Edit tour

Windows Analysis Report
SW-GX-3R(EX)_06293_setup.exe

Overview

General Information

Sample name:	SW-GX-3R(EX)_06293_setup.exe
Analysis ID:	1579780
MD5:	5e1e66319cace2ea52f37e9f025e40fb
SHA1:	2fd7c9e96c17ab5da52b43108cb9e4a44213a536
SHA256:	30d2957b6b44309b4121193bc52f9e3a6bf4bb2b36bf53c19db7607f3f07cc5a
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

PE file has a writeable .text section

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SW-GX-3R(EX)_06293_setup.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe" MD5: 5E1E66319CACE2EA52F37E9F025E40FB)

msiexec.exe (PID: 7500 cmdline: MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Downloaded Installations\{7DED6250-9973-44A8-BFD0-71491CF41AEA}\GX-3R.msi" SETUPEXEDIR="C:\Users\user\Desktop" SETUPEXENAME="SW-GX-3R(EX)_06293_setup.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7532 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7576 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 965794F20A6A7A4389D97787515D8009 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7952 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding A68C3EFAC0AEFE0BC0AA104F747B6A98 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 8040 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 588624F03B769A27B304CA4FE9239E00 M Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 8076 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexch35.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 8096 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexcl35.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 8132 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjet35.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 8176 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjt4jlt.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7180 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msltus35.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7208 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mspdox35.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7228 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msrd2x35.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5812 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mstext35.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5956 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msxbse35.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Source: Process started

Author: frack113: Data: Command: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexch35.dll", CommandLine: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexch35.dll", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\msiexec.exe, NewProcessName: C:\Windows\SysWOW64\msiexec.exe, OriginalFileName: C:\Windows\SysWOW64\msiexec.exe, ParentCommandLine: C:\Windows\system32\msiexec.exe /V, ParentImage: C:\Windows\System32\msiexec.exe, ParentProcessId: 7532, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexch35.dll", ProcessId: 8076, ProcessName: msiexec.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: SW-GX-3R(EX)_06293_setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: 6 symbols\dll\msjtes40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msltus40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\mspbde40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,pV symbols\dll\msexch40.pdbd source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msexcl40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: V symbols\dll\msrepl40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\Setup___Win32_Release_Unicode\setup.pdb source: SW-GX-3R(EX)_06293_setup.exe
Source:	Binary string: symbols\dll\msjet40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\msltus40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,vV symbols\dll\msjet40.pdbd source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msrepl40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: V symbols\dll\msrd2x40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,zV symbols\dll\msjtes40.pdbD source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msjtes40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msjetoledb40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,rV symbols\dll\msexcl40.pdbd source: GX-3R.msi.0.dr
Source:	Binary string: ` symbols\dll\msexch40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msrd2x40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msrd3x40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\msrepl40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\mstext40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msxbde40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\msjet40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\expsrv.pdb source: GX-3R.msi.0.dr
Source:	Binary string: t,6 symbols\dll\msexcl40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\mstext40.pdbd source: GX-3R.msi.0.dr
Source:	Binary string: ,xV symbols\dll\msjetoledb40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\dao360.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,\|V symbols\dll\mspbde40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 5 symbols\dll\dao360.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msexch40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: t,6 symbols\dll\msrd3x40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ` symbols\dll\msrd2x40.pdb$ source: GX-3R.msi.0.dr
Source:	Binary string: V symbols\dll\expsrv.pdb source: GX-3R.msi.0.dr
Source:	Binary string: V symbols\dll\mstext40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\msjetoledb40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,{V symbols\dll\msltus40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: V symbols\dll\msxbde40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\mspbde40.pdbd source: GX-3R.msi.0.dr
Source:	Binary string: v,r` symbols\dll\expsrv.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 5 symbols\dll\msxbde40.pdbD source: GX-3R.msi.0.dr
Source:	Binary string: .pdB# source: SW-GX-3R(EX)_06293_setup.exe

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0042217D __EH_prolog3,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW,		0_2_0042217D
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0045A208 GetProcAddress,SearchPathW,GetModuleFileNameW,FindFirstFileW,CreateEventW,VirtualProtect,VirtualQuery,VirtualProtect,VirtualProtect,		0_2_0045A208

Source: GX-3R.msi.0.dr	String found in binary or memory: http://www.flexerasoftware.com0
Source: SW-GX-3R(EX)_06293_setup.exe	String found in binary or memory: http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d

