Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe

Overview

General Information

Sample name:WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe
Analysis ID:1559588
MD5:9e6704727a6392d89e70695760082568
SHA1:4046c737631b58193c6241cc151564fccf5db349
SHA256:dce9c1c9802637b50c215e138a576a927a7d32e450584636cff2539b7c8436ec
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Contains functionality for read data from the clipboard
Contains functionality to shutdown / reboot the system
Detected potential crypto function
Sample file is different than original file name gathered from version info
Uses 32bit PE files

Classification

Process Tree

  • System is w10x64native
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeStatic PE information: certificate valid
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_0040626D FindFirstFileA,FindClose,0_2_0040626D
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_00405732 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405732
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_004026FE FindFirstFileA,0_2_004026FE
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/log/imp/e/chr_offer_declined/d/
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778505970.00000000004A8000.00000004.00000020.00020000.00000000.sdmp, WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/changelog
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778505970.00000000004A8000.00000004.00000020.00020000.00000000.sdmp, WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/privacy
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778505970.00000000004A8000.00000004.00000020.00020000.00000000.sdmp, WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/terms
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778505970.00000000004A8000.00000004.00000020.00020000.00000000.sdmp, WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/termshttps://wavebrowser.co/privacyhttps://wavebrowser.co/changelog
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_004051CF GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_004051CF
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,CoUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031D6
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_00404A0E0_2_00404A0E
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_004065F60_2_004065F6
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000000.73776334138.000000000043A000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameWave Browser: vs WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeBinary or memory string: OriginalFilenameWave Browser: vs WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: clean2.winEXE@1/1@0/0
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,CoUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031D6
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_0040449B GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_0040449B
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_004020D1 CoCreateInstance,MultiByteToWideChar,0_2_004020D1
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeFile created: C:\Users\user\AppData\Local\Temp\nsu1CE8.tmpJump to behavior
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeFile read: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: edgegdi.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeStatic PE information: certificate valid
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeStatic file information: File size 80737360 > 1048576
Source: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_0040626D FindFirstFileA,FindClose,0_2_0040626D
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_00405732 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405732
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_004026FE FindFirstFileA,0_2_004026FE
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeAPI call chain: ExitProcess graph end nodegraph_0-3496
Source: C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exeCode function: 0_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,CoUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031D6

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Access Token Manipulation		1
Access Token Manipulation		OS Credential Dumping2
File and Directory Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
DLL Side-Loading		LSASS Memory3
System Information Discovery		Remote Desktop Protocol1
Clipboard Data		Junk DataExfiltration Over BluetoothNetwork Denial of Service

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe3%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://nsis.sf.net/NSIS_ErrorError0%Avira URL Cloudsafe
http://nsis.sf.net/NSIS_Error0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://wavebrowser.co/termshttps://wavebrowser.co/privacyhttps://wavebrowser.co/changelogWaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778505970.00000000004A8000.00000004.00000020.00020000.00000000.sdmp, WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpfalse
    		high
    https://api.wavebrowserbase.com/log/imp/e/chr_offer_declined/d/WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      http://nsis.sf.net/NSIS_ErrorWaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exefalse
      • Avira URL Cloud: safe
      		unknown
      https://api.wavebrowserbase.com/inst/WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        http://nsis.sf.net/NSIS_ErrorErrorWaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exefalse
        • Avira URL Cloud: safe
        		unknown
        https://wavebrowser.co/termsWaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778505970.00000000004A8000.00000004.00000020.00020000.00000000.sdmp, WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          https://wavebrowser.co/changelogWaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778505970.00000000004A8000.00000004.00000020.00020000.00000000.sdmp, WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://wavebrowser.co/privacyWaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778505970.00000000004A8000.00000004.00000020.00020000.00000000.sdmp, WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, 00000000.00000002.73778957520.000000000288D000.00000004.00000020.00020000.00000000.sdmpfalse
              		high

              World Map of Contacted IPs

              ⊘No contacted IP infos

              General Information

              Joe Sandbox version:41.0.0 Charoite
              Analysis ID:1559588
              Start date and time:2024-11-20 17:41:19 +01:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:0h 4m 9s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
              Number of analysed new started processes analysed:2
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample name:WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe
              Detection:CLEAN
              Classification:clean2.winEXE@1/1@0/0
              EGA Information:
              • Successful, ratio: 100%
              HCA Information:
              • Successful, ratio: 98%
              • Number of executed functions: 36
              • Number of non-executed functions: 31
              Cookbook Comments:
              • Found application associated with file extension: .exe
              • Stop behavior analysis, all processes terminated

              Warnings

              • Exclude process from analysis (whitelisted): dllhost.exe
              • VT rate limit hit for: WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe

              Simulations

              Behavior and APIs

              ⊘No simulations

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              ⊘No context

              ASNs

              ⊘No context

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup_patch_1.5.18.2_from_1.3.16.1.packed.7z

              Download File
              Process:C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe
              File Type:7-zip archive data, version 0.4
              Category:dropped
              Size (bytes):585889
              Entropy (8bit):7.999702474255724
              Encrypted:true
              SSDEEP:12288:OwpdnfTvHr4bIx+Ls3I6aBnOnn77PkXN/Ek0MOaAmA73yPP63soXt:5b7vLsIxYs4JnW7LkXNssOgq3y63soXt
              MD5:E2A54921298CA1926008E2FC31082A71
              SHA1:2BB81A8046D382924EF8F53D1AD708C4A630A56E
              SHA-256:59291D479167E6C5CDBCDA7CC8AB35B43664BFAB480E5BCA60E4A2F98981B5FA
              SHA-512:49B925DF5444E34600F10B209DE557258AF60BB0E71EE0C06F08B6B5523ABAA122864737AB4EAC3BFD641FE6EB415EE8DF9857EA4FAC9ABA1B06CE2CA740078F
              Malicious:false
              Reputation:low
              Preview:7z..'...9g$.................RC...a..My.A6.lu.JR...w..R....5....v.....Z.;.."=..E2..v(..}..w(.[:..Sa....w..t..n....7.......lL....nQ.4...Dj..na'....r.a?..'o&..&.#sd.d...x.j:O...Z....`......C/..`...S.6...,vUW?.M.3|X-........F..xH......Q..Y~..:....C...I.VI...+.].6..._...C.ka]8.Bz.g.r....E.:S3...#%.&....KM.$..H4T.{S..O.{....Oi....`...D'.0yI.Qp..T8.9..U......K.w..sDU.0,..cj..t.s./...I..~-.=NfV2b..>..YK$..#....8l.~.N.%....xJ4.l]^)...dc.:O..k.~rK......).~.P)Xk(.2~.s34Zpv.............}.49...^.N.F@.MVO...M..b..,.xY. ./..a..C.I..(P.*...-j{..........*.E\>Y.H.o.pp.&.U...._3.5.H<...=#.^.+...O..wq.a...rUA....bCT.n..........w...-..y.../.q.........2......m..........*.z...d.D.5x..3.`.. ...i..|?....Q...w[Q....;g.Tu....._...0.D....Nr..a....).......0..P.l=...."....w.....",..jf....-.......s...EP.....X_.ulmY..>K.6.0...@ny0%M...( .....w.......c.5.;..]..0..S...&..[V....*..2....Q......g..=...0....m.cL..|.X..._..7....O.L'o$..K.E..!....I..T..q.OW...'_&9..m

              Static File Info

              General

              File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
              Entropy (8bit):7.999880962225572
              TrID:
              • Win32 Executable (generic) a (10002005/4) 99.96%
              • Generic Win/DOS Executable (2004/3) 0.02%
              • DOS Executable Generic (2002/1) 0.02%
              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
              File name:WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe
              File size:80'737'360 bytes
              MD5:9e6704727a6392d89e70695760082568
              SHA1:4046c737631b58193c6241cc151564fccf5db349
              SHA256:dce9c1c9802637b50c215e138a576a927a7d32e450584636cff2539b7c8436ec
              SHA512:7f46d2b44b03a9c91cd1dfae40f70c9ef29e052bfd463e2dcf1f9b38a5652168663723d2398617b2e3528752ea13d52f64e1672f21963d2ee52c877213bc3908
              SSDEEP:1572864:Gj2EZIcXYZcYJtArzhqcANvI29rqcHjp0fSEoILDo16+/h:u2EZExcrNdAZIo190fSNxQ+/h
              TLSH:120833565AF8DCE0F84EE1F3C21269F425C6BC02F5316117BDC67CB9F932E246A9A049
              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F...v...F...@...F.Rich..F.........................PE..L....g.f.................`.........

              File Icon

              Icon Hash:1b197a76b2d86917

              Static PE Info

              General

              Entrypoint:0x4031d6
              Entrypoint Section:.text
              Digitally signed:true
              Imagebase:0x400000
              Subsystem:windows gui
              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
              Time Stamp:0x66D867D8 [Wed Sep 4 13:59:52 2024 UTC]
              TLS Callbacks:
              CLR (.Net) Version:
              OS Version Major:4
              OS Version Minor:0
              File Version Major:4
              File Version Minor:0
              Subsystem Version Major:4
              Subsystem Version Minor:0
              Import Hash:3abe302b6d9a1256e6a915429af4ffd2

              Authenticode Signature

              Signature Valid:true
              Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
              Signature Validation Error:The operation completed successfully
              Error Number:0
              Not Before, Not After
              • 14/09/2023 02:00:00 21/07/2026 01:59:59
              Subject Chain
              • CN=Wavesor Software (Eightpoint Technologies Ltd. SEZC), O=Wavesor Software (Eightpoint Technologies Ltd. SEZC), L=George Town, C=KY, SERIALNUMBER=314202, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=KY
              Version:3
              Thumbprint MD5:AECFC3F717D06635CB33A3E5ECD51CBF
              Thumbprint SHA-1:2EA4ADE8719DE01274C5A3BAF694B91E339BDA79
              Thumbprint SHA-256:89F225CC1B03AB2BDCEF6B5D4606EEAC8B5B9CF289ED5FF3659240BCD3A7FA72
              Serial:09D77A45C1C09755AE3E7A5153983C03

              Entrypoint Preview

              Instruction
              sub esp, 00000184h
              push ebx
              push esi
              push edi
              xor ebx, ebx
              push 00008001h
              mov dword ptr [esp+18h], ebx
              mov dword ptr [esp+10h], 00409198h
              mov dword ptr [esp+20h], ebx
              mov byte ptr [esp+14h], 00000020h
              call dword ptr [004070A0h]
              call dword ptr [0040709Ch]
              and eax, BFFFFFFFh
              cmp ax, 00000006h
              mov dword ptr [0042370Ch], eax
              je 00007FB214D1D033h
              push ebx
              call 00007FB214D2010Ah
              cmp eax, ebx
              je 00007FB214D1D029h
              push 00000C00h
              call eax
              mov esi, 00407298h
              push esi
              call 00007FB214D20086h
              push esi
              call dword ptr [00407098h]
              lea esi, dword ptr [esi+eax+01h]
              cmp byte ptr [esi], bl
              jne 00007FB214D1D00Dh
              push 0000000Ah
              call 00007FB214D200DEh
              push 00000008h
              call 00007FB214D200D7h
              push 00000006h
              mov dword ptr [00423704h], eax
              call 00007FB214D200CBh
              cmp eax, ebx
              je 00007FB214D1D031h
              push 0000001Eh
              call eax
              test eax, eax
              je 00007FB214D1D029h
              or byte ptr [0042370Fh], 00000040h
              push ebp
              call dword ptr [00407044h]
              push ebx
              call dword ptr [00407288h]
              mov dword ptr [004237D8h], eax
              push ebx
              lea eax, dword ptr [esp+38h]
              push 00000160h
              push eax
              push ebx
              push 0041ECC8h
              call dword ptr [00407178h]
              push 00409188h

              Rich Headers

              Programming Language:
              • [EXP] VC++ 6.0 SP5 build 8804

              Data Directories

              NameVirtual AddressVirtual Size Is in Section
              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IMPORT0x74300xa0.rdata
              IMAGE_DIRECTORY_ENTRY_RESOURCE0x3a0000x2b900.rsrc
              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
              IMAGE_DIRECTORY_ENTRY_SECURITY0x4cfc9280x2b28
              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IAT0x70000x298.rdata
              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

              Sections

              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
              .text0x10000x5f0d0x6000a04138503cbcc902263bedc7fedd6947False0.6649576822916666data6.450391437698698IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              .rdata0x70000x12500x14004856bbf2a79b612f639ebd55d68c4d02False0.4287109375data5.001085207233966IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
              .data0x90000x1a8180x40006c5105864978df88e34770eefada5daFalse0.6376953125data5.129587811765307IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              .ndata0x240000x160000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              .rsrc0x3a0000x2b9000x2ba008d3197cdc9fc5da2b6585c96a1558b67False0.33579199498567336data5.624486507936371IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

              Resources

              NameRVASizeTypeLanguageCountryZLIB Complexity
              RT_ICON0x3a3880x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/mEnglishUnited States0.14971016207263693
              RT_ICON0x4abb00x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 3779 x 3779 px/mEnglishUnited States0.19292621400042043
              RT_ICON0x540580x6573PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.998767856455277
              RT_ICON0x5a5d00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/mEnglishUnited States0.2827113840340104
              RT_ICON0x5e7f80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/mEnglishUnited States0.35643153526970955
              RT_ICON0x60da00x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 6400, resolution 3779 x 3779 px/mEnglishUnited States0.39571005917159763
              RT_ICON0x628080x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/mEnglishUnited States0.47303001876172607
              RT_ICON0x638b00x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 3779 x 3779 px/mEnglishUnited States0.5651639344262295
              RT_ICON0x642380x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 1600, resolution 3779 x 3779 px/mEnglishUnited States0.6122093023255814
              RT_ICON0x648f00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/mEnglishUnited States0.7047872340425532
              RT_DIALOG0x64d580x202dataEnglishUnited States0.4182879377431907
              RT_DIALOG0x64f600xf8dataEnglishUnited States0.6330645161290323
              RT_DIALOG0x650580xeedataEnglishUnited States0.6260504201680672
              RT_GROUP_ICON0x651480x92dataEnglishUnited States0.7054794520547946
              RT_VERSION0x651e00x2f8dataEnglishUnited States0.45
              RT_MANIFEST0x654d80x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

              Imports

              DLLImport
              KERNEL32.dllGetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetCurrentDirectoryA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileAttributesA, GetFileAttributesA, GetShortPathNameA, MoveFileA, GetFullPathNameA, SetFileTime, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA
              USER32.dllScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
              GDI32.dllSelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
              SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA
              ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
              COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
              ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

              Possible Origin

              Language of compilation systemCountry where language is spokenMap
              EnglishUnited States

              Network Behavior

              ⊘No network behavior found

              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              High Level Behavior Distribution

              Click to dive into process behavior distribution

              System Behavior

              General

              Target ID:0
              Start time:11:43:26
              Start date:20/11/2024
              Path:C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe
              Wow64 process (32bit):true
              Commandline:"C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe"
              Imagebase:0x400000
              File size:80'737'360 bytes
              MD5 hash:9E6704727A6392D89E70695760082568
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:low
              Has exited:true

              Disassembly

              Reset < >

                Execution Graph

                Execution Coverage:15.2%
                Dynamic/Decrypted Code Coverage:0%
                Signature Coverage:21.3%
                Total number of Nodes:1287
                Total number of Limit Nodes:25
                execution_graph 3683 402340 3684 402acb 17 API calls 3683->3684 3685 402351 3684->3685 3686 402acb 17 API calls 3685->3686 3687 40235a 3686->3687 3688 402acb 17 API calls 3687->3688 3689 402364 GetPrivateProfileStringA 3688->3689 3690 401d41 GetDlgItem GetClientRect 3691 402acb 17 API calls 3690->3691 3692 401d71 LoadImageA SendMessageA 3691->3692 3693 402957 3692->3693 3694 401d8f DeleteObject 3692->3694 3694->3693 3294 401746 3295 402acb 17 API calls 3294->3295 3296 40174d 3295->3296 3300 405b32 3296->3300 3298 401754 3299 405b32 2 API calls 3298->3299 3299->3298 3301 405b3d GetTickCount GetTempFileNameA 3300->3301 3302 405b6e 3301->3302 3303 405b6a 3301->3303 3302->3298 3303->3301 3303->3302 3702 401947 3703 402acb 17 API calls 3702->3703 3704 40194e lstrlenA 3703->3704 3705 40257d 3704->3705 3709 4025ca 3718 402aa9 3709->3718 3711 402642 3712 405b7b ReadFile 3715 4025d4 3712->3715 3713 402644 3721 405ec8 wsprintfA 3713->3721 3714 402654 3714->3711 3717 40266a SetFilePointer 3714->3717 3715->3711 3715->3712 3715->3713 3715->3714 3717->3711 3719 405f8c 17 API calls 3718->3719 3720 402abe 3719->3720 3720->3715 3721->3711 3722 40224b 3723 402acb 17 API calls 3722->3723 3724 402251 3723->3724 3725 402acb 17 API calls 3724->3725 3726 40225a 3725->3726 3727 402acb 17 API calls 3726->3727 3728 402263 3727->3728 3729 40626d 2 API calls 3728->3729 3730 40226c 3729->3730 3731 40227d lstrlenA lstrlenA 3730->3731 3735 402270 3730->3735 3733 405091 24 API calls 3731->3733 3732 405091 24 API calls 3736 402278 3732->3736 3734 4022b9 SHFileOperationA 3733->3734 3734->3735 3734->3736 3735->3732 3737 4028cb 3738 402aa9 17 API calls 3737->3738 3739 4028d1 3738->3739 3740 402906 3739->3740 3742 40271c 3739->3742 3743 4028e3 3739->3743 3741 405f8c 17 API calls 3740->3741 3740->3742 3741->3742 3743->3742 3745 405ec8 wsprintfA 3743->3745 3745->3742 3746 4022cd 3747 4022d4 3746->3747 3750 4022e7 3746->3750 3748 405f8c 17 API calls 3747->3748 3749 4022e1 3748->3749 3751 405686 MessageBoxIndirectA 3749->3751 3751->3750 3752 4051cf 3753 4051f1 GetDlgItem GetDlgItem GetDlgItem 3752->3753 3754 40537a 3752->3754 3797 40403e SendMessageA 3753->3797 3756 405382 GetDlgItem CreateThread CloseHandle 3754->3756 3757 4053aa 3754->3757 3756->3757 3758 4053d8 3757->3758 3761 4053c0 ShowWindow ShowWindow 3757->3761 3762 4053f9 3757->3762 3759 405433 3758->3759 3763 4053e8 3758->3763 3764 40540c ShowWindow 3758->3764 3759->3762 3774 405440 SendMessageA 3759->3774 3760 405261 3766 405268 GetClientRect GetSystemMetrics SendMessageA SendMessageA 3760->3766 3802 40403e SendMessageA 3761->3802 3806 404070 3762->3806 3803 403fe2 3763->3803 3770 40542c 3764->3770 3771 40541e 3764->3771 3772 4052d6 3766->3772 3773 4052ba SendMessageA SendMessageA 3766->3773 3769 405405 3776 403fe2 SendMessageA 3770->3776 3775 405091 24 API calls 3771->3775 3777 4052e9 3772->3777 3778 4052db SendMessageA 3772->3778 3773->3772 3774->3769 3779 405459 CreatePopupMenu 3774->3779 3775->3770 3776->3759 3798 404009 3777->3798 3778->3777 3781 405f8c 17 API calls 3779->3781 3782 405469 AppendMenuA 3781->3782 3784 405487 GetWindowRect 3782->3784 3785 40549a TrackPopupMenu 3782->3785 3783 4052f9 3786 405302 ShowWindow 3783->3786 3787 405336 GetDlgItem SendMessageA 3783->3787 3784->3785 3785->3769 3788 4054b6 3785->3788 3789 405325 3786->3789 3790 405318 ShowWindow 3786->3790 3787->3769 3791 40535d SendMessageA SendMessageA 3787->3791 3792 4054d5 SendMessageA 3788->3792 3801 40403e SendMessageA 3789->3801 3790->3789 3791->3769 3792->3792 3793 4054f2 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3792->3793 3795 405514 SendMessageA 3793->3795 3795->3795 3796 405536 GlobalUnlock SetClipboardData CloseClipboard 3795->3796 3796->3769 3797->3760 3799 405f8c 17 API calls 3798->3799 3800 404014 SetDlgItemTextA 3799->3800 3800->3783 3801->3787 3802->3758 3804 403fe9 3803->3804 3805 403fef SendMessageA 3803->3805 3804->3805 3805->3762 3807 404088 GetWindowLongA 3806->3807 3808 404133 3806->3808 3807->3808 3809 40409d 3807->3809 3808->3769 3809->3808 3810 4040ca GetSysColor 3809->3810 3811 4040cd 3809->3811 3810->3811 3812 4040d3 SetTextColor 3811->3812 3813 4040dd SetBkMode 3811->3813 3812->3813 3814 4040f5 GetSysColor 3813->3814 3815 4040fb 3813->3815 3814->3815 3816 404102 SetBkColor 3815->3816 3817 40410c 3815->3817 3816->3817 3817->3808 3818 404126 CreateBrushIndirect 3817->3818 3819 40411f DeleteObject 3817->3819 3818->3808 3819->3818 3820 4020d1 3821 402acb 17 API calls 3820->3821 3822 4020d8 3821->3822 3823 402acb 17 API calls 3822->3823 3824 4020e2 3823->3824 3825 402acb 17 API calls 3824->3825 3826 4020ec 3825->3826 3827 402acb 17 API calls 3826->3827 3828 4020f6 3827->3828 3829 402acb 17 API calls 3828->3829 3831 402100 3829->3831 3830 402142 CoCreateInstance 3835 402161 3830->3835 3837 40220c 3830->3837 3831->3830 3832 402acb 17 API calls 3831->3832 3832->3830 3833 401423 24 API calls 3834 402242 3833->3834 3836 4021ec MultiByteToWideChar 3835->3836 3835->3837 3836->3837 3837->3833 3837->3834 3838 404454 3839 404464 3838->3839 3840 40448a 3838->3840 3841 404009 18 API calls 3839->3841 3842 404070 8 API calls 3840->3842 3843 404471 SetDlgItemTextA 3841->3843 3844 404496 3842->3844 3843->3840 3845 4026d4 3846 4026da 3845->3846 3847 4026de FindNextFileA 3846->3847 3850 4026f0 3846->3850 3848 40272f 3847->3848 3847->3850 3851 405f6a lstrcpynA 3848->3851 3851->3850 3304 4031d6 SetErrorMode GetVersion 3305 403217 3304->3305 3306 40321d 3304->3306 3307 406302 5 API calls 3305->3307 3308 406294 3 API calls 3306->3308 3307->3306 3309 403233 lstrlenA 3308->3309 3309->3306 3310 403242 3309->3310 3311 406302 5 API calls 3310->3311 3312 403249 3311->3312 3313 406302 5 API calls 3312->3313 3314 403250 3313->3314 3315 406302 5 API calls 3314->3315 3316 40325c #17 OleInitialize SHGetFileInfoA 3315->3316 3394 405f6a lstrcpynA 3316->3394 3319 4032a8 GetCommandLineA 3395 405f6a lstrcpynA 3319->3395 3321 4032ba 3322 40592d CharNextA 3321->3322 3323 4032e3 CharNextA 3322->3323 3328 4032f3 3323->3328 3324 4033bd 3325 4033d0 GetTempPathA 3324->3325 3396 4031a5 3325->3396 3327 4033e8 3329 403442 DeleteFileA 3327->3329 3330 4033ec GetWindowsDirectoryA lstrcatA 3327->3330 3328->3324 3331 40592d CharNextA 3328->3331 3335 4033bf 3328->3335 3406 402d63 GetTickCount GetModuleFileNameA 3329->3406 3332 4031a5 12 API calls 3330->3332 3331->3328 3334 403408 3332->3334 3334->3329 3338 40340c GetTempPathA lstrcatA SetEnvironmentVariableA SetEnvironmentVariableA 3334->3338 3491 405f6a lstrcpynA 3335->3491 3336 403456 3339 4034f0 ExitProcess CoUninitialize 3336->3339 3348 40592d CharNextA 3336->3348 3377 4034dc 3336->3377 3342 4031a5 12 API calls 3338->3342 3340 403624 3339->3340 3341 403506 3339->3341 3344 4036a6 ExitProcess 3340->3344 3345 40362c GetCurrentProcess OpenProcessToken 3340->3345 3494 405686 3341->3494 3346 40343a 3342->3346 3352 403677 3345->3352 3353 403647 LookupPrivilegeValueA AdjustTokenPrivileges 3345->3353 3346->3329 3346->3339 3349 403471 3348->3349 3356 4034b7 3349->3356 3357 40351c 3349->3357 3355 406302 5 API calls 3352->3355 3353->3352 3367 40367e 3355->3367 3359 4059f0 18 API calls 3356->3359 3498 4055f1 3357->3498 3366 4034c2 3359->3366 3360 403693 ExitWindowsEx 3360->3344 3362 40369f 3360->3362 3514 40140b 3362->3514 3364 403532 lstrcatA 3365 40353d lstrcatA lstrcmpiA 3364->3365 3365->3339 3368 403559 3365->3368 3366->3339 3492 405f6a lstrcpynA 3366->3492 3367->3360 3367->3362 3370 403565 3368->3370 3371 40355e 3368->3371 3506 4055d4 CreateDirectoryA 3370->3506 3501 405557 CreateDirectoryA 3371->3501 3372 4034d1 3493 405f6a lstrcpynA 3372->3493 3434 403798 3377->3434 3378 40356a SetCurrentDirectoryA 3379 403584 3378->3379 3380 403579 3378->3380 3510 405f6a lstrcpynA 3379->3510 3509 405f6a lstrcpynA 3380->3509 3383 405f8c 17 API calls 3384 4035c3 DeleteFileA 3383->3384 3385 4035d0 CopyFileA 3384->3385 3391 403592 3384->3391 3385->3391 3386 403618 3387 405d49 36 API calls 3386->3387 3389 40361f 3387->3389 3388 405d49 36 API calls 3388->3391 3389->3339 3390 405f8c 17 API calls 3390->3391 3391->3383 3391->3386 3391->3388 3391->3390 3393 403604 CloseHandle 3391->3393 3511 405609 CreateProcessA 3391->3511 3393->3391 3394->3319 3395->3321 3397 4061d4 5 API calls 3396->3397 3399 4031b1 3397->3399 3398 4031bb 3398->3327 3399->3398 3400 405902 3 API calls 3399->3400 3401 4031c3 3400->3401 3402 4055d4 2 API calls 3401->3402 3403 4031c9 3402->3403 3404 405b32 2 API calls 3403->3404 3405 4031d4 3404->3405 3405->3327 3517 405b03 GetFileAttributesA CreateFileA 3406->3517 3408 402da3 3429 402db3 3408->3429 3518 405f6a lstrcpynA 3408->3518 3410 402dc9 3411 405949 2 API calls 3410->3411 3412 402dcf 3411->3412 3519 405f6a lstrcpynA 3412->3519 3414 402dda GetFileSize 3415 402ed6 3414->3415 3427 402df1 3414->3427 3520 402cff 3415->3520 3417 402edf 3419 402f0f GlobalAlloc 3417->3419 3417->3429 3558 40318e SetFilePointer 3417->3558 3531 40318e SetFilePointer 3419->3531 3421 402f42 3425 402cff 6 API calls 3421->3425 3423 402ef8 3426 403178 ReadFile 3423->3426 3424 402f2a 3532 402f9c 3424->3532 3425->3429 3430 402f03 3426->3430 3427->3415 3427->3421 3427->3429 3431 402cff 6 API calls 3427->3431 3555 403178 3427->3555 3429->3336 3430->3419 3430->3429 3431->3427 3432 402f36 3432->3429 3432->3432 3433 402f73 SetFilePointer 3432->3433 3433->3429 3435 406302 5 API calls 3434->3435 3436 4037ac 3435->3436 3437 4037b2 3436->3437 3438 4037c4 3436->3438 3580 405ec8 wsprintfA 3437->3580 3439 405e51 3 API calls 3438->3439 3440 4037ef 3439->3440 3442 40380d lstrcatA 3440->3442 3444 405e51 3 API calls 3440->3444 3443 4037c2 3442->3443 3572 403a5d 3443->3572 3444->3442 3447 4059f0 18 API calls 3448 40383f 3447->3448 3449 4038c8 3448->3449 3452 405e51 3 API calls 3448->3452 3450 4059f0 18 API calls 3449->3450 3451 4038ce 3450->3451 3454 4038de LoadImageA 3451->3454 3455 405f8c 17 API calls 3451->3455 3453 40386b 3452->3453 3453->3449 3458 403887 lstrlenA 3453->3458 3462 40592d CharNextA 3453->3462 3456 403984 3454->3456 3457 403905 RegisterClassA 3454->3457 3455->3454 3461 40140b 2 API calls 3456->3461 3459 4034ec 3457->3459 3460 40393b SystemParametersInfoA CreateWindowExA 3457->3460 3463 403895 lstrcmpiA 3458->3463 3464 4038bb 3458->3464 3459->3339 3460->3456 3465 40398a 3461->3465 3466 403885 3462->3466 3463->3464 3467 4038a5 GetFileAttributesA 3463->3467 3468 405902 3 API calls 3464->3468 3465->3459 3470 403a5d 18 API calls 3465->3470 3466->3458 3469 4038b1 3467->3469 3471 4038c1 3468->3471 3469->3464 3472 405949 2 API calls 3469->3472 3473 40399b 3470->3473 3581 405f6a lstrcpynA 3471->3581 3472->3464 3475 4039a7 ShowWindow 3473->3475 3476 403a2a 3473->3476 3478 406294 3 API calls 3475->3478 3582 405163 OleInitialize 3476->3582 3479 4039bf 3478->3479 3481 4039cd GetClassInfoA 3479->3481 3484 406294 3 API calls 3479->3484 3480 403a30 3482 403a34 3480->3482 3483 403a4c 3480->3483 3486 4039e1 GetClassInfoA RegisterClassA 3481->3486 3487 4039f7 DialogBoxParamA 3481->3487 3482->3459 3489 40140b 2 API calls 3482->3489 3485 40140b 2 API calls 3483->3485 3484->3481 3485->3459 3486->3487 3488 40140b 2 API calls 3487->3488 3490 403a1f 3488->3490 3489->3459 3490->3459 3491->3325 3492->3372 3493->3377 3495 40569b 3494->3495 3496 403514 ExitProcess 3495->3496 3497 4056af MessageBoxIndirectA 3495->3497 3497->3496 3499 406302 5 API calls 3498->3499 3500 403521 lstrcatA 3499->3500 3500->3364 3500->3365 3502 403563 3501->3502 3503 4055a8 GetLastError 3501->3503 3502->3378 3503->3502 3504 4055b7 SetFileSecurityA 3503->3504 3504->3502 3505 4055cd GetLastError 3504->3505 3505->3502 3507 4055e4 3506->3507 3508 4055e8 GetLastError 3506->3508 3507->3378 3508->3507 3509->3379 3510->3391 3512 405648 3511->3512 3513 40563c CloseHandle 3511->3513 3512->3391 3513->3512 3515 401389 2 API calls 3514->3515 3516 401420 3515->3516 3516->3344 3517->3408 3518->3410 3519->3414 3521 402d20 3520->3521 3522 402d08 3520->3522 3523 402d30 GetTickCount 3521->3523 3524 402d28 3521->3524 3525 402d11 DestroyWindow 3522->3525 3526 402d18 3522->3526 3528 402d61 3523->3528 3529 402d3e CreateDialogParamA ShowWindow 3523->3529 3559 40633e 3524->3559 3525->3526 3526->3417 3528->3417 3529->3528 3531->3424 3534 402fb2 3532->3534 3533 402fdd 3536 403178 ReadFile 3533->3536 3534->3533 3571 40318e SetFilePointer 3534->3571 3537 402fe8 3536->3537 3538 403118 3537->3538 3539 402ffa GetTickCount 3537->3539 3547 403110 3537->3547 3540 40311c 3538->3540 3541 403134 3538->3541 3548 40300d 3539->3548 3542 403178 ReadFile 3540->3542 3543 403178 ReadFile 3541->3543 3545 405baa WriteFile 3541->3545 3541->3547 3542->3547 3543->3541 3544 403178 ReadFile 3544->3548 3545->3541 3547->3432 3548->3544 3548->3547 3549 403073 GetTickCount 3548->3549 3563 406447 3548->3563 3554 40308c 3549->3554 3550 40309c MulDiv wsprintfA 3552 405091 24 API calls 3550->3552 3551 403102 3551->3547 3552->3554 3553 405baa WriteFile 3553->3554 3554->3547 3554->3548 3554->3550 3554->3551 3554->3553 3556 405b7b ReadFile 3555->3556 3557 40318b 3556->3557 3557->3427 3558->3423 3560 40635b PeekMessageA 3559->3560 3561 406351 DispatchMessageA 3560->3561 3562 402d2e 3560->3562 3561->3560 3562->3417 3564 40646c 3563->3564 3565 406474 3563->3565 3564->3548 3565->3564 3566 406504 GlobalAlloc 3565->3566 3567 4064fb GlobalFree 3565->3567 3568 406572 GlobalFree 3565->3568 3569 40657b GlobalAlloc 3565->3569 3566->3564 3570 406518 3566->3570 3567->3566 3568->3569 3569->3564 3569->3565 3570->3565 3571->3533 3573 403a71 3572->3573 3589 405ec8 wsprintfA 3573->3589 3575 403ae2 3590 403b16 3575->3590 3577 40381d 3577->3447 3578 403ae7 3578->3577 3579 405f8c 17 API calls 3578->3579 3579->3578 3580->3443 3581->3449 3593 404055 3582->3593 3584 4051ad 3585 404055 SendMessageA 3584->3585 3586 4051bf OleUninitialize 3585->3586 3586->3480 3587 405186 3587->3584 3596 401389 3587->3596 3589->3575 3591 405f8c 17 API calls 3590->3591 3592 403b24 SetWindowTextA 3591->3592 3592->3578 3594 40406d 3593->3594 3595 40405e SendMessageA 3593->3595 3594->3587 3595->3594 3598 401390 3596->3598 3597 4013fe 3597->3587 3598->3597 3599 4013cb MulDiv SendMessageA 3598->3599 3599->3598 3852 403756 3853 403761 3852->3853 3854 403765 3853->3854 3855 403768 