System Summary

PE file has a writeable .text section

Source: richtx32.ocx.2.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_004464E0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

0_2_004464E0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\668c32.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{1FFE8FB4-E84F-4460-8750-7986F429A342}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9308.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9413.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9471.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Vsflex7.ocx	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\cmdlgjp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\comdlg32.ocx	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\JETCOMP.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msexch35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msexcl35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjet35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjint35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjt4jlt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjter35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msltus35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mspdox35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msrd2x35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msrepl35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msrpfs35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mstext35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msxbse35.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\VBAR332.DLL	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Odbcjet.hlp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Odbcjet.cnt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc42loc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mscomct2.ocx	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mscomctl.ocx	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\vb6jp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\richtx32.ocx	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_ATLUnicode_f1.7EBEDD68_AA66_11D2_B980_006097C4DE24	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F479_Dao360.dll.5B60FF9E_851D_11D4_A752_00B0D0428C0C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F248_vbajet32.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F1122_Expsrv.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_MFC42ANSICore_f0.51D569E2_8A28_11D2_B962_006097C4DE24	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\ARPPRODUCTICON.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut1_0BE5A0A4C6544045B9A8BB1F57F0AFD3.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut11_24FC0B0B186C41C78A4A8C3D821B787F.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\668c34.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\668c34.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI9308.tmp

Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0042C448	0_2_0042C448
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0048C026	0_2_0048C026
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_004940F0	0_2_004940F0
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0047C10A	0_2_0047C10A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00488463	0_2_00488463
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0046C710	0_2_0046C710
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0048898E	0_2_0048898E
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00480DCA	0_2_00480DCA
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00488ED2	0_2_00488ED2
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00478EDA	0_2_00478EDA
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00498EB0	0_2_00498EB0
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0048954E	0_2_0048954E
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00469788	0_2_00469788
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0045D8D8	0_2_0045D8D8
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00469C5D	0_2_00469C5D
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00475D7D	0_2_00475D7D
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0046A031	0_2_0046A031
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00496230	0_2_00496230
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0046A43D	0_2_0046A43D
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0046A85D	0_2_0046A85D
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00476B9E	0_2_00476B9E
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00476E19	0_2_00476E19
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00473084	0_2_00473084
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0047711E	0_2_0047711E
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0048B8D3	0_2_0048B8D3
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00493890	0_2_00493890
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00477CF4	0_2_00477CF4
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00493CF0	0_2_00493CF0

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: String function: 0040F3F1 appears 31 times
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: String function: 0040E918 appears 41 times
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: String function: 0047565F appears 35 times
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: String function: 00408D97 appears 43 times
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: String function: 004096BA appears 118 times
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: String function: 00464713 appears 70 times
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: String function: 00463F3B appears 65 times
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: String function: 00464749 appears 93 times
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: String function: 004646E0 appears 715 times
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: String function: 004018B0 appears 176 times
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: String function: 004676BC appears 57 times

Source: vb6jp.dll.2.dr	Static PE information: No import functions for PE file found
Source: mfc42loc.dll.2.dr	Static PE information: No import functions for PE file found
Source: Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24.2.dr	Static PE information: No import functions for PE file found
Source: cmdlgjp.dll.2.dr	Static PE information: No import functions for PE file found

Source: SW-GX-3R(EX)_06293_setup.exe, 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstallShield Setup.exe, vs SW-GX-3R(EX)_06293_setup.exe
Source: SW-GX-3R(EX)_06293_setup.exe	Binary or memory string: OriginalFilenameInstallShield Setup.exe, vs SW-GX-3R(EX)_06293_setup.exe

Source: SW-GX-3R(EX)_06293_setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: richtx32.ocx.2.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_CACHED, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: sus24.winEXE@28/82@0/0

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_004464E0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

0_2_004464E0

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_00441F61 LoadLibraryW,GetProcAddress,lstrcpyW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,FreeLibrary,

0_2_00441F61

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_0044D92E __EH_prolog3_GS,GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,CoCreateInstance,

0_2_0044D92E

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_004177BA FindResourceW,SizeofResource,LoadResource,LockResource,

0_2_004177BA

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\GX-3R

Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

File created: C:\Users\user\AppData\Local\Downloaded Installations

Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

File created: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\

Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: debuglog	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: runfromtemp	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: reboot	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: %s%s	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: tempdisk1folder	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: ISSetup.dll	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: ISSetup.dll	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: Skin	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: Startup	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: setup.isn	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: count	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: Languages	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: key%d	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: Languages	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: %s\0x%04x.ini	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: %s\0x%04x.ini	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: %s\%04x.mst	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: %s\%04x.mst	0_2_0043E15A
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Command line argument: `UG	0_2_004754B0