GlobalAlloc 3853->3855 3855->3854 3856 4014d6 3857 402aa9 17 API calls 3856->3857 3858 4014dc Sleep 3857->3858 3860 402957 3858->3860 3861 4023d6 3862 402acb 17 API calls 3861->3862 3863 4023e8 3862->3863 3864 402acb 17 API calls 3863->3864 3865 4023f2 3864->3865 3878 402b5b 3865->3878 3868 402427 3870 402433 3868->3870 3873 402aa9 17 API calls 3868->3873 3869 402acb 17 API calls 3872 402420 lstrlenA 3869->3872 3874 402452 RegSetValueExA 3870->3874 3875 402f9c 35 API calls 3870->3875 3871 40271c 3872->3868 3873->3870 3876 402468 RegCloseKey 3874->3876 3875->3874 3876->3871 3879 402b76 3878->3879 3882 405e1e 3879->3882 3883 405e2d 3882->3883 3884 402402 3883->3884 3885 405e38 RegCreateKeyExA 3883->3885 3884->3868 3884->3869 3884->3871 3885->3884 3600 401759 3601 402acb 17 API calls 3600->3601 3602 401760 3601->3602 3603 401786 3602->3603 3604 40177e 3602->3604 3640 405f6a lstrcpynA 3603->3640 3639 405f6a lstrcpynA 3604->3639 3607 401784 3611 4061d4 5 API calls 3607->3611 3608 401791 3609 405902 3 API calls 3608->3609 3610 401797 lstrcatA 3609->3610 3610->3607 3623 4017a3 3611->3623 3612 40626d 2 API calls 3612->3623 3613 405ade 2 API calls 3613->3623 3615 4017ba CompareFileTime 3615->3623 3616 40187e 3617 405091 24 API calls 3616->3617 3618 401888 3617->3618 3621 402f9c 35 API calls 3618->3621 3619 405091 24 API calls 3622 40186a 3619->3622 3620 405f6a lstrcpynA 3620->3623 3624 40189b 3621->3624 3623->3612 3623->3613 3623->3615 3623->3616 3623->3620 3626 405f8c 17 API calls 3623->3626 3633 405686 MessageBoxIndirectA 3623->3633 3637 401855 3623->3637 3638 405b03 GetFileAttributesA CreateFileA 3623->3638 3625 4018af SetFileTime 3624->3625 3627 4018c1 CloseHandle 3624->3627 3625->3627 3626->3623 3627->3622 3628 4018d2 3627->3628 3629 4018d7 3628->3629 3630 4018ea 3628->3630 3631 405f8c 17 API calls 3629->3631 3632 405f8c 17 API calls 3630->3632 3634 4018df lstrcatA 3631->3634 3635 4018f2 3632->3635 3633->3623 3634->3635 3636 405686 MessageBoxIndirectA 3635->3636 3636->3622 3637->3619 3637->3622 3638->3623 3639->3607 3640->3608 3886 401659 3887 402acb 17 API calls 3886->3887 3888 40165f 3887->3888 3889 40626d 2 API calls 3888->3889 3890 401665 3889->3890 3891 401959 3892 402aa9 17 API calls 3891->3892 3893 401960 3892->3893 3894 402aa9 17 API calls 3893->3894 3895 40196d 3894->3895 3896 402acb 17 API calls 3895->3896 3897 401984 lstrlenA 3896->3897 3899 401994 3897->3899 3898 4019d4 3899->3898 3903 405f6a lstrcpynA 3899->3903 3901 4019c4 3901->3898 3902 4019c9 lstrlenA 3901->3902 3902->3898 3903->3901 3904 401cda 3905 402aa9 17 API calls 3904->3905 3906 401ce0 IsWindow 3905->3906 3907 401a0e 3906->3907 3915 401a5e 3916 402aa9 17 API calls 3915->3916 3917 401a67 3916->3917 3918 402aa9 17 API calls 3917->3918 3919 401a0e 3918->3919 3920 401f61 3921 402acb 17 API calls 3920->3921 3922 401f68 3921->3922 3923 406302 5 API calls 3922->3923 3924 401f77 3923->3924 3925 401f8f GlobalAlloc 3924->3925 3927 401ff7 3924->3927 3926 401fa3 3925->3926 3925->3927 3928 406302 5 API calls 3926->3928 3929 401faa 3928->3929 3930 406302 5 API calls 3929->3930 3931 401fb4 3930->3931 3931->3927 3935 405ec8 wsprintfA 3931->3935 3933 401feb 3936 405ec8 wsprintfA 3933->3936 3935->3933 3936->3927 3937 402561 3938 402acb 17 API calls 3937->3938 3939 402568 3938->3939 3942 405b03 GetFileAttributesA CreateFileA 3939->3942 3941 402574 3942->3941 3943 401563 3944 4028ff 3943->3944 3947 405ec8 wsprintfA 3944->3947 3946 402904 3947->3946 3948 4024e5 3949 402b0b 17 API calls 3948->3949 3950 4024ef 3949->3950 3951 402aa9 17 API calls 3950->3951 3952 4024f8 3951->3952 3953 402513 RegEnumKeyA 3952->3953 3954 40251f RegEnumValueA 3952->3954 3956 40271c 3952->3956 3955 402534 RegCloseKey 3953->3955 3954->3955 3955->3956 3965 40166a 3966 402acb 17 API calls 3965->3966 3967 401671 3966->3967 3968 402acb 17 API calls 3967->3968 3969 40167a 3968->3969 3970 402acb 17 API calls 3969->3970 3971 401683 MoveFileA 3970->3971 3972 401696 3971->3972 3978 40168f 3971->3978 3974 40626d 2 API calls 3972->3974 3976 402242 3972->3976 3973 401423 24 API calls 3973->3976 3975 4016a5 3974->3975 3975->3976 3977 405d49 36 API calls 3975->3977 3977->3978 3978->3973 3979 4047ec 3980 404818 3979->3980 3981 4047fc 3979->3981 3982 40484b 3980->3982 3983 40481e SHGetPathFromIDListA 3980->3983 3990 40566a GetDlgItemTextA 3981->3990 3986 404835 SendMessageA 3983->3986 3987 40482e 3983->3987 3985 404809 SendMessageA 3985->3980 3986->3982 3988 40140b 2 API calls 3987->3988 3988->3986 3990->3985 3991 4019ed 3992 402acb 17 API calls 3991->3992 3993 4019f4 3992->3993 3994 402acb 17 API calls 3993->3994 3995 4019fd 3994->3995 3996 401a04 lstrcmpiA 3995->3996 3997 401a16 lstrcmpA 3995->3997 3998 401a0a 3996->3998 3997->3998 3999 40156f 4000 401586 3999->4000 4001 40157f ShowWindow 3999->4001 4002 401594 ShowWindow 4000->4002 4003 402957 4000->4003 4001->4000 4002->4003 3282 402473 3283 402b0b 17 API calls 3282->3283 3284 40247d 3283->3284 3285 402acb 17 API calls 3284->3285 3286 402486 3285->3286 3287 402490 RegQueryValueExA 3286->3287 3288 40271c 3286->3288 3289 4024b0 3287->3289 3292 4024b6 RegCloseKey 3287->3292 3289->3292 3293 405ec8 wsprintfA 3289->3293 3292->3288 3293->3292 4004 404174 4005 40418a 4004->4005 4013 404296 4004->4013 4007 404009 18 API calls 4005->4007 4006 404305 4008 4043cf 4006->4008 4009 40430f GetDlgItem 4006->4009 4010 4041e0 4007->4010 4015 404070 8 API calls 4008->4015 4011 404325 4009->4011 4012 40438d 4009->4012 4014 404009 18 API calls 4010->4014 4011->4012 4018 40434b SendMessageA LoadCursorA SetCursor 4011->4018 4012->4008 4019 40439f 4012->4019 4013->4006 4013->4008 4016 4042da GetDlgItem SendMessageA 4013->4016 4017 4041ed CheckDlgButton 4014->4017 4029 4043ca 4015->4029 4037 40402b EnableWindow 4016->4037 4035 40402b EnableWindow 4017->4035 4041 404418 4018->4041 4024 4043a5 SendMessageA 4019->4024 4025 4043b6 4019->4025 4021 404300 4038 4043f4 4021->4038 4024->4025 4025->4029 4030 4043bc SendMessageA 4025->4030 4027 40420b GetDlgItem 4036 40403e SendMessageA 4027->4036 4030->4029 4032 404221 SendMessageA 4033 404248 SendMessageA SendMessageA lstrlenA SendMessageA SendMessageA 4032->4033 4034 40423f GetSysColor 4032->4034 4033->4029 4034->4033 4035->4027 4036->4032 4037->4021 4039 404402 4038->4039 4040 404407 SendMessageA 4038->4040 4039->4040 4040->4006 4044 40564c ShellExecuteExA 4041->4044 4043 40437e LoadCursorA SetCursor 4043->4012 4044->4043 4045 4014f4 SetForegroundWindow 4046 402957 4045->4046 4047 4065f6 4049 40647a 4047->4049 4048 406de5 4049->4048 4050 406504 GlobalAlloc 4049->4050 4051 4064fb GlobalFree 4049->4051 4052 406572 GlobalFree 4049->4052 4053 40657b GlobalAlloc 4049->4053 4050->4048 4050->4049 4051->4050 4052->4053 4053->4048 4053->4049 4054 406377 WaitForSingleObject 4055 406391 4054->4055 4056 4063a3 GetExitCodeProcess 4055->4056 4057 40633e 2 API calls 4055->4057 4058 406398 WaitForSingleObject 4057->4058 4058->4055 4059 401cfb 4060 402aa9 17 API calls 4059->4060 4061 401d02 4060->4061 4062 402aa9 17 API calls 4061->4062 4063 401d0e GetDlgItem 4062->4063 4064 40257d 4063->4064 4065 402c7c 4066 402ca4 4065->4066 4067 402c8b SetTimer 4065->4067 4068 402cf9 4066->4068 4069 402cbe MulDiv wsprintfA SetWindowTextA SetDlgItemTextA 4066->4069 4067->4066 4069->4068 4070 4022fc 4071 402304 4070->4071 4072 40230a 4070->4072 4073 402acb 17 API calls 4071->4073 4074 402acb 17 API calls 4072->4074 4075 40231a 4072->4075 4073->4072 4074->4075 4076 402328 4075->4076 4077 402acb 17 API calls 4075->4077 4078 402acb 17 API calls 4076->4078 4077->4076 4079 402331 WritePrivateProfileStringA 4078->4079 4080 4018fd 4081 401934 4080->4081 4082 402acb 17 API calls 4081->4082 4083 401939 4082->4083 4084 405732 67 API calls 4083->4084 4085 401942 4084->4085 4086 4026fe 4087 402acb 17 API calls 4086->4087 4088 402705 FindFirstFileA 4087->4088 4089 402728 4088->4089 4093 402718 4088->4093 4090 40272f 4089->4090 4094 405ec8 wsprintfA 4089->4094 4095 405f6a lstrcpynA 4090->4095 4094->4090 4095->4093 4103 401000 4104 401037 BeginPaint GetClientRect 4103->4104 4105 40100c DefWindowProcA 4103->4105 4107 4010f3 4104->4107 4108 401179 4105->4108 4109 401073 CreateBrushIndirect FillRect DeleteObject 4107->4109 4110 4010fc 4107->4110 4109->4107 4111 401102 CreateFontIndirectA 4110->4111 4112 401167 EndPaint 4110->4112 4111->4112 4113 401112 6 API calls 4111->4113 4112->4108 4113->4112 4114 401900 4115 402acb 17 API calls 4114->4115 4116 401907 4115->4116 4117 405686 MessageBoxIndirectA 4116->4117 4118 401910 4117->4118 3052 402381 3053 4023b3 3052->3053 3054 402388 3052->3054 3055 402acb 17 API calls 3053->3055 3064 402b0b 3054->3064 3057 4023ba 3055->3057 3075 402b89 3057->3075 3060 402399 3069 402acb 3060->3069 3063 4023c7 3065 402acb 17 API calls 3064->3065 3066 402b22 3065->3066 3079 405df0 3066->3079 3070 402ad7 3069->3070 3083 405f8c 3070->3083 3073 4023a0 RegDeleteValueA RegCloseKey 3073->3063 3076 402b9c 3075->3076 3077 402b95 3075->3077 3076->3077 3121 402bcd 3076->3121 3077->3063 3080 405dff 3079->3080 3081 40238f 3080->3081 3082 405e08 RegOpenKeyExA 3080->3082 3081->3060 3081->3063 3082->3081 3091 405f99 3083->3091 3084 4061bb 3085 402af8 3084->3085 3116 405f6a lstrcpynA 3084->3116 3085->3073 3100 4061d4 3085->3100 3087 406195 lstrlenA 3087->3091 3088 405f8c 10 API calls 3088->3087 3091->3084 3091->3087 3091->3088 3093 4060b1 GetSystemDirectoryA 3091->3093 3094 4060c4 GetWindowsDirectoryA 3091->3094 3095 4061d4 5 API calls 3091->3095 3096 405f8c 10 API calls 3091->3096 3097 40613e lstrcatA 3091->3097 3098 4060f8 SHGetSpecialFolderLocation 3091->3098 3109 405e51 3091->3109 3114 405ec8 wsprintfA 3091->3114 3115 405f6a lstrcpynA 3091->3115 3093->3091 3094->3091 3095->3091 3096->3091 3097->3091 3098->3091 3099 406110 SHGetPathFromIDListA CoTaskMemFree 3098->3099 3099->3091 3106 4061e0 3100->3106 3101 406248 3102 40624c CharPrevA 3101->3102 3104 406267 3101->3104 3102->3101 3103 40623d CharNextA 3103->3101 3103->3106 3104->3073 3106->3101 3106->3103 3107 40622b CharNextA 3106->3107 3108 406238 CharNextA 3106->3108 3117 40592d 3106->3117 3107->3106 3108->3103 3110 405df0 RegOpenKeyExA 3109->3110 3111 405e7e 3110->3111 3112 405eb4 3111->3112 3113 405e85 RegQueryValueExA RegCloseKey 3111->3113 3112->3091 3113->3112 3114->3091 3115->3091 3116->3085 3118 405933 3117->3118 3119 405946 3118->3119 3120 405939 CharNextA 3118->3120 3119->3106 3120->3118 3122 405df0 RegOpenKeyExA 3121->3122 3123 402bfb 3122->3123 3124 402c21 RegEnumKeyA 3123->3124 3125 402c38 RegCloseKey 3123->3125 3126 402c59 RegCloseKey 3123->3126 3128 402bcd 6 API calls 3123->3128 3131 402c4c 3123->3131 3124->3123 3124->3125 3132 406302 GetModuleHandleA 3125->3132 3126->3131 3128->3123 3130 402c69 RegDeleteKeyA 3130->3131 3131->3077 3133 406328 GetProcAddress 3132->3133 3134 40631e 3132->3134 3136 402c48 3133->3136 3138 406294 GetSystemDirectoryA 3134->3138 3136->3130 3136->3131 3137 406324 3137->3133 3137->3136 3139 4062b6 wsprintfA LoadLibraryExA 3138->3139 3139->3137 4119 401502 4120 40150a 4119->4120 4122 40151d 4119->4122 4121 402aa9 17 API calls 4120->4121 4121->4122 4123 402003 4124 402015 4123->4124 4125 4020c3 4123->4125 4126 402acb 17 API calls 4124->4126 4127 401423 24 API calls 4125->4127 4128 40201c 4126->4128 4134 402242 4127->4134 4129 402acb 17 API calls 4128->4129 4130 402025 4129->4130 4131 40203a LoadLibraryExA 4130->4131 4132 40202d GetModuleHandleA 4130->4132 4131->4125 4133 40204a GetProcAddress 4131->4133 4132->4131 4132->4133 4135 402096 4133->4135 4136 402059 4133->4136 4137 405091 24 API calls 4135->4137 4138 401423 24 API calls 4136->4138 4139 402069 4136->4139 4137->4139 4138->4139 4139->4134 4140 4020b7 FreeLibrary 4139->4140 4140->4134 4141 402583 4142 402588 4141->4142 4143 40259c 4141->4143 4144 402aa9 17 API calls 4142->4144 4145 402acb 17 API calls 4143->4145 4146 402591 4144->4146 4147 4025a3 lstrlenA 4145->4147 4148 4025c5 4146->4148 4149 405baa WriteFile 4146->4149 4147->4146 4149->4148 4150 405005 4151 405015 4150->4151 4152 405029 4150->4152 4153 405072 4151->4153 4154 40501b 4151->4154 4155 405031 IsWindowVisible 4152->4155 4161 405048 4152->4161 4156 405077 CallWindowProcA 4153->4156 4157 404055 SendMessageA 4154->4157 4155->4153 4158 40503e 4155->4158 4159 405025 4156->4159 4157->4159 4163 40495c SendMessageA 4158->4163 4161->4156 4168 4049dc 4161->4168 4164 4049bb SendMessageA 4163->4164 4165 40497f GetMessagePos ScreenToClient SendMessageA 4163->4165 4166 4049b3 4164->4166 4165->4166 4167 4049b8 4165->4167 4166->4161 4167->4164 4177 405f6a lstrcpynA 4168->4177 4170 4049ef 4178 405ec8 wsprintfA 4170->4178 4172 4049f9 4173 40140b 2 API calls 4172->4173 4174 404a02 4173->4174 4179 405f6a lstrcpynA 4174->4179 4176 404a09 4176->4153 4177->4170 4178->4172 4179->4176 4180 402688 4181 40268f 4180->4181 4182 402904 4180->4182 4183 402aa9 17 API calls 4181->4183 4184 402696 4183->4184 4185 4026a5 SetFilePointer 4184->4185 4185->4182 4186 4026b5 4185->4186 4188 405ec8 wsprintfA 4186->4188 4188->4182 3641 401389 3643 401390 3641->3643 3642 4013fe 3643->3642 3644 4013cb MulDiv SendMessageA 3643->3644 3644->3643 4189 401c0a 4190 402aa9 17 API calls 4189->4190 4191 401c11 4190->4191 4192 402aa9 17 API calls 4191->4192 4193 401c1e 4192->4193 4194 401c33 4193->4194 4195 402acb 17 API calls 4193->4195 4196 401c43 4194->4196 4197 402acb 17 API calls 4194->4197 4195->4194 4198 401c9a 4196->4198 4199 401c4e 4196->4199 4197->4196 4200 402acb 17 API calls 4198->4200 4201 402aa9 17 API calls 4199->4201 4202 401c9f 4200->4202 4203 401c53 4201->4203 4205 402acb 17 API calls 4202->4205 4204 402aa9 17 API calls 4203->4204 4206 401c5f 4204->4206 4207 401ca8 FindWindowExA 4205->4207 4208 401c8a SendMessageA 4206->4208 4209 401c6c SendMessageTimeoutA 4206->4209 4210 401cc6 4207->4210 4208->4210 4209->4210 4211 404a0e GetDlgItem GetDlgItem 4212 404a60 7 API calls 4211->4212 4217 404c78 4211->4217 4213 404b03 DeleteObject 4212->4213 4214 404af6 SendMessageA 4212->4214 4215 404b0c 4213->4215 4214->4213 4216 404b43 4215->4216 4220 405f8c 17 API calls 4215->4220 4218 404009 18 API calls 4216->4218 4225 404d5c 4217->4225 4227 40495c 5 API calls 4217->4227 4246 404ce9 4217->4246 4224 404b57 4218->4224 4219 404e08 4221 404e12 SendMessageA 4219->4221 4222 404e1a 4219->4222 4223 404b25 SendMessageA SendMessageA 4220->4223 4221->4222 4232 404e33 4222->4232 4233 404e2c ImageList_Destroy 4222->4233 4243 404e43 4222->4243 4223->4215 4228 404009 18 API calls 4224->4228 4225->4219 4229 404db5 SendMessageA 4225->4229 4254 404c6b 4225->4254 4226 404d4e SendMessageA 4226->4225 4227->4246 4248 404b65 4228->4248 4234 404dca SendMessageA 4229->4234 4229->4254 4230 404070 8 API calls 4231 404ffe 4230->4231 4235 404e3c GlobalFree 4232->4235 4232->4243 4233->4232 4237 404ddd 4234->4237 4235->4243 4236 404c39 GetWindowLongA SetWindowLongA 4239 404c52 4236->4239 4249 404dee SendMessageA 4237->4249 4238 404fb2 4240 404fc4 ShowWindow GetDlgItem ShowWindow 4238->4240 4238->4254 4241 404c70 4239->4241 4242 404c58 ShowWindow 4239->4242 4240->4254 4263 40403e SendMessageA 4241->4263 4262 40403e SendMessageA 4242->4262 4243->4238 4253 4049dc 4 API calls 4243->4253 4258 404e7e 4243->4258 4246->4225 4246->4226 4247 404bb4 SendMessageA 4247->4248 4248->4236 4248->4247 4250 404c33 4248->4250 4251 404bf0 SendMessageA 4248->4251 4252 404c01 SendMessageA 4248->4252 4249->4219 4250->4236 4250->4239 4251->4248 4252->4248 4253->4258 4254->4230 4255 404f88 InvalidateRect 4255->4238 4256 404f9e 4255->4256 4264 404917 4256->4264 4257 404eac SendMessageA 4261 404ec2 4257->4261 4258->4257 4258->4261 4260 404f36 SendMessageA SendMessageA 4260->4261 4261->4255 4261->4260 4262->4254 4263->4217 4267 404852 4264->4267 4266 40492c 4266->4238 4268 404868 4267->4268 4269 405f8c 17 API calls 4268->4269 4270 4048cc 4269->4270 4271 405f8c 17 API calls 4270->4271 4272 4048d7 4271->4272 4273 405f8c 17 API calls 4272->4273 4274 4048ed lstrlenA wsprintfA SetDlgItemTextA 4273->4274 4274->4266 4275 401490 4276 405091 24 API calls 4275->4276 4277 401497 4276->4277 4285 40449b 4286 4044c7 4285->4286 4287 4044d8 4285->4287 4346 40566a GetDlgItemTextA 4286->4346 4289 4044e4 GetDlgItem 4287->4289 4321 404543 4287->4321 4293 4044f8 4289->4293 4290 4044d2 4291 4061d4 5 API calls 4290->4291 4291->4287 4292 40450c SetWindowTextA 4298 404009 18 API calls 4292->4298 4293->4292 4297 40599b 4 API calls 4293->4297 4294 4047d1 4296 404070 8 API calls 4294->4296 4301 4047e5 4296->4301 4302 404502 4297->4302 4303 404528 4298->4303 4299 405f8c 17 API calls 4304 4045b7 SHBrowseForFolderA 4299->4304 4300 404657 4305 4059f0 18 API calls 4300->4305 4302->4292 4312 405902 3 API calls 4302->4312 4306 404009 18 API calls 4303->4306 4307 404627 4304->4307 4308 4045cf CoTaskMemFree 4304->4308 4309 40465d 4305->4309 4310 404536 4306->4310 4307->4294 4348 40566a GetDlgItemTextA 4307->4348 4311 405902 3 API calls 4308->4311 4349 405f6a lstrcpynA 4309->4349 4347 40403e SendMessageA 4310->4347 4314 4045dc 4311->4314 4312->4292 4317 404613 SetDlgItemTextA 4314->4317 4322 405f8c 17 API calls 4314->4322 4316 40453c 4319 406302 5 API calls 4316->4319 4317->4307 4318 404674 4320 406302 5 API calls 4318->4320 4319->4321 4329 40467b 4320->4329 4321->4294 4321->4299 4321->4307 4323 4045fb lstrcmpiA 4322->4323 4323->4317 4326 40460c lstrcatA 4323->4326 4324 4046b7 4350 405f6a lstrcpynA 4324->4350 4326->4317 4327 4046be 4328 40599b 4 API calls 4327->4328 4330 4046c4 GetDiskFreeSpaceA 4328->4330 4329->4324 4333 405949 2 API calls 4329->4333 4335 40470f 4329->4335 4332 4046e8 MulDiv 4330->4332 4330->4335 4332->4335 4333->4329 4334 404780 4337 4047a3 4334->4337 4339 40140b 2 API calls 4334->4339 4335->4334 4336 404917 20 API calls 4335->4336 4338 40476d 4336->4338 4351 40402b EnableWindow 4337->4351 4340 404782 SetDlgItemTextA 4338->4340 4341 404772 4338->4341 4339->4337 4340->4334 4344 404852 20 API calls 4341->4344 4343 4047bf 4343->4294 4345 4043f4 SendMessageA 4343->4345 4344->4334 4345->4294 4346->4290 4347->4316 4348->4300 4349->4318 4350->4327 4351->4343 4352 401d9b GetDC 4353 402aa9 17 API calls 4352->4353 4354 401dad GetDeviceCaps MulDiv ReleaseDC 4353->4354 4355 402aa9 17 API calls 4354->4355 4356 401dde 4355->4356 4357 405f8c 17 API calls 4356->4357 4358 401e1b CreateFontIndirectA 4357->4358 4359 40257d 4358->4359 3668 40159d 3669 402acb 17 API calls 3668->3669 3670 4015a4 SetFileAttributesA 3669->3670 3671 4015b6 3670->3671 4360 40149d 4361 4014ab PostQuitMessage 4360->4361 4362 4022e7 4360->4362 4361->4362 4363 401a1e 4364 402acb 17 API calls 4363->4364 4365 401a27 ExpandEnvironmentStringsA 4364->4365 4366 401a3b 4365->4366 4367 401a4e 4365->4367 4366->4367 4368 401a40 lstrcmpA 4366->4368 4368->4367 4374 40171f 4375 402acb 17 API calls 4374->4375 4376 401726 SearchPathA 4375->4376 4377 401741 4376->4377 4378 401d20 4379 402aa9 17 API calls 4378->4379 4380 401d2e SetWindowLongA 4379->4380 4381 402957 4380->4381 4382 401e2b 4383 402aa9 17 API calls 4382->4383 4384 401e31 4383->4384 4385 402aa9 17 API calls 4384->4385 4386 401e3d 4385->4386 4387 401e54 EnableWindow 4386->4387 4388 401e49 ShowWindow 4386->4388 4389 402957 4387->4389 4388->4389 4404 401f31 4405 402acb 17 API calls 4404->4405 4406 401f38 4405->4406 4407 40626d 2 API calls 4406->4407 4408 401f3e 4407->4408 4410 401f50 4408->4410 4411 405ec8 wsprintfA 4408->4411 4411->4410 3141 401932 3142 401934 3141->3142 3143 402acb 17 API calls 3142->3143 3144 401939 3143->3144 3147 405732 3144->3147 3184 4059f0 3147->3184 3150 405771 3152 40589f 3150->3152 3198 405f6a lstrcpynA 3150->3198 3151 40575a DeleteFileA 3179 401942 3151->3179 3152->3179 3228 40626d FindFirstFileA 3152->3228 3154 405797 3155 4057aa 3154->3155 3156 40579d lstrcatA 3154->3156 3199 405949 lstrlenA 3155->3199 3158 4057b0 3156->3158 3161 4057be lstrcatA 3158->3161 3162 4057c9 lstrlenA FindFirstFileA 3158->3162 3161->3162 3162->3152 3182 4057ed 3162->3182 3165 40592d CharNextA 3165->3182 3166 4056ea 5 API calls 3167 4058d9 3166->3167 3168 4058f3 3167->3168 3169 4058dd 3167->3169 3170 405091 24 API calls 3168->3170 3174 405091 24 API calls 3169->3174 3169->3179 3170->3179 3171 40587e FindNextFileA 3173 405896 FindClose 3171->3173 3171->3182 3173->3152 3175 4058ea 3174->3175 3176 405d49 36 API calls 3175->3176 3176->3179 3178 405732 60 API calls 3178->3182 3180 405091 24 API calls 3180->3171 3182->3165 3182->3171 3182->3178 3182->3180 3203 405f6a lstrcpynA 3182->3203 3204 4056ea 3182->3204 3212 405091 3182->3212 3223 405d49 MoveFileExA 3182->3223 3234 405f6a lstrcpynA 3184->3234 3186 405a01 3235 40599b CharNextA CharNextA 3186->3235 3189 405752 3189->3150 3189->3151 3190 4061d4 5 API calls 3196 405a17 3190->3196 3191 405a42 lstrlenA 3192 405a4d 3191->3192 3191->3196 3193 405902 3 API calls 3192->3193 3195 405a52 GetFileAttributesA 3193->3195 3194 40626d 2 API calls 3194->3196 3195->3189 3196->3189 3196->3191 3196->3194 3197 405949 2 API calls 3196->3197 3197->3191 3198->3154 3200 405956 3199->3200 3201 405967 3200->3201 3202 40595b CharPrevA 3200->3202 3201->3158 3202->3200 3202->3201 3203->3182 3241 405ade GetFileAttributesA 3204->3241 3207 405717 3207->3182 3208 405705 RemoveDirectoryA 3210 405713 3208->3210 3209 40570d DeleteFileA 3209->3210 3210->3207 3211 405723 SetFileAttributesA 3210->3211 3211->3207 3213 4050ac 3212->3213 3222 40514f 3212->3222 3214 4050c9 lstrlenA 3213->3214 3215 405f8c 17 API calls 3213->3215 3216 4050f2 3214->3216 3217 4050d7 lstrlenA 3214->3217 3215->3214 3219 405105 3216->3219 3220 4050f8 SetWindowTextA 3216->3220 3218 4050e9 lstrcatA 3217->3218 3217->3222 3218->3216 3221 40510b SendMessageA SendMessageA SendMessageA 3219->3221 3219->3222 3220->3219 3221->3222 3222->3182 3224 405d6c 3223->3224 3225 405d5d 3223->3225 3224->3182 3244 405bd9 3225->3244 3229 406283 FindClose 3228->3229 3230 4058c3 3228->3230 3229->3230 3230->3179 3231 405902 lstrlenA CharPrevA 3230->3231 3232 4058cd 3231->3232 3233 40591c lstrcatA 3231->3233 3232->3166 3233->3232 3234->3186 3236 4059b6 3235->3236 3239 4059c6 3235->3239 3238 4059c1 CharNextA 3236->3238 3236->3239 3237 4059e6 3237->3189 3237->3190 3238->3237 3239->3237 3240 40592d CharNextA 3239->3240 3240->3239 3242 405af0 SetFileAttributesA 3241->3242 3243 4056f6 3241->3243 3242->3243 3243->3207 3243->3208 3243->3209 3245 405c25 GetShortPathNameA 3244->3245 3246 405bff 3244->3246 3248 405d44 3245->3248 3249 405c3a 3245->3249 3271 405b03 GetFileAttributesA CreateFileA 3246->3271 3248->3224 3249->3248 3251 405c42 wsprintfA 3249->3251 3250 405c09 CloseHandle GetShortPathNameA 3250->3248 3252 405c1d 3250->3252 3253 405f8c 17 API calls 3251->3253 3252->3245 3252->3248 3254 405c6a 3253->3254 3272 405b03 GetFileAttributesA CreateFileA 3254->3272 3256 405c77 3256->3248 3257 405c86 GetFileSize GlobalAlloc 3256->3257 3258 405ca8 3257->3258 3259 405d3d CloseHandle 3257->3259 3273 405b7b ReadFile 3258->3273 3259->3248 3264 405cc7 lstrcpyA 3268 405ce9 3264->3268 3265 405cdb 3266 405a68 4 API calls 3265->3266 3266->3268 3267 405d20 SetFilePointer 3280 405baa WriteFile 3267->3280 3268->3267 3271->3250 3272->3256 3274 405b99 3273->3274 3274->3259 3275 405a68 lstrlenA 3274->3275 3276 405aa9 lstrlenA 3275->3276 3277 405ab1 3276->3277 3278 405a82 lstrcmpiA 3276->3278 3277->3264 3277->3265 3278->3277 3279 405aa0 CharNextA 3278->3279 3279->3276 3281 405bc8 GlobalFree 3280->3281 3281->3259 4412 402932 SendMessageA 4413 402957 4412->4413 4414 40294c InvalidateRect 4412->4414 4414->4413 4422 403b35 4423 403c88 4422->4423 4424 403b4d 4422->4424 4425 403c99 GetDlgItem GetDlgItem 4423->4425 4441 403cd9 4423->4441 4424->4423 4426 403b59 4424->4426 4429 404009 18 API calls 4425->4429 4427 403b64 SetWindowPos 4426->4427 4428 403b77 4426->4428 4427->4428 4430 403b94 4428->4430 4431 403b7c ShowWindow 4428->4431 4432 403cc3 SetClassLongA 4429->4432 4435 403bb6 4430->4435 4436 403b9c DestroyWindow 4430->4436 4431->4430 4437 40140b 2 API calls 4432->4437 4433 403d33 4434 404055 SendMessageA 4433->4434 4439 403c83 4433->4439 4461 403d45 4434->4461 4442 403bbb SetWindowLongA 4435->4442 4443 403bcc 4435->4443 4440 403f92 4436->4440 4437->4441 4438 401389 2 API calls 4444 403d0b 4438->4444 4440->4439 4450 403fc3 ShowWindow 4440->4450 4441->4433 4441->4438 4442->4439 4447 403c43 4443->4447 4448 403bd8 GetDlgItem 4443->4448 4444->4433 4449 403d0f SendMessageA 4444->4449 4445 40140b 2 API calls 4445->4461 4446 403f94 DestroyWindow EndDialog 4446->4440 4453 404070 8 API calls 4447->4453 4451 403c08 4448->4451 4452 403beb SendMessageA IsWindowEnabled 4448->4452 4449->4439 4450->4439 4455 403c15 4451->4455 4456 403c28 4451->4456 4457 403c5c SendMessageA 4451->4457 4465 403c0d 4451->4465 4452->4439 4452->4451 4453->4439 4454 405f8c 17 API calls 4454->4461 4455->4457 4455->4465 4459 403c30 4456->4459 4460 403c45 4456->4460 4457->4447 4458 403fe2 SendMessageA 4458->4447 4462 40140b 2 API calls 4459->4462 4463 40140b 2 API calls 4460->4463 4461->4439 4461->4445 4461->4446 4461->4454 4464 404009 18 API calls 4461->4464 4466 404009 18 API calls 4461->4466 4482 403ed4 DestroyWindow 4461->4482 4462->4465 4463->4465 4464->4461 4465->4447 4465->4458 4467 403dc0 GetDlgItem 4466->4467 4468 403dd5 4467->4468 4469 403ddd ShowWindow EnableWindow 4467->4469 4468->4469 4491 40402b EnableWindow 4469->4491 4471 403e07 EnableWindow 4476 403e1b 4471->4476 4472 403e20 GetSystemMenu EnableMenuItem SendMessageA 4473 403e50 SendMessageA 4472->4473 4472->4476 4473->4476 4475 403b16 18 API calls 4475->4476 4476->4472 4476->4475 4492 40403e SendMessageA 4476->4492 4493 405f6a lstrcpynA 4476->4493 4478 403e7f lstrlenA 4479 405f8c 17 API calls 4478->4479 4480 403e90 SetWindowTextA 4479->4480 4481 401389 2 API calls 4480->4481 4481->4461 4482->4440 4483 403eee CreateDialogParamA 4482->4483 4483->4440 4484 403f21 4483->4484 4485 404009 18 API calls 4484->4485 4486 403f2c GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4485->4486 4487 401389 2 API calls 4486->4487 4488 403f72 4487->4488 4488->4439 4489 403f7a ShowWindow 4488->4489 4490 404055 SendMessageA 4489->4490 4490->4440 4491->4471 4492->4476 4493->4478 4494 4014b7 4495 4014bd 4494->4495 4496 401389 2 API calls 4495->4496 4497 4014c5 4496->4497 4498 4026ba 4499 4026c0 4498->4499 4500 402957 4499->4500 4501 4026c8 FindClose 4499->4501 4501->4500 3645 4015bb 3646 402acb 17 API calls 3645->3646 3647 4015c2 3646->3647 3648 40599b 4 API calls 3647->3648 3661 4015ca 3648->3661 3649 401624 3651 401652 3649->3651 3652 401629 3649->3652 3650 40592d CharNextA 3650->3661 3654 401423 24 API calls 3651->3654 3664 401423 3652->3664 3659 40164a 3654->3659 3656 4055d4 2 API calls 3656->3661 3658 40163b SetCurrentDirectoryA 3658->3659 3660 4055f1 5 API calls 3660->3661 3661->3649 3661->3650 3661->3656 3661->3660 3662 40160c GetFileAttributesA 3661->3662 3663 405557 4 API calls 3661->3663 3662->3661 3663->3661 3665 405091 24 API calls 3664->3665 3666 401431 3665->3666 3667 405f6a lstrcpynA 3666->3667 3667->3658 4502 4016bb 4503 402acb 17 API calls 4502->4503 4504 4016c1 GetFullPathNameA 4503->4504 4505 4016d8 4504->4505 4511 4016f9 4504->4511 4508 40626d 2 API calls 4505->4508 4505->4511 4506 402957 4507 40170d GetShortPathNameA 4507->4506 4509 4016e9 4508->4509 4509->4511 4512 405f6a lstrcpynA 4509->4512 4511->4506 4511->4507 4512->4511 4513 40273c 4514 402acb 17 API calls 4513->4514 4516 40274a 4514->4516 4515 402760 4518 405ade 2 API calls 4515->4518 4516->4515 4517 402acb 17 API calls 4516->4517 4517->4515 4519 402766 4518->4519 4541 405b03 GetFileAttributesA CreateFileA 4519->4541 4521 402773 4522 40281c 4521->4522 4523 40277f GlobalAlloc 4521->4523 4526 402824 DeleteFileA 4522->4526 4527 402837 4522->4527 4524 402813 CloseHandle 4523->4524 4525 402798 4523->4525 4524->4522 4542 40318e SetFilePointer 4525->4542 4526->4527 4529 40279e 4530 403178 ReadFile 4529->4530 4531 4027a7 GlobalAlloc 4530->4531 4532 4027f1 4531->4532 4533 4027b7 4531->4533 4535 405baa WriteFile 4532->4535 4534 402f9c 35 API calls 4533->4534 4538 4027c4 4534->4538 4536 4027fd GlobalFree 4535->4536 4537 402f9c 35 API calls 4536->4537 4540 402810 4537->4540 4539 4027e8 GlobalFree 4538->4539 4539->4532 4540->4524 4541->4521 4542->4529 4543 40283d 4544 402aa9 17 API calls 4543->4544 4545 402843 4544->4545 4546 402882 4545->4546 4547 40286b 4545->4547 4556 40271c 4545->4556 4550 40289c 4546->4550 4551 40288c 4546->4551 4548 402870 4547->4548 4549 40287f 4547->4549 4557 405f6a lstrcpynA 4548->4557 4558 405ec8 wsprintfA 4549->4558 4552 405f8c 17 API calls 4550->4552 4553 402aa9 17 API calls 4551->4553 4552->4556 4553->4556 4557->4556 4558->4556 3672 4036be 3673 4036d6 3672->3673 3674 4036c8 CloseHandle 3672->3674 3679 403703 3673->3679 3674->3673 3677 405732 67 API calls 3678 4036e7 3677->3678 3680 403711 3679->3680 3681 4036db 3680->3681 3682 403716 FreeLibrary GlobalFree 3680->3682 3681->3677 3682->3681 3682->3682 4559 40413f lstrcpynA lstrlenA 4560 401b3f 4561 402acb 17 API calls 4560->4561 4562 401b46 4561->4562 4563 402aa9 17 API calls 4562->4563 4564 401b4f wsprintfA 4563->4564 4565 402957 4564->4565