Source: SW-GX-3R(EX)_06293_setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

File read: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI

Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

File read: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe "C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe"
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Downloaded Installations\{7DED6250-9973-44A8-BFD0-71491CF41AEA}\GX-3R.msi" SETUPEXEDIR="C:\Users\user\Desktop" SETUPEXENAME="SW-GX-3R(EX)_06293_setup.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 965794F20A6A7A4389D97787515D8009 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A68C3EFAC0AEFE0BC0AA104F747B6A98
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 588624F03B769A27B304CA4FE9239E00 M Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexch35.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexcl35.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjet35.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjt4jlt.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msltus35.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mspdox35.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msrd2x35.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mstext35.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msxbse35.dll"
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Downloaded Installations\{7DED6250-9973-44A8-BFD0-71491CF41AEA}\GX-3R.msi" SETUPEXEDIR="C:\Users\user\Desktop" SETUPEXENAME="SW-GX-3R(EX)_06293_setup.exe"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 965794F20A6A7A4389D97787515D8009 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A68C3EFAC0AEFE0BC0AA104F747B6A98	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 588624F03B769A27B304CA4FE9239E00 M Global\MSI0000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexch35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexcl35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjet35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjt4jlt.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msltus35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mspdox35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msrd2x35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mstext35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msxbse35.dll"	Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msexch35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjet35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msvcrt40.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjint35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msexcl35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjet35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjint35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjet35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjt4jlt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msltus35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjet35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjint35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mspdox35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjint35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msrd2x35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjet35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mstext35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjet35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjint35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msxbse35.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msjint35.dll	Jump to behavior

Source: GX-3R.lnk.2.dr	LNK file: ..\..\..\..\..\Program Files (x86)\GX-3R\GX3R.exe
Source: GX-3R.lnk0.2.dr	LNK file: ..\..\..\Program Files (x86)\GX-3R\GX3R.exe

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

File written: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: I accept the terms in the license agreement
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SW-GX-3R(EX)_06293_setup.exe

Static file information: File size 31250995 > 1048576

Source: SW-GX-3R(EX)_06293_setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: 6 symbols\dll\msjtes40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msltus40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\mspbde40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,pV symbols\dll\msexch40.pdbd source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msexcl40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: V symbols\dll\msrepl40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\Setup___Win32_Release_Unicode\setup.pdb source: SW-GX-3R(EX)_06293_setup.exe
Source:	Binary string: symbols\dll\msjet40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\msltus40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,vV symbols\dll\msjet40.pdbd source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msrepl40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: V symbols\dll\msrd2x40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,zV symbols\dll\msjtes40.pdbD source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msjtes40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msjetoledb40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,rV symbols\dll\msexcl40.pdbd source: GX-3R.msi.0.dr
Source:	Binary string: ` symbols\dll\msexch40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msrd2x40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msrd3x40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\msrepl40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\mstext40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msxbde40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\msjet40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\expsrv.pdb source: GX-3R.msi.0.dr
Source:	Binary string: t,6 symbols\dll\msexcl40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\mstext40.pdbd source: GX-3R.msi.0.dr
Source:	Binary string: ,xV symbols\dll\msjetoledb40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\dao360.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,\|V symbols\dll\mspbde40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 5 symbols\dll\dao360.pdb source: GX-3R.msi.0.dr
Source:	Binary string: symbols\dll\msexch40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: t,6 symbols\dll\msrd3x40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ` symbols\dll\msrd2x40.pdb$ source: GX-3R.msi.0.dr
Source:	Binary string: V symbols\dll\expsrv.pdb source: GX-3R.msi.0.dr
Source:	Binary string: V symbols\dll\mstext40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\msjetoledb40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: ,{V symbols\dll\msltus40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: V symbols\dll\msxbde40.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 6 symbols\dll\mspbde40.pdbd source: GX-3R.msi.0.dr
Source:	Binary string: v,r` symbols\dll\expsrv.pdb source: GX-3R.msi.0.dr
Source:	Binary string: 5 symbols\dll\msxbde40.pdbD source: GX-3R.msi.0.dr
Source:	Binary string: .pdB# source: SW-GX-3R(EX)_06293_setup.exe