                Executed Functions

                Function 004031D6 Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 366stringcomfileCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 0 4031d6-403215 SetErrorMode GetVersion 1 403217-40321f call 406302 0->1 2 403228 0->2 1->2 7 403221 1->7 3 40322d-403240 call 406294 lstrlenA 2->3 9 403242-40325e call 406302 * 3 3->9 7->2 16 403260-403266 9->16 17 40326f-4032cd #17 OleInitialize SHGetFileInfoA call 405f6a GetCommandLineA call 405f6a 9->17 16->17 21 403268 16->21 24 4032d9-4032ee call 40592d CharNextA 17->24 25 4032cf-4032d4 17->25 21->17 28 4033b3-4033b7 24->28 25->24 29 4032f3-4032f6 28->29 30 4033bd 28->30 31 4032f8-4032fc 29->31 32 4032fe-403306 29->32 33 4033d0-4033ea GetTempPathA call 4031a5 30->33 31->31 31->32 35 403308-403309 32->35 36 40330e-403311 32->36 42 403442-40345c DeleteFileA call 402d63 33->42 43 4033ec-40340a GetWindowsDirectoryA lstrcatA call 4031a5 33->43 35->36 37 4033a3-4033b0 call 40592d 36->37 38 403317-40331b 36->38 37->28 57 4033b2 37->57 40 403333-403360 38->40 41 40331d-403323 38->41 47 403362-403368 40->47 48 403373-4033a1 40->48 45 403325-403327 41->45 46 403329 41->46 60 4034f0-403500 ExitProcess CoUninitialize 42->60 61 403462-403468 42->61 43->42 59 40340c-40343c GetTempPathA lstrcatA SetEnvironmentVariableA * 2 call 4031a5 43->59 45->40 45->46 46->40 52 40336a-40336c 47->52 53 40336e 47->53 48->37 55 4033bf-4033cb call 405f6a 48->55 52->48 52->53 53->48 55->33 57->28 59->42 59->60 62 403624-40362a 60->62 63 403506-403516 call 405686 ExitProcess 60->63 65 4034e0-4034e7 call 403798 61->65 66 40346a-403475 call 40592d 61->66 68 4036a6-4036ae 62->68 69 40362c-403645 GetCurrentProcess OpenProcessToken 62->69 79 4034ec 65->79 80 403477-4034a0 66->80 81 4034ab-4034b5 66->81 74 4036b0 68->74 75 4036b4-4036b8 ExitProcess 68->75 77 403677-403685 call 406302 69->77 78 403647-403671 LookupPrivilegeValueA AdjustTokenPrivileges 69->78 74->75 90 403693-40369d ExitWindowsEx 77->90 91 403687-403691 77->91 78->77 79->60 83 4034a2-4034a4 80->83 84 4034b7-4034c4 call 4059f0 81->84 85 40351c-403530 call 4055f1 lstrcatA 81->85 83->81 87 4034a6-4034a9 83->87 84->60 98 4034c6-4034dc call 405f6a * 2 84->98 96 403532-403538 lstrcatA 85->96 97 40353d-403557 lstrcatA lstrcmpiA 85->97 87->81 87->83 90->68 94 40369f-4036a1 call 40140b 90->94 91->90 91->94 94->68 96->97 97->60 100 403559-40355c 97->100 98->65 102 403565 call 4055d4 100->102 103 40355e-403563 call 405557 100->103 110 40356a-403577 SetCurrentDirectoryA 102->110 103->110 111 403584-4035ac call 405f6a 110->111 112 403579-40357f call 405f6a 110->112 116 4035b2-4035ce call 405f8c DeleteFileA 111->116 112->111 119 4035d0-4035e0 CopyFileA 116->119 120 40360f-403616 116->120 119->120 122 4035e2-403602 call 405d49 call 405f8c call 405609 119->122 120->116 121 403618-40361f call 405d49 120->121 121->60 122->120 131 403604-40360b CloseHandle 122->131 131->120
                APIs
                • SetErrorMode.KERNELBASE ref: 004031FB
                • GetVersion.KERNEL32 ref: 00403201
                • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403234
                • #17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403270
                • OleInitialize.OLE32(00000000), ref: 00403277
                • SHGetFileInfoA.SHELL32(0041ECC8,00000000,?,00000160,00000000,?,00000006,00000008,0000000A), ref: 00403293
                • GetCommandLineA.KERNEL32(00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 004032A8
                • CharNextA.USER32(00000000,"C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe",00000020,"C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe",00000000,?,00000006,00000008,0000000A), ref: 004032E4
                • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000006,00000008,0000000A), ref: 004033E1
                • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004033F2
                • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004033FE
                • GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403412
                • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040341A
                • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040342B
                • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403433
                • DeleteFileA.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 00403447
                  • Part of subcall function 00406302: GetModuleHandleA.KERNEL32(?,?,?,00403249,0000000A), ref: 00406314
                  • Part of subcall function 00406302: GetProcAddress.KERNEL32(00000000,?), ref: 0040632F
                  • Part of subcall function 00403798: lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,?,?,?,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,00000000,C:\Users\user\Wavesor Software,1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,75793410), ref: 00403888
                  • Part of subcall function 00403798: lstrcmpiA.KERNEL32(?,.exe), ref: 0040389B
                  • Part of subcall function 00403798: GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe), ref: 004038A6
                  • Part of subcall function 00403798: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\Wavesor Software), ref: 004038EF
                  • Part of subcall function 00403798: RegisterClassA.USER32(00422EA0), ref: 0040392C
                • ExitProcess.KERNEL32(?,?,00000006,00000008,0000000A), ref: 004034F0
                  • Part of subcall function 004036BE: CloseHandle.KERNEL32(FFFFFFFF,004034F5,?,?,00000006,00000008,0000000A), ref: 004036C9
                • CoUninitialize.COMBASE(?,?,00000006,00000008,0000000A), ref: 004034F5
                • ExitProcess.KERNEL32 ref: 00403516
                • GetCurrentProcess.KERNEL32(00000028,?,00000006,00000008,0000000A), ref: 00403633
                • OpenProcessToken.ADVAPI32(00000000), ref: 0040363A
                • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403652
                • AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403671
                • ExitWindowsEx.USER32(00000002,80040002), ref: 00403695
                • ExitProcess.KERNEL32 ref: 004036B8
                  • Part of subcall function 00405686: MessageBoxIndirectA.USER32(00409218), ref: 004056E1
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Process$Exit$File$EnvironmentHandlePathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCloseCommandCurrentDeleteDirectoryErrorImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
                • String ID: "$"C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp$C:\Users\user\Desktop$C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe$C:\Users\user\Wavesor Software$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`Kzu$~nsu
                • API String ID: 562314493-1953063853
                • Opcode ID: a89f0c8a6e97c5f01f4735375ae769114aedeae45e413a60464f5598d873b4a1
                • Instruction ID: 9e312bc3f5d3d37e61d45afab2cefd1cff230aa7333539c56d086af75f350ab7
                • Opcode Fuzzy Hash: a89f0c8a6e97c5f01f4735375ae769114aedeae45e413a60464f5598d873b4a1
                • Instruction Fuzzy Hash: 90C106706082426AE7216F719D4DB2B3EACEB85706F04457FF581B61E2C77C8A05CB2E
                Function 00405732 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159filestringCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 335 405732-405758 call 4059f0 338 405771-405778 335->338 339 40575a-40576c DeleteFileA 335->339 341 40577a-40577c 338->341 342 40578b-40579b call 405f6a 338->342 340 4058fb-4058ff 339->340 343 405782-405785 341->343 344 4058a9-4058ae 341->344 350 4057aa-4057ab call 405949 342->350 351 40579d-4057a8 lstrcatA 342->351 343->342 343->344 344->340 347 4058b0-4058b3 344->347 348 4058b5-4058bb 347->348 349 4058bd-4058c5 call 40626d 347->349 348->340 349->340 358 4058c7-4058db call 405902 call 4056ea 349->358 353 4057b0-4057b3 350->353 351->353 356 4057b5-4057bc 353->356 357 4057be-4057c4 lstrcatA 353->357 356->357 359 4057c9-4057e7 lstrlenA FindFirstFileA 356->359 357->359 374 4058f3-4058f6 call 405091 358->374 375 4058dd-4058e0 358->375 361 4057ed-405804 call 40592d 359->361 362 40589f-4058a3 359->362 368 405806-40580a 361->368 369 40580f-405812 361->369 362->344 364 4058a5 362->364 364->344 368->369 371 40580c 368->371 372 405814-405819 369->372 373 405825-405833 call 405f6a 369->373 371->369 377 40581b-40581d 372->377 378 40587e-405890 FindNextFileA 372->378 385 405835-40583d 373->385 386 40584a-405855 call 4056ea 373->386 374->340 375->348 380 4058e2-4058f1 call 405091 call 405d49 375->380 377->373 381 40581f-405823 377->381 378->361 383 405896-405899 FindClose 378->383 380->340 381->373 381->378 383->362 385->378 388 40583f-405848 call 405732 385->388 394 405876-405879 call 405091 386->394 395 405857-40585a 386->395 388->378 394->378 397 40585c-40586c call 405091 call 405d49 395->397 398 40586e-405874 395->398 397->378 398->378
                APIs
                • DeleteFileA.KERNELBASE(?,?,75793410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040575B
                • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\*.*,?,?,75793410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057A3
                • lstrcatA.KERNEL32(?,00409014,?,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\*.*,?,?,75793410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057C4
                • lstrlenA.KERNEL32(?,?,00409014,?,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\*.*,?,?,75793410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057CA
                • FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\*.*,?,?,?,00409014,?,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\*.*,?,?,75793410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057DB
                • FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405888
                • FindClose.KERNELBASE(00000000), ref: 00405899
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                • String ID: "C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\*.*$\*.*
                • API String ID: 2035342205-3748394609
                • Opcode ID: f68f1787a7535e61b3df604e6a8492ba07a213b852bbd40fa4bcb335dd7bb391
                • Instruction ID: 4530166bbd706fa81c440e6583376772d6fc270faa34d54a03d6882d8fc6be8c
                • Opcode Fuzzy Hash: f68f1787a7535e61b3df604e6a8492ba07a213b852bbd40fa4bcb335dd7bb391
                • Instruction Fuzzy Hash: 7351B332904A09BADB216B728C45BAF7A78DF42714F14817BF841B11D2D73C8952DEA9
                Function 004065F6 Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 577 4065f6-4065fb 578 40666c-40668a 577->578 579 4065fd-40662c 577->579 582 406c62-406c77 578->582 580 406633-406637 579->580 581 40662e-406631 579->581 586 406639-40663d 580->586 587 40663f 580->587 585 406643-406646 581->585 583 406c91-406ca7 582->583 584 406c79-406c8f 582->584 588 406caa-406cb1 583->588 584->588 589 406664-406667 585->589 590 406648-406651 585->590 586->585 587->585 591 406cb3-406cb7 588->591 592 406cd8-406ce4 588->592 595 406839-406857 589->595 593 406653 590->593 594 406656-406662 590->594 598 406e66-406e70 591->598 599 406cbd-406cd5 591->599 606 40647a-406483 592->606 593->594 601 4066cc-4066fa 594->601 596 406859-40686d 595->596 597 40686f-406881 595->597 604 406884-40688e 596->604 597->604 605 406e7c-406e8f 598->605 599->592 602 406716-406730 601->602 603 4066fc-406714 601->603 609 406733-40673d 602->609 603->609 610 406890 604->610 611 406831-406837 604->611 612 406e94-406e98 605->612 607 406e91 606->607 608 406489 606->608 607->612 613 406490-406494 608->613 614 4065d0-4065f1 608->614 615 406535-406539 608->615 616 4065a5-4065a9 608->616 618 406743 609->618 619 4066b4-4066ba 609->619 620 4069a1-4069ae 610->620 621 40680c-406810 610->621 611->595 617 4067d5-4067df 611->617 613->605 624 40649a-4064a7 613->624 614->582 628 406de5-406def 615->628 629 40653f-406558 615->629 625 406df4-406dfe 616->625 626 4065af-4065c3 616->626 630 406e24-406e2e 617->630 631 4067e5-406807 617->631 638 406e00-406e0a 618->638 639 406699-4066b1 618->639 632 4066c0-4066c6 619->632 633 40676d-406773 619->633 620->606 622 406816-40682e 621->622 623 406e18-406e22 621->623 622->611 623->605 624->607 635 4064ad-4064f3 624->635 625->605 636 4065c6-4065ce 626->636 628->605 640 40655b-40655f 629->640 630->605 631->620 632->601 634 4067d1 632->634 633->634 637 406775-406793 633->637 634->617 641 4064f5-4064f9 635->641 642 40651b-40651d 635->642 636->614 636->616 643 406795-4067a9 637->643 644 4067ab-4067bd 637->644 638->605 639->619 640->615 645 406561-406567 640->645 648 406504-406512 GlobalAlloc 641->648 649 4064fb-4064fe GlobalFree 641->649 650 40652b-406533 642->650 651 40651f-406529 642->651 652 4067c0-4067ca 643->652 644->652 646 406591-4065a3 645->646 647 406569-406570 645->647 646->636 653 406572-406575 GlobalFree 647->653 654 40657b-40658b GlobalAlloc 647->654 648->607 655 406518 648->655 649->648 650->640 651->650 651->651 652->633 656 4067cc 652->656 653->654 654->607 654->646 655->642 658 406752-40676a 656->658 659 406e0c-406e16 656->659 658->633 659->605
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 48b772c591d60bd120ceb21c558333e6da892a782e2c7f4c33aa573d96a0a8bb
                • Instruction ID: 5cdea38fe39661480990cc8a004f6d9d9bf1a0cca829e9caf547f016d39c1b54
                • Opcode Fuzzy Hash: 48b772c591d60bd120ceb21c558333e6da892a782e2c7f4c33aa573d96a0a8bb
                • Instruction Fuzzy Hash: 7BF17475D00229CBDF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7385A86CF44
                Function 0040626D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 697 40626d-406281 FindFirstFileA 698 406283-40628c FindClose 697->698 699 40628e 697->699 700 406290-406291 698->700 699->700
                APIs
                • FindFirstFileA.KERNELBASE(75793410,00421558,C:\,00405A33,C:\,C:\,00000000,C:\,C:\,75793410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,75793410,C:\Users\user\AppData\Local\Temp\), ref: 00406278
                • FindClose.KERNELBASE(00000000), ref: 00406284
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Find$CloseFileFirst
                • String ID: C:\
                • API String ID: 2295610775-3404278061
                • Opcode ID: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
                • Instruction ID: 4b5b4fac396428ba6811cbdb79132df6df7f7590a8a38978907140e3512fee8b
                • Opcode Fuzzy Hash: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
                • Instruction Fuzzy Hash: 9AD012319190246BC3402B387D0C84B7B599B553317128B77F96BF16F0C3389C7286EA
                Function 00403798 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 132 403798-4037b0 call 406302 135 4037b2-4037c2 call 405ec8 132->135 136 4037c4-4037f5 call 405e51 132->136 145 403818-403841 call 403a5d call 4059f0 135->145 141 4037f7-403808 call 405e51 136->141 142 40380d-403813 lstrcatA 136->142 141->142 142->145 150 403847-40384c 145->150 151 4038c8-4038d0 call 4059f0 145->151 150->151 153 40384e-403872 call 405e51 150->153 157 4038d2-4038d9 call 405f8c 151->157 158 4038de-403903 LoadImageA 151->158 153->151 159 403874-403876 153->159 157->158 161 403984-40398c call 40140b 158->161 162 403905-403935 RegisterClassA 158->162 163 403887-403893 lstrlenA 159->163 164 403878-403885 call 40592d 159->164 175 403996-4039a1 call 403a5d 161->175 176 40398e-403991 161->176 165 403a53 162->165 166 40393b-40397f SystemParametersInfoA CreateWindowExA 162->166 170 403895-4038a3 lstrcmpiA 163->170 171 4038bb-4038c3 call 405902 call 405f6a 163->171 164->163 169 403a55-403a5c 165->169 166->161 170->171 174 4038a5-4038af GetFileAttributesA 170->174 171->151 178 4038b1-4038b3 174->178 179 4038b5-4038b6 call 405949 174->179 185 4039a7-4039c1 ShowWindow call 406294 175->185 186 403a2a-403a32 call 405163 175->186 176->169 178->171 178->179 179->171 191 4039c3-4039c8 call 406294 185->191 192 4039cd-4039df GetClassInfoA 185->192 193 403a34-403a3a 186->193 194 403a4c-403a4e call 40140b 186->194 191->192 197 4039e1-4039f1 GetClassInfoA RegisterClassA 192->197 198 4039f7-403a28 DialogBoxParamA call 40140b call 4036e8 192->198 193->176 199 403a40-403a47 call 40140b 193->199 194->165 197->198 198->169 199->176
                APIs
                  • Part of subcall function 00406302: GetModuleHandleA.KERNEL32(?,?,?,00403249,0000000A), ref: 00406314
                  • Part of subcall function 00406302: GetProcAddress.KERNEL32(00000000,?), ref: 0040632F
                • lstrcatA.KERNEL32(1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,75793410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe",00000000), ref: 00403813
                • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,?,?,?,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,00000000,C:\Users\user\Wavesor Software,1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,75793410), ref: 00403888
                • lstrcmpiA.KERNEL32(?,.exe), ref: 0040389B
                • GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe), ref: 004038A6
                • LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\Wavesor Software), ref: 004038EF
                  • Part of subcall function 00405EC8: wsprintfA.USER32 ref: 00405ED5
                • RegisterClassA.USER32(00422EA0), ref: 0040392C
                • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403944
                • CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403979
                • ShowWindow.USER32(00000005,00000000), ref: 004039AF
                • GetClassInfoA.USER32(00000000,RichEdit20A,00422EA0), ref: 004039DB
                • GetClassInfoA.USER32(00000000,RichEdit,00422EA0), ref: 004039E8
                • RegisterClassA.USER32(00422EA0), ref: 004039F1
                • DialogBoxParamA.USER32(?,00000000,00403B35,00000000), ref: 00403A10
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                • String ID: "C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe$C:\Users\user\Wavesor Software$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                • API String ID: 1975747703-503856829
                • Opcode ID: 82f0b6a78c27effcb7da86fba94de1bf9d358bf6bea2f89834a38c58d360b3d0
                • Instruction ID: adaaead87af2f4bee353d1c72736fa47975a157a90096c49b539272413637961
                • Opcode Fuzzy Hash: 82f0b6a78c27effcb7da86fba94de1bf9d358bf6bea2f89834a38c58d360b3d0
                • Instruction Fuzzy Hash: 1961D7B1744200BED720BF619D45F3B3AACEB4475AF40447EF941B22E1C67C9D069A2E
                Function 00402D63 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 206 402d63-402db1 GetTickCount GetModuleFileNameA call 405b03 209 402db3-402db8 206->209 210 402dbd-402deb call 405f6a call 405949 call 405f6a GetFileSize 206->210 211 402f95-402f99 209->211 218 402df1 210->218 219 402ed8-402ee6 call 402cff 210->219 221 402df6-402e0d 218->221 226 402ee8-402eeb 219->226 227 402f3b-402f40 219->227 222 402e11-402e1a call 403178 221->222 223 402e0f 221->223 232 402e20-402e27 222->232 233 402f42-402f4a call 402cff 222->233 223->222 229 402eed-402f05 call 40318e call 403178 226->229 230 402f0f-402f39 GlobalAlloc call 40318e call 402f9c 226->230 227->211 229->227 252 402f07-402f0d 229->252 230->227 257 402f4c-402f5d 230->257 236 402ea3-402ea7 232->236 237 402e29-402e3d call 405abe 232->237 233->227 241 402eb1-402eb7 236->241 242 402ea9-402eb0 call 402cff 236->242 237->241 255 402e3f-402e46 237->255 248 402ec6-402ed0 241->248 249 402eb9-402ec3 call 4063b9 241->249 242->241 248->221 256 402ed6 248->256 249->248 252->227 252->230 255->241 259 402e48-402e4f 255->259 256->219 260 402f65-402f6a 257->260 261 402f5f 257->261 259->241 263 402e51-402e58 259->263 262 402f6b-402f71 260->262 261->260 262->262 264 402f73-402f8e SetFilePointer call 405abe 262->264 263->241 265 402e5a-402e61 263->265 268 402f93 264->268 265->241 267 402e63-402e83 265->267 267->227 269 402e89-402e8d 267->269 268->211 270 402e95-402e9d 269->270 271 402e8f-402e93 269->271 270->241 272 402e9f-402ea1 270->272 271->256 271->270 272->241
                APIs
                • GetTickCount.KERNEL32 ref: 00402D74
                • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe,00000400), ref: 00402D90
                  • Part of subcall function 00405B03: GetFileAttributesA.KERNELBASE(00000003,00402DA3,C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe,80000000,00000003), ref: 00405B07
                  • Part of subcall function 00405B03: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B29
                • GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe,C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe,80000000,00000003), ref: 00402DDC
                Strings
                • "C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe", xrefs: 00402D63
                • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402F3B
                • C:\Users\user\Desktop, xrefs: 00402DBE, 00402DC3, 00402DC9
                • soft, xrefs: 00402E51
                • Null, xrefs: 00402E5A
                • Error launching installer, xrefs: 00402DB3
                • C:\Users\user\AppData\Local\Temp\, xrefs: 00402D6A
                • Inst, xrefs: 00402E48
                • C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe, xrefs: 00402D7A, 00402D89, 00402D9D, 00402DBD
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: File$AttributesCountCreateModuleNameSizeTick
                • String ID: "C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
                • API String ID: 4283519449-1243651393
                • Opcode ID: 4402c1a628421308b32cd0359e52fb618b8350017d4aa0aaea4d42cf6b84a165
                • Instruction ID: 2e32d7aad0b4ca297083aa7498b96cb894cc3d31802a5233eda7db803f364c93
                • Opcode Fuzzy Hash: 4402c1a628421308b32cd0359e52fb618b8350017d4aa0aaea4d42cf6b84a165
                • Instruction Fuzzy Hash: CB51D6B1900215ABDB219F65DE89B9F7AB8EB04365F10403BF904B62D1C7BC9E418B9D
                Function 00405F8C Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 199stringCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 273 405f8c-405f97 274 405f99-405fa8 273->274 275 405faa-405fc0 273->275 274->275 276 4061b1-4061b5 275->276 277 405fc6-405fd1 275->277 279 405fe3-405fed 276->279 280 4061bb-4061c5 276->280 277->276 278 405fd7-405fde 277->278 278->276 279->280 281 405ff3-405ffa 279->281 282 4061d0-4061d1 280->282 283 4061c7-4061cb call 405f6a 280->283 284 406000-406034 281->284 285 4061a4 281->285 283->282 287 406151-406154 284->287 288 40603a-406044 284->288 289 4061a6-4061ac 285->289 290 4061ae-4061b0 285->290 293 406184-406187 287->293 294 406156-406159 287->294 291 406046-40604a 288->291 292 40605e 288->292 289->276 290->276 291->292 297 40604c-406050 291->297 300 406065-40606c 292->300 295 406195-4061a2 lstrlenA 293->295 296 406189-406190 call 405f8c 293->296 298 406169-406175 call 405f6a 294->298 299 40615b-406167 call 405ec8 294->299 295->276 296->295 297->292 302 406052-406056 297->302 309 40617a-406180 298->309 299->309 304 406071-406073 300->304 305 40606e-406070 300->305 302->292 310 406058-40605c 302->310 307 406075-406098 call 405e51 304->307 308 4060ac-4060af 304->308 305->304 321 406138-40613c 307->321 322 40609e-4060a7 call 405f8c 307->322 314 4060b1-4060bd GetSystemDirectoryA 308->314 315 4060bf-4060c2 308->315 309->295 313 406182 309->313 310->300 317 406149-40614f call 4061d4 313->317 318 406133-406136 314->318 319 4060c4-4060d2 GetWindowsDirectoryA 315->319 320 40612f-406131 315->320 317->295 318->317 318->321 319->320 320->318 323 4060d4-4060de 320->323 321->317 326 40613e-406144 lstrcatA 321->326 322->318 328 4060e0-4060e3 323->328 329 4060f8-40610e SHGetSpecialFolderLocation 323->329 326->317 328->329 333 4060e5-4060ec 328->333 330 406110-40612a SHGetPathFromIDListA CoTaskMemFree 329->330 331 40612c 329->331 330->318 330->331 331->320 334 4060f4-4060f6 333->334 334->318 334->329
                APIs
                • GetSystemDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,00000400), ref: 004060B7
                • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,00000400,?,0041F4E8,00000000,004050C9,0041F4E8,00000000), ref: 004060CA
                • SHGetSpecialFolderLocation.SHELL32(004050C9,00000000,?,0041F4E8,00000000,004050C9,0041F4E8,00000000), ref: 00406106
                • SHGetPathFromIDListA.SHELL32(00000000,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe), ref: 00406114
                • CoTaskMemFree.OLE32(00000000), ref: 00406120
                • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,\Microsoft\Internet Explorer\Quick Launch), ref: 00406144
                • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,?,0041F4E8,00000000,004050C9,0041F4E8,00000000,00000000,004D7563,00000000), ref: 00406196
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
                • String ID: C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe$KtM$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                • API String ID: 717251189-1389201770
                • Opcode ID: fdc6a5aa1746c55117902e6833992edfdaf1df66eec9c6c9a1b750bd381f8059
                • Instruction ID: bb9011323e63b572c88625bc05a244510e37b0ede85a9af68ccf729595c90084
                • Opcode Fuzzy Hash: fdc6a5aa1746c55117902e6833992edfdaf1df66eec9c6c9a1b750bd381f8059
                • Instruction Fuzzy Hash: F661F171A00111AEDF219F24CC95BBA3BA5DB45301F16813BE943BA2D2C27C49A2CB5E
                Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 404 401759-40177c call 402acb call 40596f 409 401786-401798 call 405f6a call 405902 lstrcatA 404->409 410 40177e-401784 call 405f6a 404->410 415 40179d-4017a3 call 4061d4 409->415 410->415 420 4017a8-4017ac 415->420 421 4017ae-4017b8 call 40626d 420->421 422 4017df-4017e2 420->422 429 4017ca-4017dc 421->429 430 4017ba-4017c8 CompareFileTime 421->430 424 4017e4-4017e5 call 405ade 422->424 425 4017ea-401806 call 405b03 422->425 424->425 432 401808-40180b 425->432 433 40187e-4018a7 call 405091 call 402f9c 425->433 429->422 430->429 435 401860-40186a call 405091 432->435 436 40180d-40184f call 405f6a * 2 call 405f8c call 405f6a call 405686 432->436 446 4018a9-4018ad 433->446 447 4018af-4018bb SetFileTime 433->447 448 401873-401879 435->448 436->420 468 401855-401856 436->468 446->447 451 4018c1-4018cc CloseHandle 446->451 447->451 449 402960 448->449 455 402962-402966 449->455 453 4018d2-4018d5 451->453 454 402957-40295a 451->454 457 4018d7-4018e8 call 405f8c lstrcatA 453->457 458 4018ea-4018ed call 405f8c 453->458 454->449 464 4018f2-4022ec call 405686 457->464 458->464 464->454 464->455 468->448 470 401858-401859 468->470 470->435
                APIs
                • lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp,00000000,00000000,00000031), ref: 00401798
                • CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,00000000,00000000,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp,00000000,00000000,00000031), ref: 004017C2
                  • Part of subcall function 00405F6A: lstrcpynA.KERNEL32(?,?,00000400,004032A8,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405F77
                  • Part of subcall function 00405091: lstrlenA.KERNEL32(0041F4E8,00000000,004D7563,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000,?), ref: 004050CA
                  • Part of subcall function 00405091: lstrlenA.KERNEL32(004030CC,0041F4E8,00000000,004D7563,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000), ref: 004050DA
                  • Part of subcall function 00405091: lstrcatA.KERNEL32(0041F4E8,004030CC,004030CC,0041F4E8,00000000,004D7563,00000000), ref: 004050ED
                  • Part of subcall function 00405091: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 004050FF
                  • Part of subcall function 00405091: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405125
                  • Part of subcall function 00405091: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040513F
                  • Part of subcall function 00405091: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040514D
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                • String ID: C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp$C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe$SOFTWARE\Wavesor\SWUpdater\ClientState\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}$setup_patch_1.5.18.2_from_1.3.16.1.packed.7z
                • API String ID: 1941528284-1661779537
                • Opcode ID: d9a1499bbeff332ef484b3efe4fc6b7a30b6fb52926251db0019f3892f916c90
                • Instruction ID: ccd8e90e53bd547ce555faf0a88c0b4db7f619f01c1663a473e2e99c851a8e73
                • Opcode Fuzzy Hash: d9a1499bbeff332ef484b3efe4fc6b7a30b6fb52926251db0019f3892f916c90
                • Instruction Fuzzy Hash: D841A571A04516BECF107BB5CC45DAF76A8EF45369B20823BF521F20E1C77C8A418A6D
                Function 00405557 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 471 405557-4055a2 CreateDirectoryA 472 4055a4-4055a6 471->472 473 4055a8-4055b5 GetLastError 471->473 474 4055cf-4055d1 472->474 473->474 475 4055b7-4055cb SetFileSecurityA 473->475 475->472 476 4055cd GetLastError 475->476 476->474