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_0042C448 _memset,_memset,lstrlenW,_memset,wsprintfW,___FUnloadDelayLoadedDLL2@4,LoadLibraryW,GetProcAddress,GetLastError,GetSystemTimeAsFileTime,

0_2_0042C448

Source: MSI3CCA.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x12bc5
Source: MSI9471.tmp.2.dr	Static PE information: real checksum: 0x0 should be: 0xba91
Source: Vsflex7.ocx.2.dr	Static PE information: real checksum: 0x0 should be: 0x83140
Source: RKComm.ocx.2.dr	Static PE information: real checksum: 0x0 should be: 0x23ba8
Source: Global_VC_ATLUnicode_f1.7EBEDD68_AA66_11D2_B980_006097C4DE24.2.dr	Static PE information: real checksum: 0x0 should be: 0x1bc64
Source: NewShortcut1_0BE5A0A4C6544045B9A8BB1F57F0AFD3.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x10280
Source: RkIrDA11.ocx.2.dr	Static PE information: real checksum: 0x0 should be: 0x12215
Source: richtx32.ocx.2.dr	Static PE information: real checksum: 0x37a99 should be: 0x4aa56
Source: ARPPRODUCTICON.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x1389e
Source: Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24.2.dr	Static PE information: real checksum: 0x0 should be: 0x52af
Source: JETCOMP.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x13c21
Source: NewShortcut11_24FC0B0B186C41C78A4A8C3D821B787F.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x10280

Source: F1122_Expsrv.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2.2.dr	Static PE information: section name: ENGINE
Source: msexch35.dll.2.dr	Static PE information: section name: CURSORS
Source: msexch35.dll.2.dr	Static PE information: section name: BASE
Source: msjint35.dll.2.dr	Static PE information: section name: WEP_TEXT
Source: VBAR332.DLL.2.dr	Static PE information: section name: ENGINE
Source: Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B.2.dr	Static PE information: section name: ENGINE

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_3_00734A51 push ebx; retf	0_3_00734A52
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_3_00734A51 push ebx; retf	0_3_00734A52
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_3_00734A51 push ebx; retf	0_3_00734A52
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_3_00734A51 push ebx; retf	0_3_00734A52
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_3_00734A51 push ebx; retf	0_3_00734A52
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_3_00734A51 push ebx; retf	0_3_00734A52
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_3_00734A51 push ebx; retf	0_3_00734A52
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_3_00734A51 push ebx; retf	0_3_00734A52
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_3_00734A51 push ebx; retf	0_3_00734A52
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_004647B8 push ecx; ret	0_2_004647CB
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_00467701 push ecx; ret	0_2_00467714

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msrd2x35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F479_Dao360.dll.5B60FF9E_851D_11D4_A752_00B0D0428C0C	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\comdlg32.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msxbse35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mscomct2.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9308.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjet35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\vb6jp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\GX-3R\RKComm.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\GX-3R\GX3R.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\VBAR332.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\cmdlgjp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msexcl35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjt4jlt.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Vsflex7.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F1122_Expsrv.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\JETCOMP.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\GX-3R\RkIrDA11.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut11_24FC0B0B186C41C78A4A8C3D821B787F.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9471.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjint35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F248_vbajet32.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mstext35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msrpfs35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msltus35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msrepl35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mspdox35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjter35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\richtx32.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mscomctl.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc42loc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_MFC42ANSICore_f0.51D569E2_8A28_11D2_B962_006097C4DE24	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI3CCA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_ATLUnicode_f1.7EBEDD68_AA66_11D2_B980_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msexch35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut1_0BE5A0A4C6544045B9A8BB1F57F0AFD3.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msrd2x35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F479_Dao360.dll.5B60FF9E_851D_11D4_A752_00B0D0428C0C	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\comdlg32.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msxbse35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mscomct2.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9308.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjet35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\vb6jp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\VBAR332.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\cmdlgjp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msexcl35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjt4jlt.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Vsflex7.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F1122_Expsrv.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\JETCOMP.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut11_24FC0B0B186C41C78A4A8C3D821B787F.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9471.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjint35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F248_vbajet32.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mstext35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msrpfs35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msltus35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msrepl35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mspdox35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msjter35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\richtx32.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mscomctl.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\mfc42loc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_MFC42ANSICore_f0.51D569E2_8A28_11D2_B962_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_ATLUnicode_f1.7EBEDD68_AA66_11D2_B980_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\msexch35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut1_0BE5A0A4C6544045B9A8BB1F57F0AFD3.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_ATLUnicode_f1.7EBEDD68_AA66_11D2_B980_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F479_Dao360.dll.5B60FF9E_851D_11D4_A752_00B0D0428C0C	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F248_vbajet32.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F1122_Expsrv.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_MFC42ANSICore_f0.51D569E2_8A28_11D2_B962_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_00428196 __EH_prolog3,GetTempPathW,CoCreateGuid,CreateDirectoryW,GetPrivateProfileStringW,CreateDirectoryW,