                APIs
                • CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040559A
                • GetLastError.KERNEL32 ref: 004055AE
                • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004055C3
                • GetLastError.KERNEL32 ref: 004055CD
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: ErrorLast$CreateDirectoryFileSecurity
                • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ls@$|s@
                • API String ID: 3449924974-3105301103
                • Opcode ID: 6494dcf4892d125dd91232f43a5d02422eac6eb6da40cea13db3a7c62baa9568
                • Instruction ID: 10c896659e8025b4850b99cc2d4e61bdda87fff31b3f3568e94b9897cbd4a4b4
                • Opcode Fuzzy Hash: 6494dcf4892d125dd91232f43a5d02422eac6eb6da40cea13db3a7c62baa9568
                • Instruction Fuzzy Hash: FC010871C04219EAEF019BA1CC447EFBFB9EF04354F10813AD905B6290E378A604CBAA
                Function 00402F9C Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 155COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 477 402f9c-402fb0 478 402fb2 477->478 479 402fb9-402fc1 477->479 478->479 480 402fc3 479->480 481 402fc8-402fcd 479->481 480->481 482 402fdd-402fea call 403178 481->482 483 402fcf-402fd8 call 40318e 481->483 487 402ff0-402ff4 482->487 488 40312f 482->488 483->482 490 403118-40311a 487->490 491 402ffa-40301a GetTickCount call 406427 487->491 489 403131-403132 488->489 492 403171-403175 489->492 493 403163-403167 490->493 494 40311c-40311f 490->494 503 40316e 491->503 505 403020-403028 491->505 496 403134-40313a 493->496 497 403169 493->497 498 403121 494->498 499 403124-40312d call 403178 494->499 501 40313c 496->501 502 40313f-40314d call 403178 496->502 497->503 498->499 499->488 512 40316b 499->512 501->502 502->488 514 40314f-403154 call 405baa 502->514 503->492 508 40302a 505->508 509 40302d-40303b call 403178 505->509 508->509 509->488 515 403041-40304a 509->515 512->503 518 403159-40315b 514->518 517 403050-403063 call 406447 515->517 522 403068-40306d 517->522 520 403114-403116 518->520 521 40315d-403160 518->521 520->489 521->493 523 403110-403112 522->523 524 403073-40308a GetTickCount 522->524 523->489 525 40308c-403094 524->525 526 4030cf-4030d1 524->526 527 403096-40309a 525->527 528 40309c-4030cc MulDiv wsprintfA call 405091 525->528 529 4030d3-4030d7 526->529 530 403104-403108 526->530 527->526 527->528 528->526 533 4030d9-4030e5 call 405baa 529->533 534 4030ec-4030f2 529->534 530->505 531 40310e 530->531 531->503 533->520 540 4030e7-4030ea 533->540 535 4030f8-4030fc 534->535 535->517 539 403102 535->539 539->503 540->535
                APIs
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CountTick$wsprintf
                • String ID: ... %d%%$cuM
                • API String ID: 551687249-579933731
                • Opcode ID: 83f174d6043497e4207e2511ffbbbcac1c17996e36d45ce9a5b1f59eccb8449a
                • Instruction ID: 5f1f0f90ab52480f624b15d228fda7616e1eaa7d5f1d5864c66c4d16daa58cb3
                • Opcode Fuzzy Hash: 83f174d6043497e4207e2511ffbbbcac1c17996e36d45ce9a5b1f59eccb8449a
                • Instruction Fuzzy Hash: 69518271901219ABCF10DF65DA4469F7BB8AB08756F14413BF910BB2C0C7389E51CBAA
                Function 00406294 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 541 406294-4062b4 GetSystemDirectoryA 542 4062b6 541->542 543 4062b8-4062ba 541->543 542->543 544 4062ca-4062cc 543->544 545 4062bc-4062c4 543->545 547 4062cd-4062ff wsprintfA LoadLibraryExA 544->547 545->544 546 4062c6-4062c8 545->546 546->547
                APIs
                • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004062AB
                • wsprintfA.USER32 ref: 004062E4
                • LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004062F8
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: DirectoryLibraryLoadSystemwsprintf
                • String ID: %s%s.dll$UXTHEME$\
                • API String ID: 2200240437-4240819195
                • Opcode ID: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
                • Instruction ID: b350a7b34e5dfe1d1a07fade029f1484d0e2916aa38c44d12689a48c44b66a33
                • Opcode Fuzzy Hash: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
                • Instruction Fuzzy Hash: FAF0F63091410AAADF15AB74DC0DFFB365CAB08304F1405BAB646E11D2E6B8E9288B69
                Function 00405B32 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 548 405b32-405b3c 549 405b3d-405b68 GetTickCount GetTempFileNameA 548->549 550 405b77-405b79 549->550 551 405b6a-405b6c 549->551 553 405b71-405b74 550->553 551->549 552 405b6e 551->552 552->553
                APIs
                • GetTickCount.KERNEL32 ref: 00405B46
                • GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000006,00000008,0000000A), ref: 00405B60
                Strings
                • "C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe", xrefs: 00405B32
                • nsa, xrefs: 00405B3D
                • C:\Users\user\AppData\Local\Temp\, xrefs: 00405B35
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CountFileNameTempTick
                • String ID: "C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe"$C:\Users\user\AppData\Local\Temp\$nsa
                • API String ID: 1716503409-4194187634
                • Opcode ID: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
                • Instruction ID: 47ad9e4c3b070603f63866c15a94f77f10573a77d4085d28ed577f0a2abf86d9
                • Opcode Fuzzy Hash: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
                • Instruction Fuzzy Hash: FFF089367082086BD7104F55DC04B9B7BA8DF91750F10803BFA049A191D6B4B9548B59
                Function 004059F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 554 4059f0-405a0b call 405f6a call 40599b 559 405a11-405a1e call 4061d4 554->559 560 405a0d-405a0f 554->560 564 405a20-405a24 559->564 565 405a2a-405a2c 559->565 561 405a63-405a65 560->561 564->560 566 405a26-405a28 564->566 567 405a42-405a4b lstrlenA 565->567 566->560 566->565 568 405a4d-405a61 call 405902 GetFileAttributesA 567->568 569 405a2e-405a35 call 40626d 567->569 568->561 574 405a37-405a3a 569->574 575 405a3c-405a3d call 405949 569->575 574->560 574->575 575->567
                APIs
                  • Part of subcall function 00405F6A: lstrcpynA.KERNEL32(?,?,00000400,004032A8,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405F77
                  • Part of subcall function 0040599B: CharNextA.USER32(?,?,C:\,?,00405A07,C:\,C:\,75793410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,75793410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004059A9
                  • Part of subcall function 0040599B: CharNextA.USER32(00000000), ref: 004059AE
                  • Part of subcall function 0040599B: CharNextA.USER32(00000000), ref: 004059C2
                • lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,75793410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,75793410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A43
                • GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75793410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,75793410,C:\Users\user\AppData\Local\Temp\), ref: 00405A53
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CharNext$AttributesFilelstrcpynlstrlen
                • String ID: C:\$C:\Users\user\AppData\Local\Temp\
                • API String ID: 3248276644-2214159804
                • Opcode ID: 3317ae5885fe5557bfe6bd01748d3a5579ce53a26439151f89887cafc9669dc2
                • Instruction ID: b63be7d1610f08e16cf97c71acc26f165dc25b1935d551b17c13779f5e49e68e
                • Opcode Fuzzy Hash: 3317ae5885fe5557bfe6bd01748d3a5579ce53a26439151f89887cafc9669dc2
                • Instruction Fuzzy Hash: 24F0C826315D6156C622237A2C86AAF5644CE87324709473FF851B22D2DA3C89539E7E
                Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 660 4015bb-4015ce call 402acb call 40599b 665 4015d0-4015e3 call 40592d 660->665 666 401624-401627 660->666 674 4015e5-4015e8 665->674 675 4015fb-4015fc call 4055d4 665->675 668 401652-402242 call 401423 666->668 669 401629-401644 call 401423 call 405f6a SetCurrentDirectoryA 666->669 682 402957-402966 668->682 683 40271c-402723 668->683 669->682 687 40164a-40164d 669->687 674->675 679 4015ea-4015f1 call 4055f1 674->679 684 401601-401603 675->684 679->675 691 4015f3-4015f4 call 405557 679->691 683->682 688 401605-40160a 684->688 689 40161a-401622 684->689 687->682 692 401617 688->692 693 40160c-401615 GetFileAttributesA 688->693 689->665 689->666 696 4015f9 691->696 692->689 693->689 693->692 696->684
                APIs
                  • Part of subcall function 0040599B: CharNextA.USER32(?,?,C:\,?,00405A07,C:\,C:\,75793410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,75793410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004059A9
                  • Part of subcall function 0040599B: CharNextA.USER32(00000000), ref: 004059AE
                  • Part of subcall function 0040599B: CharNextA.USER32(00000000), ref: 004059C2
                • GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D
                  • Part of subcall function 00405557: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040559A
                • SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp,00000000,00000000,000000F0), ref: 0040163C
                Strings
                • C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp, xrefs: 00401631
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CharNext$Directory$AttributesCreateCurrentFile
                • String ID: C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp
                • API String ID: 1892508949-3980534823
                • Opcode ID: 06c5ea5d2508a300df36807d09dc16aeb1f5b60a4e227fcc4c62028f323519dc
                • Instruction ID: 1397d73bc892ae661a741dfecf38a44b6d03d9e6e7f57cd6dcc913c124f66756
                • Opcode Fuzzy Hash: 06c5ea5d2508a300df36807d09dc16aeb1f5b60a4e227fcc4c62028f323519dc
                • Instruction Fuzzy Hash: 59110431608152EBCF217FA55C415BF66B09A96324B28093FE5D2B22E2D63D4E43973F
                Function 00406A2B Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 701 406a2b-406a31 702 406a33-406a35 701->702 703 406a36-406a54 701->703 702->703 704 406c62-406c77 703->704 705 406d27-406d34 703->705 706 406c91-406ca7 704->706 707 406c79-406c8f 704->707 708 406d5e-406d62 705->708 709 406caa-406cb1 706->709 707->709 710 406dc2-406dd5 708->710 711 406d64-406d85 708->711 712 406cb3-406cb7 709->712 713 406cd8 709->713 714 406cde-406ce4 710->714 715 406d87-406d9c 711->715 716 406d9e-406db1 711->716 718 406e66-406e70 712->718 719 406cbd-406cd5 712->719 713->714 721 406e91 714->721 722 406489 714->722 717 406db4-406dbb 715->717 716->717 723 406d5b 717->723 724 406dbd 717->724 725 406e7c-406e8f 718->725 719->713 731 406e94-406e98 721->731 726 406490-406494 722->726 727 4065d0-4065f1 722->727 728 406535-406539 722->728 729 4065a5-4065a9 722->729 723->708 735 406d40-406d58 724->735 736 406e72 724->736 725->731 726->725 732 40649a-4064a7 726->732 727->704 737 406de5-406def 728->737 738 40653f-406558 728->738 733 406df4-406dfe 729->733 734 4065af-4065c3 729->734 732->721 739 4064ad-4064f3 732->739 733->725 740 4065c6-4065ce 734->740 735->723 736->725 737->725 741 40655b-40655f 738->741 742 4064f5-4064f9 739->742 743 40651b-40651d 739->743 740->727 740->729 741->728 744 406561-406567 741->744 747 406504-406512 GlobalAlloc 742->747 748 4064fb-4064fe GlobalFree 742->748 749 40652b-406533 743->749 750 40651f-406529 743->750 745 406591-4065a3 744->745 746 406569-406570 744->746 745->740 751 406572-406575 GlobalFree 746->751 752 40657b-40658b GlobalAlloc 746->752 747->721 753 406518 747->753 748->747 749->741 750->749 750->750 751->752 752->721 752->745 753->743
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: b2818476e1d6469588ef8d75e2f77556e52d803f704a1a77dfe7aba4081c4173
                • Instruction ID: ffc4466fd7e1a84d1c0fc4b16d1a76bfc4ed23806840a2aa82a83de6544419ef
                • Opcode Fuzzy Hash: b2818476e1d6469588ef8d75e2f77556e52d803f704a1a77dfe7aba4081c4173
                • Instruction Fuzzy Hash: D6A15371E00229DBDF28CFA8C8547ADBBB1FF44305F15802AD856BB281C7789A96DF44
                Function 00406C2C Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 56f2a3a3000d6c7273ab2248f4ff10f601781423d0ca2bb331c25efff9829afe
                • Instruction ID: 3b3aa2dd6ba4133719dd3176c6350ec32f9f513342808bce88e7bfcf8f6a0710
                • Opcode Fuzzy Hash: 56f2a3a3000d6c7273ab2248f4ff10f601781423d0ca2bb331c25efff9829afe
                • Instruction Fuzzy Hash: F4913370E00229DBDF28CF98C8587ADBBB1FF44305F15802AD852BB291C7789A96DF44
                Function 00406942 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 7fc8b0fe229dbff43726b3aa98382c4509895189392f9f8db1d3ee082f796570
                • Instruction ID: 583e61d198cc77022754fa770bf55cdcc509db116518bb017f27c6a68360c261
                • Opcode Fuzzy Hash: 7fc8b0fe229dbff43726b3aa98382c4509895189392f9f8db1d3ee082f796570
                • Instruction Fuzzy Hash: B9814471D04229DBDF24CFA8C884BADBBB1FF44305F25816AD446BB281C7389A96DF54
                Function 00406447 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 27bf3f2d71280db305e6514bcdeee96470c11e7b3e186f58d433be2447d111a6
                • Instruction ID: 20cbf149701654aecfc40dff313aa48f1da8dd35a22a44c357500b5e58bb095b
                • Opcode Fuzzy Hash: 27bf3f2d71280db305e6514bcdeee96470c11e7b3e186f58d433be2447d111a6
                • Instruction Fuzzy Hash: 1B816571D04229DBDF28CFA8C844BADBBB0FF44305F21816AD856BB281C7785A96DF54
                Function 00406895 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: f7de7d62d5bd7f5964df27a39736f706d5b0cb98cf3e46e90e0dfc1ab4ed8f1c
                • Instruction ID: 803a34037b0f7f5be0b8e0f61a876c36f0b5510bb0b2ab0f73e67388892f039f
                • Opcode Fuzzy Hash: f7de7d62d5bd7f5964df27a39736f706d5b0cb98cf3e46e90e0dfc1ab4ed8f1c
                • Instruction Fuzzy Hash: 95710471D04229DBDF24CFA8C8447ADBBB1FB44305F15806AD846BB281D7385A96DF54
                Function 004069B3 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 8e17704cfcf72c8df979941797e4b0b3defb04d6abbfe177bdd58f92bded9ed7
                • Instruction ID: ad71f402e4a9b92a37c553ea73d368b4d72ad24497358f0b079e3127edd250f9
                • Opcode Fuzzy Hash: 8e17704cfcf72c8df979941797e4b0b3defb04d6abbfe177bdd58f92bded9ed7
                • Instruction Fuzzy Hash: 5D713571D04229DBDF28CF98C844BADBBB1FF44305F15806AD856BB281C7389A96DF54
                Function 004068FF Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 721cf2a7e84b7ceee3b40c5675287f3d3981b6f25cb9f163efdac731e148116f
                • Instruction ID: 5c7df32a9af3fd0bcd177ef93077855236352ac101eaea0ca8dc2b1de7da3dc3
                • Opcode Fuzzy Hash: 721cf2a7e84b7ceee3b40c5675287f3d3981b6f25cb9f163efdac731e148116f
                • Instruction Fuzzy Hash: B5715571D04229DBEF28CF98C844BADBBB1FF44305F15806AD842BB281C7389A96DF44
                Function 004056EA Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00405ADE: GetFileAttributesA.KERNELBASE(?,?,004056F6,?,?,00000000,004058D9,?,?,?,?), ref: 00405AE3
                  • Part of subcall function 00405ADE: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405AF7
                • RemoveDirectoryA.KERNELBASE(?,?,?,00000000,004058D9), ref: 00405705
                • DeleteFileA.KERNELBASE(?,?,?,00000000,004058D9), ref: 0040570D
                • SetFileAttributesA.KERNEL32(?,00000000), ref: 00405725
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: File$Attributes$DeleteDirectoryRemove
                • String ID:
                • API String ID: 1655745494-0
                • Opcode ID: 4526b13c13977a81b347ddf21e43b981b877d45027d35de2861a06aa596b0a5f
                • Instruction ID: 00cd3eab12882a3f19659206189ea3ab42d92ca9329beb30f1c3f95a05fa073d
                • Opcode Fuzzy Hash: 4526b13c13977a81b347ddf21e43b981b877d45027d35de2861a06aa596b0a5f
                • Instruction Fuzzy Hash: E5E02B31229A91D6C22077749D08A5F2ED8DFC6364F050A36F452F31D0D37888079A7F
                Function 00402473 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                Download Yara Rule
                APIs
                • RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024A3
                • RegCloseKey.ADVAPI32(?,?,?,SOFTWARE\Wavesor\SWUpdater\ClientState\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF},00000000,00000011,00000002), ref: 00402542
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CloseQueryValue
                • String ID:
                • API String ID: 3356406503-0
                • Opcode ID: b97812b176999fa0f3909cccd2c6438b092887abf3ca4fb56db716ff80d2e821
                • Instruction ID: 797b5721f9f96c9af8eba6c362a28f779825b0d179cdb3fb2efbf2dc45e8c0c9
                • Opcode Fuzzy Hash: b97812b176999fa0f3909cccd2c6438b092887abf3ca4fb56db716ff80d2e821
                • Instruction Fuzzy Hash: 4F11C471A05205FEDB15CF64DA989AEBAB49F00348F20843FE545B62C0D2B84A81DB6A
                Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                Download Yara Rule
                APIs
                • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: MessageSend
                • String ID:
                • API String ID: 3850602802-0
                • Opcode ID: 3be8b2c82b9d5296ba031bde5fc3ac6967fc1ef6e00b1cb2986e69e81292ed92
                • Instruction ID: 2eeecbca978bd34a3a2c87f0a48c5f542c226d41099ae67583a71d3d142e8862
                • Opcode Fuzzy Hash: 3be8b2c82b9d5296ba031bde5fc3ac6967fc1ef6e00b1cb2986e69e81292ed92
                • Instruction Fuzzy Hash: 80012831724210ABE7294B389D04B6A369CE710328F11823BF811F72F1D6B8DC42DB4D
                Function 00402381 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON
                Download Yara Rule
                APIs
                • RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 004023A2
                • RegCloseKey.ADVAPI32(00000000), ref: 004023AB
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CloseDeleteValue
                • String ID:
                • API String ID: 2831762973-0
                • Opcode ID: ee36e1c7ee59157d69c125585a4d8c176703faf92eff200617fc6fd3d4afb1ba
                • Instruction ID: b5e441b27b73f145435eebc05e6f2b3deee3722b7b5d1586dbbfb91a11b86f75
                • Opcode Fuzzy Hash: ee36e1c7ee59157d69c125585a4d8c176703faf92eff200617fc6fd3d4afb1ba
                • Instruction Fuzzy Hash: A5F09C72B00111ABD711AFE49A8EABE76A49B40314F25453FF602B71C1D6FC5E02876E
                Function 00406302 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                Download Yara Rule
                APIs
                • GetModuleHandleA.KERNEL32(?,?,?,00403249,0000000A), ref: 00406314
                • GetProcAddress.KERNEL32(00000000,?), ref: 0040632F
                  • Part of subcall function 00406294: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004062AB
                  • Part of subcall function 00406294: wsprintfA.USER32 ref: 004062E4
                  • Part of subcall function 00406294: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004062F8
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                • String ID:
                • API String ID: 2547128583-0
                • Opcode ID: 0d35e83e7827ddfc44332ff894d31571b8ba04ccc8674abf719cedda659f01fc
                • Instruction ID: 7792f7d89acf823de2699a2c6bb45250695d03a410eb934ddee53f05324a8379
                • Opcode Fuzzy Hash: 0d35e83e7827ddfc44332ff894d31571b8ba04ccc8674abf719cedda659f01fc
                • Instruction Fuzzy Hash: D2E08C32A08221ABD3106B74AD0493B73E8DB99740702487EFA06F2180D738EC2296A9
                Function 00405B03 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                Download Yara Rule
                APIs
                • GetFileAttributesA.KERNELBASE(00000003,00402DA3,C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe,80000000,00000003), ref: 00405B07
                • CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B29
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: File$AttributesCreate
                • String ID:
                • API String ID: 415043291-0
                • Opcode ID: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
                • Instruction ID: 2f873e3f3c43f12a3908621a4267836d753c9203ad123c8b10a06e7f93ada197
                • Opcode Fuzzy Hash: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
                • Instruction Fuzzy Hash: C7D09E31658201EFEF098F20DD16F2EBBA2EB84B00F10962CB642944E0D6715815AB16
                Function 00405ADE Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                Download Yara Rule
                APIs
                • GetFileAttributesA.KERNELBASE(?,?,004056F6,?,?,00000000,004058D9,?,?,?,?), ref: 00405AE3
                • SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405AF7
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: AttributesFile
                • String ID:
                • API String ID: 3188754299-0
                • Opcode ID: 7ab00c422df54d36d0d1c47ad5130eeae7fd73d224c9059dc67d6d60f2aac68c
                • Instruction ID: b7bec259a7406421912cbc46aebe03861170fd98e68390908d479edd226f6e0d
                • Opcode Fuzzy Hash: 7ab00c422df54d36d0d1c47ad5130eeae7fd73d224c9059dc67d6d60f2aac68c
                • Instruction Fuzzy Hash: E5D01272908121BFC2112728ED0C89BBF95DB543B1702CB31FD79A26F0E7304C52AAA5
                Function 004036BE Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON
                Download Yara Rule
                APIs
                • CloseHandle.KERNEL32(FFFFFFFF,004034F5,?,?,00000006,00000008,0000000A), ref: 004036C9
                Strings
                • C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\, xrefs: 004036DD
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CloseHandle
                • String ID: C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\
                • API String ID: 2962429428-355992861
                • Opcode ID: 74bbd10c700ad04cd4501273d328f723aec36b298a8b384acbe559924b06b6a2
                • Instruction ID: 396606c85901c53f59bd577b7c6b05ad80c12e20c965e706032c1b0f9cf5384f
                • Opcode Fuzzy Hash: 74bbd10c700ad04cd4501273d328f723aec36b298a8b384acbe559924b06b6a2
                • Instruction Fuzzy Hash: 54C02230A0420093D1302F74ED4B9043A146740331BA00731F479B20F2C33C2A41446E
                Function 004055D4 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                Download Yara Rule
                APIs
                • CreateDirectoryA.KERNELBASE(?,00000000,004031C9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 004055DA
                • GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004055E8
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CreateDirectoryErrorLast
                • String ID:
                • API String ID: 1375471231-0
                • Opcode ID: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
                • Instruction ID: 176dbb695fa69d1773a7d690fb999828ada584b34c1629d79551d48c85d86b1a
                • Opcode Fuzzy Hash: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
                • Instruction Fuzzy Hash: E1C08C30608101BBD6000B318D09B073A56AB00340F1084356002E00F4C6309100C93F
                Function 00405B7B Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                Download Yara Rule
                APIs
                • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040318B,00000000,00000000,00402FE8,000000FF,00000004,00000000,00000000,00000000), ref: 00405B8F
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: FileRead
                • String ID:
                • API String ID: 2738559852-0
                • Opcode ID: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
                • Instruction ID: 82daff948be82a3a54a064a8b67bdb156262b24a8193569c828015c470817b44
                • Opcode Fuzzy Hash: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
                • Instruction Fuzzy Hash: AFE0EC3265425AABDF509E559C00BEB7BACEB453A0F008832F915E3190D235F9219BA5
                Function 00405BAA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                Download Yara Rule
                APIs
                • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000020,?,00403159,00000000,0040A8C0,00000020,0040A8C0,00000020,000000FF,00000004,00000000), ref: 00405BBE
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: FileWrite
                • String ID:
                • API String ID: 3934441357-0
                • Opcode ID: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
                • Instruction ID: 29870a228079f63f45527f16aa4763e95840d14b1a08b3071f6f7043dbe3ced8
                • Opcode Fuzzy Hash: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
                • Instruction Fuzzy Hash: EBE0EC3261429AABDF109F559C00EEB7B6CEB05361F144832FD15E6150E271F8219BB5
                Function 00405DF0 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON
                Download Yara Rule
                APIs
                • RegOpenKeyExA.KERNELBASE(00000000,?,00000000,?,?,0041F4E8,?,?,00405E7E,0041F4E8,?,?,?,00000002,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe), ref: 00405E14
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Open
                • String ID:
                • API String ID: 71445658-0
                • Opcode ID: 688c0e3dac6200a4dcf5f70578aed2939ff3afbafb421f65443b8838c7a2b092
                • Instruction ID: ba5dad521a6b40c9e54b5391ff095803b52aec86cb211a8a265cc86c886d2883
                • Opcode Fuzzy Hash: 688c0e3dac6200a4dcf5f70578aed2939ff3afbafb421f65443b8838c7a2b092
                • Instruction Fuzzy Hash: 2AD0123214460DBBDF115F90EC05FAB371DFB14311F004426FE45A4091D375D670AB99
                Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                Download Yara Rule
                APIs
                • SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: AttributesFile
                • String ID:
                • API String ID: 3188754299-0
                • Opcode ID: 4f4fd182535e9e8f7078d8f61a708ba61c5a69de73c102584ea52aa17dd92270
                • Instruction ID: 6b6e43e0d42c625d8266bfea82bd0fe16559fb602912bc7a2e5d3c6a4b8464c0
                • Opcode Fuzzy Hash: 4f4fd182535e9e8f7078d8f61a708ba61c5a69de73c102584ea52aa17dd92270
                • Instruction Fuzzy Hash: 4ED012B2704111ABCF10DBE89A489DDB7A49B40329B308537D111F21D0D2B98A45A72E
                Function 00405D49 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                Download Yara Rule
                APIs
                • MoveFileExA.KERNEL32(?,?,00000005(MOVEFILE_REPLACE_EXISTING|MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00405D53
                  • Part of subcall function 00405BD9: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405D6A,?,?), ref: 00405C0A
                  • Part of subcall function 00405BD9: GetShortPathNameA.KERNEL32(?,00421A98,00000400), ref: 00405C13
                  • Part of subcall function 00405BD9: GetShortPathNameA.KERNEL32(?,00421E98,00000400), ref: 00405C30
                  • Part of subcall function 00405BD9: wsprintfA.USER32 ref: 00405C4E
                  • Part of subcall function 00405BD9: GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405C89
                  • Part of subcall function 00405BD9: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405C98
                  • Part of subcall function 00405BD9: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CD0
                  • Part of subcall function 00405BD9: SetFilePointer.KERNEL32(004093B8,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D26
                  • Part of subcall function 00405BD9: GlobalFree.KERNEL32(00000000), ref: 00405D37
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: File$GlobalNamePathShort$AllocCloseFreeHandleMovePointerSizelstrcpywsprintf
                • String ID:
                • API String ID: 299535525-0
                • Opcode ID: a7c86fb983e4a2a6b39add72e13c44e1fb896256edc90134224cd530a86ba537
                • Instruction ID: a26933083b4c0f9a0fa58553d7c0e54d140117203494a92baae2d10ee0292597
                • Opcode Fuzzy Hash: a7c86fb983e4a2a6b39add72e13c44e1fb896256edc90134224cd530a86ba537
                • Instruction Fuzzy Hash: 26D09E31118641AEDA111B11EC05A1B7BB1FB91355F10C42AF185500B1E7359451DF15
                Function 0040318E Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                Download Yara Rule
                APIs
                • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F2A,?), ref: 0040319C
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: FilePointer
                • String ID:
                • API String ID: 973152223-0
                • Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
                • Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
                • Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
                • Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

                Non-executed Functions

                Function 00404A0E Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 481windowmemoryCOMMON
                Download Yara Rule
                APIs
                • GetDlgItem.USER32(?,000003F9), ref: 00404A26
                • GetDlgItem.USER32(?,00000408), ref: 00404A31
                • GlobalAlloc.KERNEL32(00000040,?), ref: 00404A7B
                • LoadBitmapA.USER32(0000006E), ref: 00404A8E
                • SetWindowLongA.USER32(?,000000FC,00405005), ref: 00404AA7
                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404ABB
                • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404ACD
                • SendMessageA.USER32(?,00001109,00000002), ref: 00404AE3
                • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404AEF
                • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B01
                • DeleteObject.GDI32(00000000), ref: 00404B04
                • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404B2F
                • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404B3B
                • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404BD0
                • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404BFB
                • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C0F
                • GetWindowLongA.USER32(?,000000F0), ref: 00404C3E
                • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404C4C
                • ShowWindow.USER32(?,00000005), ref: 00404C5D
                • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404D5A
                • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404DBF
                • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404DD4
                • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404DF8
                • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E18
                • ImageList_Destroy.COMCTL32(?), ref: 00404E2D
                • GlobalFree.KERNEL32(?), ref: 00404E3D
                • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404EB6
                • SendMessageA.USER32(?,00001102,?,?), ref: 00404F5F
                • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404F6E
                • InvalidateRect.USER32(?,00000000,00000001), ref: 00404F8E
                • ShowWindow.USER32(?,00000000), ref: 00404FDC
                • GetDlgItem.USER32(?,000003FE), ref: 00404FE7
                • ShowWindow.USER32(00000000), ref: 00404FEE
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                • String ID: $KtM$M$N
                • API String ID: 1638840714-1485218758
                • Opcode ID: 93c98d4ec4668bcb2a28b794a0b84e11ead12c18dbcc0c9b8545a6ab8116134d
                • Instruction ID: e53edbee2b152b0549b5e4175851bd50996010034005c2ce37e30fc0cedab0f1
                • Opcode Fuzzy Hash: 93c98d4ec4668bcb2a28b794a0b84e11ead12c18dbcc0c9b8545a6ab8116134d
                • Instruction Fuzzy Hash: A50260B0900209AFEB20DF94DC85AAE7BB5FB84315F10817AF610B62E1D7799D42DF58
                Function 004051CF Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON
                Download Yara Rule
                APIs
                • GetDlgItem.USER32(?,00000403), ref: 0040522E
                • GetDlgItem.USER32(?,000003EE), ref: 0040523D
                • GetClientRect.USER32(?,?), ref: 0040527A
                • GetSystemMetrics.USER32(00000002), ref: 00405281
                • SendMessageA.USER32(?,0000101B,00000000,?), ref: 004052A2
                • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004052B3
                • SendMessageA.USER32(?,00001001,00000000,?), ref: 004052C6
                • SendMessageA.USER32(?,00001026,00000000,?), ref: 004052D4
                • SendMessageA.USER32(?,00001024,00000000,?), ref: 004052E7
                • ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405309
                • ShowWindow.USER32(?,00000008), ref: 0040531D
                • GetDlgItem.USER32(?,000003EC), ref: 0040533E
                • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040534E
                • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405367
                • SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405373
                • GetDlgItem.USER32(?,000003F8), ref: 0040524C
                  • Part of subcall function 0040403E: SendMessageA.USER32(00000028,?,00000001,00403E6E), ref: 0040404C
                • GetDlgItem.USER32(?,000003EC), ref: 0040538F
                • CreateThread.KERNEL32(00000000,00000000,Function_00005163,00000000), ref: 0040539D
                • CloseHandle.KERNEL32(00000000), ref: 004053A4
                • ShowWindow.USER32(00000000), ref: 004053C7
                • ShowWindow.USER32(?,00000008), ref: 004053CE
                • ShowWindow.USER32(00000008), ref: 00405414
                • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405448
                • CreatePopupMenu.USER32 ref: 00405459
                • AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 0040546E
                • GetWindowRect.USER32(?,000000FF), ref: 0040548E
                • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004054A7
                • SendMessageA.USER32(?,0000102D,00000000,?), ref: 004054E3
                • OpenClipboard.USER32(00000000), ref: 004054F3
                • EmptyClipboard.USER32 ref: 004054F9
                • GlobalAlloc.KERNEL32(00000042,?), ref: 00405502
                • GlobalLock.KERNEL32(00000000), ref: 0040550C
                • SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405520
                • GlobalUnlock.KERNEL32(00000000), ref: 00405539
                • SetClipboardData.USER32(00000001,00000000), ref: 00405544
                • CloseClipboard.USER32 ref: 0040554A
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                • String ID:
                • API String ID: 590372296-0
                • Opcode ID: 3a9281ed8a789c1f11ab91822155f9eb880975752d287774625736a89b1e06cb
                • Instruction ID: 0e806a1c10c1a3103ec1b6ff030541c572903ae85d70ab094f2e75f2d1af7317
                • Opcode Fuzzy Hash: 3a9281ed8a789c1f11ab91822155f9eb880975752d287774625736a89b1e06cb
                • Instruction Fuzzy Hash: ABA15AB1900209BFDB219FA4DD89AAE7F79FB04355F10403AFA04B62A0C7B55E41DF69
                Function 0040449B Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON
                Download Yara Rule
                APIs
                • GetDlgItem.USER32(?,000003FB), ref: 004044EA
                • SetWindowTextA.USER32(00000000,?), ref: 00404514
                • SHBrowseForFolderA.SHELL32(?,0041F0E0,?), ref: 004045C5
                • CoTaskMemFree.OLE32(00000000), ref: 004045D0
                • lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,0041FD08), ref: 00404602
                • lstrcatA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe), ref: 0040460E
                • SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404620
                  • Part of subcall function 0040566A: GetDlgItemTextA.USER32(?,?,00000400,00404657), ref: 0040567D
                  • Part of subcall function 004061D4: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe",75793410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040622C
                  • Part of subcall function 004061D4: CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406239
                  • Part of subcall function 004061D4: CharNextA.USER32(?,"C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe",75793410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040623E
                  • Part of subcall function 004061D4: CharPrevA.USER32(?,?,75793410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040624E
                • GetDiskFreeSpaceA.KERNEL32(0041ECD8,?,?,0000040F,?,0041ECD8,0041ECD8,?,00000001,0041ECD8,?,?,000003FB,?), ref: 004046DE
                • MulDiv.KERNEL32(?,0000040F,00000400), ref: 004046F9
                  • Part of subcall function 00404852: lstrlenA.KERNEL32(0041FD08,0041FD08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040476D,000000DF,00000000,00000400,?), ref: 004048F0
                  • Part of subcall function 00404852: wsprintfA.USER32 ref: 004048F8
                  • Part of subcall function 00404852: SetDlgItemTextA.USER32(?,0041FD08), ref: 0040490B
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                • String ID: A$C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe$C:\Users\user\Wavesor Software$KtM
                • API String ID: 2624150263-207126815
                • Opcode ID: 03e8bc56e4921ad75bea8cd1f1782dda8109c9e19b56ba20b71ffa0d74a477b0
                • Instruction ID: 64b5da15ede57aab044e7fe1d22d086372aa44ea1ea65b7a694081baf4ac5fa5
                • Opcode Fuzzy Hash: 03e8bc56e4921ad75bea8cd1f1782dda8109c9e19b56ba20b71ffa0d74a477b0
                • Instruction Fuzzy Hash: 09A1A0B1900209ABDB11AFA5CC41AEFB7B8EF85314F14843BF611B72D1D77C8A418B69
                Function 004020D1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON
                Download Yara Rule
                APIs
                • CoCreateInstance.OLE32(00407410,?,00000001,00407400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402153
                • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402202
                Strings
                • C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp, xrefs: 00402193
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: ByteCharCreateInstanceMultiWide
                • String ID: C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp
                • API String ID: 123533781-3980534823
                • Opcode ID: dfaca637bdac44dec30a48896566fdc8f10f8569e151c1bd4da3c134321a28cb
                • Instruction ID: 6501524f140c77e19c8f4c8bf6c33f72b20f6566a7f2a320fdf5b89632137862
                • Opcode Fuzzy Hash: dfaca637bdac44dec30a48896566fdc8f10f8569e151c1bd4da3c134321a28cb
                • Instruction Fuzzy Hash: EE5137B1A00208BFCB10DFE4C989A9D7BB5AF48318F2085AAF515EB2D1DA799941CF14
                Function 004026FE Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                Download Yara Rule
                APIs
                • FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040270D
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: FileFindFirst
                • String ID:
                • API String ID: 1974802433-0
                • Opcode ID: 902bedf32fc1ff8d7565c97258b5c91b6aa2c78cd9de410635d4b247be3247e1
                • Instruction ID: 595bc86bb0b87b603365eb58ea040ec14d9195657b0818bf84ef9d27f643e594
                • Opcode Fuzzy Hash: 902bedf32fc1ff8d7565c97258b5c91b6aa2c78cd9de410635d4b247be3247e1
                • Instruction Fuzzy Hash: AAF0A772604151EAD700E7A499499EEB768CB15315F60457BE281F20C1C6B88A469B3E
                Function 00403B35 Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON
                Download Yara Rule
                APIs
                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B71
                • ShowWindow.USER32(?), ref: 00403B8E
                • DestroyWindow.USER32 ref: 00403BA2
                • SetWindowLongA.USER32(?,00000000,00000000), ref: 00403BBE
                • GetDlgItem.USER32(?,?), ref: 00403BDF
                • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403BF3
                • IsWindowEnabled.USER32(00000000), ref: 00403BFA
                • GetDlgItem.USER32(?,00000001), ref: 00403CA8
                • GetDlgItem.USER32(?,00000002), ref: 00403CB2
                • SetClassLongA.USER32(?,000000F2,?), ref: 00403CCC
                • SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403D1D
                • GetDlgItem.USER32(?,00000003), ref: 00403DC3
                • ShowWindow.USER32(00000000,?), ref: 00403DE4
                • EnableWindow.USER32(?,?), ref: 00403DF6
                • EnableWindow.USER32(?,?), ref: 00403E11
                • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403E27
                • EnableMenuItem.USER32(00000000), ref: 00403E2E
                • SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403E46
                • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403E59
                • lstrlenA.KERNEL32(0041FD08,?,0041FD08,00000000), ref: 00403E83
                • SetWindowTextA.USER32(?,0041FD08), ref: 00403E92
                • ShowWindow.USER32(?,0000000A), ref: 00403FC6
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                • String ID:
                • API String ID: 184305955-0
                • Opcode ID: 05387db83c01577c3a6776a36a7a5abe3735367355a95d1901617aca2af9034d
                • Instruction ID: ece9219a4d70184b68c45d6c06b8272552e5c94251c83fd0e936414de4f8c744
                • Opcode Fuzzy Hash: 05387db83c01577c3a6776a36a7a5abe3735367355a95d1901617aca2af9034d
                • Instruction Fuzzy Hash: 7AC1C0B1A04205BBDB206F61EE48E2B3E7DFB45706F40453EF601B11E1C779A9429B6E
                Function 00404174 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 202windowstringCOMMON
                Download Yara Rule
                APIs
                • CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004041FF
                • GetDlgItem.USER32(00000000,000003E8), ref: 00404213
                • SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404231
                • GetSysColor.USER32(?), ref: 00404242
                • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404251
                • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404260
                • lstrlenA.KERNEL32(?), ref: 00404263
                • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404272
                • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404287
                • GetDlgItem.USER32(?,0000040A), ref: 004042E9
                • SendMessageA.USER32(00000000), ref: 004042EC
                • GetDlgItem.USER32(?,000003E8), ref: 00404317
                • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404357
                • LoadCursorA.USER32(00000000,00007F02), ref: 00404366
                • SetCursor.USER32(00000000), ref: 0040436F
                • LoadCursorA.USER32(00000000,00007F00), ref: 00404385
                • SetCursor.USER32(00000000), ref: 00404388
                • SendMessageA.USER32(00000111,00000001,00000000), ref: 004043B4
                • SendMessageA.USER32(00000010,00000000,00000000), ref: 004043C8
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                • String ID: ?A@$C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe$KtM$N
                • API String ID: 3103080414-781585071
                • Opcode ID: 073baeb7e2e56e8e61070ac22e94b8c547292f2e7e559fc5b4704c6dbdd391f8
                • Instruction ID: 58642e7cad261c001b024910741a92c2a1970d4d91afa6865c69404cbc82dd24
                • Opcode Fuzzy Hash: 073baeb7e2e56e8e61070ac22e94b8c547292f2e7e559fc5b4704c6dbdd391f8
                • Instruction Fuzzy Hash: F061B2B1A40209BFEB109F61DD45B6A7B69FB84715F008036FB04BA2D1C7B8A951CB99
                Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                Download Yara Rule
                APIs
                • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                • BeginPaint.USER32(?,?), ref: 00401047
                • GetClientRect.USER32(?,?), ref: 0040105B
                • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                • DeleteObject.GDI32(?), ref: 004010ED
                • CreateFontIndirectA.GDI32(?), ref: 00401105
                • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                • SelectObject.GDI32(00000000,?), ref: 00401140
                • DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
                • SelectObject.GDI32(00000000,00000000), ref: 00401160
                • DeleteObject.GDI32(?), ref: 00401165
                • EndPaint.USER32(?,?), ref: 0040116E
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                • String ID: F
                • API String ID: 941294808-1304234792
                • Opcode ID: 0195cc9bd3a679183555b6c9b2658d6023a39abd86bfcdd07458fb5c51006648
                • Instruction ID: d756f8073455ec7f94eaaa006bac723f94b68f9cc4de0a6a70f3062e944f429a
                • Opcode Fuzzy Hash: 0195cc9bd3a679183555b6c9b2658d6023a39abd86bfcdd07458fb5c51006648
                • Instruction Fuzzy Hash: 6E419B71804249AFCF058FA4CD459AFBFB9FF44310F00812AF961AA1A0C738EA50DFA5
                Function 00405BD9 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON
                Download Yara Rule
                APIs
                • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405D6A,?,?), ref: 00405C0A
                • GetShortPathNameA.KERNEL32(?,00421A98,00000400), ref: 00405C13
                  • Part of subcall function 00405A68: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CC3,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405A78
                  • Part of subcall function 00405A68: lstrlenA.KERNEL32(00000000,?,00000000,00405CC3,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AAA
                • GetShortPathNameA.KERNEL32(?,00421E98,00000400), ref: 00405C30
                • wsprintfA.USER32 ref: 00405C4E
                • GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405C89
                • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405C98
                • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CD0
                • SetFilePointer.KERNEL32(004093B8,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D26
                • GlobalFree.KERNEL32(00000000), ref: 00405D37
                • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405D3E
                  • Part of subcall function 00405B03: GetFileAttributesA.KERNELBASE(00000003,00402DA3,C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe,80000000,00000003), ref: 00405B07
                  • Part of subcall function 00405B03: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B29
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                • String ID: %s=%s$[Rename]
                • API String ID: 2171350718-1727408572
                • Opcode ID: bce0d0f4342e6da5230c8f2dad3e86e1282dfb285abde4192bed92e2832b08e1
                • Instruction ID: 5deb0727307c374d823852481fd1d72290d2d80dc16b0ec149a77f792b4fa3ea
                • Opcode Fuzzy Hash: bce0d0f4342e6da5230c8f2dad3e86e1282dfb285abde4192bed92e2832b08e1
                • Instruction Fuzzy Hash: 0F31F231605B156BD6206B659C49F6B3AACDF45754F14043BBE01FA2D2E67CAC008EBD
                Function 004061D4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                Download Yara Rule
                APIs
                • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe",75793410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040622C
                • CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406239
                • CharNextA.USER32(?,"C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe",75793410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040623E
                • CharPrevA.USER32(?,?,75793410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040624E
                Strings
                • "C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe", xrefs: 00406210
                • C:\Users\user\AppData\Local\Temp\, xrefs: 004061D5
                • *?|<>/":, xrefs: 0040621C
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Char$Next$Prev
                • String ID: "C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                • API String ID: 589700163-3973182572
                • Opcode ID: 7d136cfff8c7bf043451e4c65a0ab86a2e72481698e5121a5e115d190c3ec359
                • Instruction ID: 78b5553556e1b29770c7274e4e8764cd0b55728b37568efcb800383df96c7a9c
                • Opcode Fuzzy Hash: 7d136cfff8c7bf043451e4c65a0ab86a2e72481698e5121a5e115d190c3ec359
                • Instruction Fuzzy Hash: FF11045180839029FB3226380C40BB76F994F6A760F1900BFE8D2722C2D67C5CA2976E
                Function 00404070 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                Download Yara Rule
                APIs
                • GetWindowLongA.USER32(?,000000EB), ref: 0040408D
                • GetSysColor.USER32(00000000), ref: 004040CB
                • SetTextColor.GDI32(?,00000000), ref: 004040D7
                • SetBkMode.GDI32(?,?), ref: 004040E3
                • GetSysColor.USER32(?), ref: 004040F6
                • SetBkColor.GDI32(?,?), ref: 00404106
                • DeleteObject.GDI32(?), ref: 00404120
                • CreateBrushIndirect.GDI32(?), ref: 0040412A
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                • String ID:
                • API String ID: 2320649405-0
                • Opcode ID: c86d0c104538bc307405f6e360d8371e1c040facf7e5af7d22035c6604205aa7
                • Instruction ID: dc807fd0e826fa60b9ec6720df696095df3ef071cd79e71149a0dd006d979902
                • Opcode Fuzzy Hash: c86d0c104538bc307405f6e360d8371e1c040facf7e5af7d22035c6604205aa7
                • Instruction Fuzzy Hash: D021B2709047059BCB309F28DC48A4BBBF8AF81715F048A2AFA96B62E0C334E844CB55
                Function 00405091 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                Download Yara Rule
                APIs
                • lstrlenA.KERNEL32(0041F4E8,00000000,004D7563,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000,?), ref: 004050CA
                • lstrlenA.KERNEL32(004030CC,0041F4E8,00000000,004D7563,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000), ref: 004050DA
                • lstrcatA.KERNEL32(0041F4E8,004030CC,004030CC,0041F4E8,00000000,004D7563,00000000), ref: 004050ED
                • SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 004050FF
                • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405125
                • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040513F
                • SendMessageA.USER32(?,00001013,?,00000000), ref: 0040514D
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: MessageSend$lstrlen$TextWindowlstrcat
                • String ID:
                • API String ID: 2531174081-0
                • Opcode ID: 954db5f2327d198c380381d75d535be114341e3607e8d3e1ad8a742e9c9284d1
                • Instruction ID: f15a229f4800e2d3be0f1ca7c95b874ac348c5f245d1a9f1eaef2b17b8141df3
                • Opcode Fuzzy Hash: 954db5f2327d198c380381d75d535be114341e3607e8d3e1ad8a742e9c9284d1
                • Instruction Fuzzy Hash: 67217A71E00518BADF119FA5CD84ADFBFA9EB05354F14807AF904AA291C6789E418FA8
                Function 0040495C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                Download Yara Rule
                APIs
                • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404977
                • GetMessagePos.USER32 ref: 0040497F
                • ScreenToClient.USER32(?,?), ref: 00404999
                • SendMessageA.USER32(?,00001111,00000000,?), ref: 004049AB
                • SendMessageA.USER32(?,0000110C,00000000,?), ref: 004049D1
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Message$Send$ClientScreen
                • String ID: f
                • API String ID: 41195575-1993550816
                • Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
                • Instruction ID: 064635845699c0f4496499246dda67b20ede28c923f9f6f9e3dc5f389f782763
                • Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
                • Instruction Fuzzy Hash: 38015271D00219BADB01DBA4DD85BFFBBBCAF55711F10412BBA10B61C0D7B469018BA5
                Function 00402C7C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                Download Yara Rule
                APIs
                • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C97
                • MulDiv.KERNEL32(00033600,00000064,04CFF450), ref: 00402CC2
                • wsprintfA.USER32 ref: 00402CD2
                • SetWindowTextA.USER32(?,?), ref: 00402CE2
                • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402CF4
                Strings
                • verifying installer: %d%%, xrefs: 00402CCC
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Text$ItemTimerWindowwsprintf
                • String ID: verifying installer: %d%%
                • API String ID: 1451636040-82062127
                • Opcode ID: bae99d8ff7e2baad353350c7eaeb5d71397e6bffa89abe4dcb3f34ba705061ab
                • Instruction ID: 8c289f0fb36a9d27d262e5defce623c0a4e81db89a67886656150a2c4b5e1d8a
                • Opcode Fuzzy Hash: bae99d8ff7e2baad353350c7eaeb5d71397e6bffa89abe4dcb3f34ba705061ab
                • Instruction Fuzzy Hash: 00014F70944208BBEF249F60DD09EEE37A9EB04704F008039FA06B92E0D7B99955CF59
                Function 0040273C Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                Download Yara Rule
                APIs
                • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402790
                • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027AC
                • GlobalFree.KERNEL32(?), ref: 004027EB
                • GlobalFree.KERNEL32(00000000), ref: 004027FE
                • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 00402816
                • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040282A
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Global$AllocFree$CloseDeleteFileHandle
                • String ID:
                • API String ID: 2667972263-0
                • Opcode ID: 2b8880450a0941e35fefda1c3ba4f300f1e60a56ea9b279ad054b7b5189ad6a1
                • Instruction ID: 69dabb1dc5664d4cb3e0aedb1da4cd8560a2ff3041f204a353ec2f52c38cd3f1
                • Opcode Fuzzy Hash: 2b8880450a0941e35fefda1c3ba4f300f1e60a56ea9b279ad054b7b5189ad6a1
                • Instruction Fuzzy Hash: 7C21BF71C00128BBCF206FA5CE49D9E7A79EF04364F14423AF410762E0C7791D009FA9
                Function 00401D9B Relevance: 7.5, APIs: 5, Instructions: 43COMMON
                Download Yara Rule
                APIs
                • GetDC.USER32(?), ref: 00401D9E
                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB8
                • MulDiv.KERNEL32(00000000,00000000), ref: 00401DC0
                • ReleaseDC.USER32(?,00000000), ref: 00401DD1
                • CreateFontIndirectA.GDI32(0040A7E8), ref: 00401E20
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CapsCreateDeviceFontIndirectRelease
                • String ID:
                • API String ID: 3808545654-0
                • Opcode ID: 6a8c14db2f1d773d547e4ece9ff7750bd8912a8ea0f13da685b557514c98691f
                • Instruction ID: 85430ec79d7d493a62f5c90f0650e63f0d0faf8675fc45e27afe54df9b067c18
                • Opcode Fuzzy Hash: 6a8c14db2f1d773d547e4ece9ff7750bd8912a8ea0f13da685b557514c98691f
                • Instruction Fuzzy Hash: CD019271948341AFE7009BB0AE49E9A7FB4DB55305F108479F101BB2E2CA7841909F2F
                Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                Download Yara Rule
                APIs
                • GetDlgItem.USER32(?), ref: 00401D45
                • GetClientRect.USER32(00000000,?), ref: 00401D52
                • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D73
                • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D81
                • DeleteObject.GDI32(00000000), ref: 00401D90
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                • String ID:
                • API String ID: 1849352358-0
                • Opcode ID: d63f6fcb6a70248071c07972b8709aba0c7b18598e4359f2e7158ac2c8b4515b
                • Instruction ID: 236c2df16a83e1707d8be159829b3a1190eecd98233effbe731bed35476ffb6f
                • Opcode Fuzzy Hash: d63f6fcb6a70248071c07972b8709aba0c7b18598e4359f2e7158ac2c8b4515b
                • Instruction Fuzzy Hash: 01F0ECB2A04115BFDB01ABA4DE89DEFBBBCEB44305B044466F601F2191C6749D018B79
                Function 00404852 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                Download Yara Rule
                APIs
                • lstrlenA.KERNEL32(0041FD08,0041FD08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040476D,000000DF,00000000,00000400,?), ref: 004048F0
                • wsprintfA.USER32 ref: 004048F8
                • SetDlgItemTextA.USER32(?,0041FD08), ref: 0040490B
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: ItemTextlstrlenwsprintf
                • String ID: %u.%u%s%s
                • API String ID: 3540041739-3551169577
                • Opcode ID: fc39b083cafe0faf60dc0761f43273384c7893e0f8fea42348e0b2d59e8b85dc
                • Instruction ID: 0ac14a548df83272d562d6c5522d93b353c1d491cf82d9c84c752126d1ac48ba
                • Opcode Fuzzy Hash: fc39b083cafe0faf60dc0761f43273384c7893e0f8fea42348e0b2d59e8b85dc
                • Instruction Fuzzy Hash: 2A11D573A041243BDB0065A99C45EAF3288DB85374F254637FE25F71D2EA78CC1285A8
                Function 00401C0A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                Download Yara Rule
                APIs
                • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C7A
                • SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C92
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: MessageSend$Timeout
                • String ID: !
                • API String ID: 1777923405-2657877971
                • Opcode ID: 5c5cc43d9ea2f1c4f8babb9c5b306aab98c19b0d16ecc4efa158615eb64d646c
                • Instruction ID: 3953527ca16890ec8ab59ce35194567eea46ff7bd29c8182c04533b3460f2dbd
                • Opcode Fuzzy Hash: 5c5cc43d9ea2f1c4f8babb9c5b306aab98c19b0d16ecc4efa158615eb64d646c
                • Instruction Fuzzy Hash: 0C21A2B1E44209BEEF15DFA5D986AAD7BB4EF84304F24843EF501B61D0CB7886418F28
                Function 004023D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                Download Yara Rule
                APIs
                • lstrlenA.KERNEL32(SOFTWARE\Wavesor\SWUpdater\ClientState\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF},00000023,00000011,00000002), ref: 00402421
                • RegSetValueExA.ADVAPI32(?,?,?,?,SOFTWARE\Wavesor\SWUpdater\ClientState\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF},00000000,00000011,00000002), ref: 0040245E
                • RegCloseKey.ADVAPI32(?,?,?,SOFTWARE\Wavesor\SWUpdater\ClientState\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF},00000000,00000011,00000002), ref: 00402542
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CloseValuelstrlen
                • String ID: SOFTWARE\Wavesor\SWUpdater\ClientState\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}
                • API String ID: 2655323295-3979017399
                • Opcode ID: 5391e8230be019b8073da92ef677fa0fa72af143615599fd07648e97b0497649
                • Instruction ID: 1fc307ab1697ef986dd5cd2868f3fef353c7a70d956ff55dcab5481d81c0b37e
                • Opcode Fuzzy Hash: 5391e8230be019b8073da92ef677fa0fa72af143615599fd07648e97b0497649
                • Instruction Fuzzy Hash: E2119371E00115BEDF10EFA5DE49AAEBA74EB54318F20843BF504F71D1C6B95D419B28
                Function 00405902 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                Download Yara Rule
                APIs
                • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004031C3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 00405908
                • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004031C3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 00405911
                • lstrcatA.KERNEL32(?,00409014,?,00000006,00000008,0000000A), ref: 00405922
                Strings
                • C:\Users\user\AppData\Local\Temp\, xrefs: 00405902
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CharPrevlstrcatlstrlen
                • String ID: C:\Users\user\AppData\Local\Temp\
                • API String ID: 2659869361-3355392842
                • Opcode ID: 7d86c92969947f3077f9a158046bd063bc506289d00538d24d19a3cace2b88b5
                • Instruction ID: bd87ec63c1f35a98f82bf41febae71866d1aa3f85b5b5a32f8f6ee96ed89cac6
                • Opcode Fuzzy Hash: 7d86c92969947f3077f9a158046bd063bc506289d00538d24d19a3cace2b88b5
                • Instruction Fuzzy Hash: C6D0A9A26069316ED2022315AC09EEB2A0CCF16319B040022F600B62A2CA3C1D418BFE
                Function 00402003 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON
                Download Yara Rule
                APIs
                • GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 0040202E
                  • Part of subcall function 00405091: lstrlenA.KERNEL32(0041F4E8,00000000,004D7563,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000,?), ref: 004050CA
                  • Part of subcall function 00405091: lstrlenA.KERNEL32(004030CC,0041F4E8,00000000,004D7563,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000), ref: 004050DA
                  • Part of subcall function 00405091: lstrcatA.KERNEL32(0041F4E8,004030CC,004030CC,0041F4E8,00000000,004D7563,00000000), ref: 004050ED
                  • Part of subcall function 00405091: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 004050FF
                  • Part of subcall function 00405091: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405125
                  • Part of subcall function 00405091: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040513F
                  • Part of subcall function 00405091: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040514D
                • LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040203E
                • GetProcAddress.KERNEL32(00000000,?), ref: 0040204E
                • FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B8
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                • String ID:
                • API String ID: 2987980305-0
                • Opcode ID: db5442f5b1e021b3d19732318723c0ab0318f38da9bfae6837580e729b656b77
                • Instruction ID: fd60b9c6cfc4bddbe94fc7e5a8503348695d94644a3847b69ed94d97695b539d
                • Opcode Fuzzy Hash: db5442f5b1e021b3d19732318723c0ab0318f38da9bfae6837580e729b656b77
                • Instruction Fuzzy Hash: BC21C971A00215BBCF207FA48E49BAE75B0AB54359F20413BF601B22D0C6BD4A42D66E
                Function 00402BCD Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON
                Download Yara Rule
                APIs
                • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402C32
                • RegCloseKey.ADVAPI32(?,?,?), ref: 00402C3B
                • RegCloseKey.ADVAPI32(?,?,?), ref: 00402C5C
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Close$Enum
                • String ID:
                • API String ID: 464197530-0
                • Opcode ID: 7491e01b77a4f54db0745fefa8ef52e761586eb4c2d62f00184cdfe08c81871e
                • Instruction ID: 3f870e478545c218cbf8d1d8c83e1046b3ec80cd8b5b23ff6fd5b08b87a912e1
                • Opcode Fuzzy Hash: 7491e01b77a4f54db0745fefa8ef52e761586eb4c2d62f00184cdfe08c81871e
                • Instruction Fuzzy Hash: 76112B36504109FBEF129F91CE09F9E7B69AB48340F104072BE05B51E0E7B5AE11ABA9
                Function 0040599B Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                Download Yara Rule
                APIs
                • CharNextA.USER32(?,?,C:\,?,00405A07,C:\,C:\,75793410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,75793410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004059A9
                • CharNextA.USER32(00000000), ref: 004059AE
                • CharNextA.USER32(00000000), ref: 004059C2
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CharNext
                • String ID: C:\
                • API String ID: 3213498283-3404278061
                • Opcode ID: 10bc9b63e27fd2895a2a79afc72dfc96a7ed1041d934c6f985c348dce719f526
                • Instruction ID: b251aa3e985fa887116ab65003500a8f213bfb7e3cc2aa31c3213714dbeb82a6
                • Opcode Fuzzy Hash: 10bc9b63e27fd2895a2a79afc72dfc96a7ed1041d934c6f985c348dce719f526
                • Instruction Fuzzy Hash: 22F0CDD1908F60AAFB3252684C45B675E88CB56371F1800ABE240A62C282B848408FAA
                Function 00402CFF Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                Download Yara Rule
                APIs
                • DestroyWindow.USER32(00000000,00000000,00402EDF,00000001), ref: 00402D12
                • GetTickCount.KERNEL32 ref: 00402D30
                • CreateDialogParamA.USER32(0000006F,00000000,00402C7C,00000000), ref: 00402D4D
                • ShowWindow.USER32(00000000,00000005), ref: 00402D5B
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Window$CountCreateDestroyDialogParamShowTick
                • String ID:
                • API String ID: 2102729457-0
                • Opcode ID: 10c80b0613a78b839ad02c7969bec3604bf4f1206715e27e9f15991f3fdd17a2
                • Instruction ID: f5aaf9fad63db9690dbd9b3812727a8d708a0014de572c02bbf4379bbf317f26
                • Opcode Fuzzy Hash: 10c80b0613a78b839ad02c7969bec3604bf4f1206715e27e9f15991f3fdd17a2
                • Instruction Fuzzy Hash: 42F05E70906220ABCA217F64FE4CACB7BA4FB45B527014576F145B11E4C3799C8ACBDD
                Function 00405005 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                Download Yara Rule
                APIs
                • IsWindowVisible.USER32(?), ref: 00405034
                • CallWindowProcA.USER32(?,?,?,?), ref: 00405085
                  • Part of subcall function 00404055: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404067
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Window$CallMessageProcSendVisible
                • String ID:
                • API String ID: 3748168415-3916222277
                • Opcode ID: 3aee37f21ff99dc198a5fd33356f68d884607a106991554e7d1ecd4dd831c2ab
                • Instruction ID: 5be162d7cd7d71c2ccb341d7130f59d8c0266776e22eb2788f3d6f03133d665e
                • Opcode Fuzzy Hash: 3aee37f21ff99dc198a5fd33356f68d884607a106991554e7d1ecd4dd831c2ab
                • Instruction Fuzzy Hash: 2D019A7150060DABDF209F20DC80EAF3A25EB80354F204036FA14792D0C73A8891AEAA
                Function 00405E51 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                Download Yara Rule
                APIs
                • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,0041F4E8,?,?,?,00000002,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,?,00406095,80000002), ref: 00405E97
                • RegCloseKey.ADVAPI32(?,?,00406095,80000002,Software\Microsoft\Windows\CurrentVersion,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe,?,0041F4E8), ref: 00405EA2
                Strings
                • C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe, xrefs: 00405E54, 00405E88
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CloseQueryValue
                • String ID: C:\Users\user\AppData\Local\Temp\nsk1CF9.tmp\setup.exe
                • API String ID: 3356406503-67217748
                • Opcode ID: 0288708f4d7737bac9a1074e9ca2e73b9ec30620d1184b938b48006dcff2752a
                • Instruction ID: d4591e39b0d39d961dff3dfa4a9982e28399459fd93e33a5317855cc39530622
                • Opcode Fuzzy Hash: 0288708f4d7737bac9a1074e9ca2e73b9ec30620d1184b938b48006dcff2752a
                • Instruction Fuzzy Hash: 92019A72510609ABDF228F20CC09FDB3FA9EF48360F008026FA45A2190D338DA11CBA4
                Function 00405609 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                Download Yara Rule
                APIs
                • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 00405632
                • CloseHandle.KERNEL32(?), ref: 0040563F
                Strings
                • Error launching installer, xrefs: 0040561C
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CloseCreateHandleProcess
                • String ID: Error launching installer
                • API String ID: 3712363035-66219284
                • Opcode ID: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
                • Instruction ID: 9728a5d5e843408a2f651da6c1778568bac2657747ba6051cf584ee7dfff0d45
                • Opcode Fuzzy Hash: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
                • Instruction Fuzzy Hash: B0E046F0A00209BFEB009B60EC09F7B7AACEB10748F404861BD11F32A0E374A9108A79
                Function 00403703 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                Download Yara Rule
                APIs
                • FreeLibrary.KERNEL32(?,75793410,00000000,C:\Users\user\AppData\Local\Temp\,004036DB,004034F5,?,?,00000006,00000008,0000000A), ref: 0040371D
                • GlobalFree.KERNEL32(?), ref: 00403724
                Strings
                • C:\Users\user\AppData\Local\Temp\, xrefs: 00403703
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: Free$GlobalLibrary
                • String ID: C:\Users\user\AppData\Local\Temp\
                • API String ID: 1100898210-3355392842
                • Opcode ID: 35d1f02da0abf4a3a5ea65bd0cdd12c9264502c99e7b9c945f64e5a7c8fdc6a2
                • Instruction ID: 9ffce7b129726733408ddd2483fbf3d013749e605b0eca4be9f0b214f3a53a2d
                • Opcode Fuzzy Hash: 35d1f02da0abf4a3a5ea65bd0cdd12c9264502c99e7b9c945f64e5a7c8fdc6a2
                • Instruction Fuzzy Hash: 25E01273805121A7C7355F56ED04B5E7768AF49B22F05806BEC407B3A0C7746C418BD9
                Function 00405949 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                Download Yara Rule
                APIs
                • lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402DCF,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe,C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe,80000000,00000003), ref: 0040594F
                • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402DCF,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe,C:\Users\user\Desktop\WaveInstaller_x64-v1.5.18.2_from-v1.3.16.1.exe,80000000,00000003), ref: 0040595D
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: CharPrevlstrlen
                • String ID: C:\Users\user\Desktop
                • API String ID: 2709904686-3370423016
                • Opcode ID: 714da30cf500cccbdd7b4a4277d37f3a4e299a669b52a45b343dae58782ad56f
                • Instruction ID: c4fcca613fcdd7c15110d01ecf8f186c4298fc2a4ba311cc039d9d6f64372384
                • Opcode Fuzzy Hash: 714da30cf500cccbdd7b4a4277d37f3a4e299a669b52a45b343dae58782ad56f
                • Instruction Fuzzy Hash: B7D0A7A3408D705EE3036310DC04B9F6A48CF12314F490062F080B61A5C67C1C424BAE
                Function 00405A68 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                Download Yara Rule
                APIs
                • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CC3,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405A78
                • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405A90
                • CharNextA.USER32(00000000,?,00000000,00405CC3,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AA1
                • lstrlenA.KERNEL32(00000000,?,00000000,00405CC3,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AAA
                Memory Dump Source
                • Source File: 00000000.00000002.73778245087.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.73778216653.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778275519.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778326036.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.73778455320.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_400000_WaveInstaller_x64-v1.jbxd
                Similarity
                • API ID: lstrlen$CharNextlstrcmpi
                • String ID:
                • API String ID: 190613189-0
                • Opcode ID: 57b21f4120e00b08a3941e9ed4e610408d9ca53935617fe6296070accebd3829
                • Instruction ID: 037941339f6bd63fe355126afe518e0153d46939b0274778cc0aadc7e03f3bf8
                • Opcode Fuzzy Hash: 57b21f4120e00b08a3941e9ed4e610408d9ca53935617fe6296070accebd3829
                • Instruction Fuzzy Hash: 29F0C231605414AFC702DBA5DC40D9FBBA8EF46350B2541A6E800F7251D234EE01AFA9