0_2_00428196

Source: C:\Windows\System32\msiexec.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GX-3R.lnk

Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_0045A382 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0045A382

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\comdlg32.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F479_Dao360.dll.5B60FF9E_851D_11D4_A752_00B0D0428C0C	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mscomct2.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9308.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\vb6jp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\GX-3R\RKComm.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\GX-3R\GX3R.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\VBAR332.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\cmdlgjp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Vsflex7.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F1122_Expsrv.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\JETCOMP.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\GX-3R\RkIrDA11.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut11_24FC0B0B186C41C78A4A8C3D821B787F.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9471.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F248_vbajet32.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\msrpfs35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\msrepl35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\msjter35.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\richtx32.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mscomctl.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_MFC42ANSICore_f0.51D569E2_8A28_11D2_B962_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc42loc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI3CCA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_ATLUnicode_f1.7EBEDD68_AA66_11D2_B980_006097C4DE24	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut1_0BE5A0A4C6544045B9A8BB1F57F0AFD3.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24	Jump to dropped file

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-75130
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-75189

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0042217D __EH_prolog3,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW,		0_2_0042217D
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0045A208 GetProcAddress,SearchPathW,GetModuleFileNameW,FindFirstFileW,CreateEventW,VirtualProtect,VirtualQuery,VirtualProtect,VirtualProtect,		0_2_0045A208

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_00440295 __EH_prolog3,VirtualQuery,GetSystemInfo,MapViewOfFile,

0_2_00440295

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

API call chain: ExitProcess graph end node

graph_0-75131

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_004646D1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_004646D1

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_0042C448 _memset,_memset,lstrlenW,_memset,wsprintfW,___FUnloadDelayLoadedDLL2@4,LoadLibraryW,GetProcAddress,GetLastError,GetSystemTimeAsFileTime,

0_2_0042C448

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_004097D1 GetFileSize,GetProcessHeap,GetProcessHeap,HeapAlloc,ReadFile,lstrlenA,__alloca_probe_16,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,ReadFile,GetProcessHeap,HeapFree,

0_2_004097D1

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_004646D1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004646D1
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0046CC4D __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0046CC4D
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_004657C4 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004657C4
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: 0_2_0047A13D SetUnhandledExceptionFilter,	0_2_0047A13D

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexch35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexcl35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjet35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjt4jlt.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msltus35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mspdox35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msrd2x35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mstext35.dll"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msxbse35.dll"	Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_0043C6DF __EH_prolog3,_memset,_memset,_memset,_memset,_memset,_memset,InitializeSecurityDescriptor,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,SetSecurityDescriptorDacl,CoInitializeSecurity,

0_2_0043C6DF

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_00458DDF GetCurrentThread,OpenThreadToken,GetLastError,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,

0_2_00458DDF

Source: SW-GX-3R(EX)_06293_setup.exe	Binary or memory string: AShell_TrayWndTahoma
Source: SW-GX-3R(EX)_06293_setup.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	0_2_0047CC3C
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	0_2_0047CD53
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	0_2_0047CDEB
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	0_2_0047CE5F
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	0_2_0047D031
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: EnumSystemLocalesA,	0_2_0047D0F4
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0047D11E
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	0_2_0047D1C1
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0047D185
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	0_2_0046D5FD
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: GetLocaleInfoW,TranslateCharsetInfo,IsValidLocale,	0_2_004419CA
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: GetLocaleInfoW,	0_2_00441A4E
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: GetLocaleInfoA,	0_2_0048A79F
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_0047AA43
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: GetLocaleInfoA,	0_2_0048AA33
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	0_2_0047B0E4
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	0_2_0047B36F
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	0_2_0047B635
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: GetLocaleInfoW,	0_2_00483CDC
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	0_2_00483CF5
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	0_2_00483D29
Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_00483E68

Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_0042C448 _memset,_memset,lstrlenW,_memset,wsprintfW,___FUnloadDelayLoadedDLL2@4,LoadLibraryW,GetProcAddress,GetLastError,GetSystemTimeAsFileTime,

0_2_0042C448

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_00489D12 __lock,__get_daylight,__invoke_watson,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

0_2_00489D12

Source: C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe

Code function: 0_2_00432A7F GetVersionExW,GetSystemInfo,

0_2_00432A7F

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	32 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	12 Process Injection	1 Access Token Manipulation	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	26 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SW-GX-3R(EX)_06293_setup.exe	0%	Virustotal		Browse
SW-GX-3R(EX)_06293_setup.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\GX-3R\GX3R.exe	0%	ReversingLabs
C:\Program Files (x86)\GX-3R\GX3R.exe	1%	Virustotal	Browse
C:\Program Files (x86)\GX-3R\RKComm.ocx	0%	ReversingLabs
C:\Program Files (x86)\GX-3R\RKComm.ocx	0%	Virustotal	Browse
C:\Program Files (x86)\GX-3R\RkIrDA11.ocx	0%	ReversingLabs
C:\Program Files (x86)\GX-3R\RkIrDA11.ocx	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSI3CCA.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI3CCA.tmp	0%	Virustotal	Browse
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F1122_Expsrv.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F248_vbajet32.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F479_Dao360.dll.5B60FF9E_851D_11D4_A752_00B0D0428C0C	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_ATLUnicode_f1.7EBEDD68_AA66_11D2_B980_006097C4DE24	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_MFC42ANSICore_f0.51D569E2_8A28_11D2_B962_006097C4DE24	0%	ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B	0%	ReversingLabs
C:\Windows\Installer\MSI9308.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI9471.tmp	0%	ReversingLabs
C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\ARPPRODUCTICON.exe	0%	ReversingLabs
C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut11_24FC0B0B186C41C78A4A8C3D821B787F.exe	0%	ReversingLabs
C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut1_0BE5A0A4C6544045B9A8BB1F57F0AFD3.exe	0%	ReversingLabs
C:\Windows\SysWOW64\JETCOMP.exe	0%	ReversingLabs
C:\Windows\SysWOW64\VBAR332.DLL	0%	ReversingLabs
C:\Windows\SysWOW64\Vsflex7.ocx	0%	ReversingLabs
C:\Windows\SysWOW64\cmdlgjp.dll	0%	ReversingLabs
C:\Windows\SysWOW64\comdlg32.ocx	0%	ReversingLabs
C:\Windows\SysWOW64\mfc42loc.dll	0%	ReversingLabs
C:\Windows\SysWOW64\mscomct2.ocx	0%	ReversingLabs
C:\Windows\SysWOW64\mscomctl.ocx	0%	ReversingLabs
C:\Windows\SysWOW64\msexch35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msexcl35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msjet35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msjint35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msjt4jlt.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msjter35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msltus35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\mspdox35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msrd2x35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msrepl35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msrpfs35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\mstext35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\msxbse35.dll	0%	ReversingLabs
C:\Windows\SysWOW64\richtx32.ocx	0%	ReversingLabs
C:\Windows\SysWOW64\vb6jp.dll	0%	ReversingLabs

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d	SW-GX-3R(EX)_06293_setup.exe	false		high
http://www.flexerasoftware.com0	GX-3R.msi.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579780
Start date and time:	2024-12-23 08:09:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SW-GX-3R(EX)_06293_setup.exe
Detection:	SUS
Classification:	sus24.winEXE@28/82@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 159 Number of non-executed functions: 242
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetValueKey calls found.

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	461951
Entropy (8bit):	5.1337031006066045
Encrypted:	false
SSDEEP:	6144:fd0t32q/EqUsm7EOViOD9qxzlpUiX8F3mQO/sPNGiep1THf1LR0JsbwTKZvOmcMF:fd0mnyFd
MD5:	58A037DE5DAD7B7AAE58F4BC814E4A5E
SHA1:	F970C65516B01F579172FAF8E2780F0514C3C0E0
SHA-256:	A6C5BCE51AA537981A45B7045CB5EB50ADF856AE4A447225AFF7FF49FFCC3DC7
SHA-512:	06A1F0327CD06B06B12F8692979AD69BC9B80D4D1A15B582741B4F2BD072BDBD1194342CBF58C2F5C0A77AC0C424EEA2B3871C9C8AC7ABFD750F8BD2092D2931
Malicious:	false
Preview:	...@IXOS.@.....@h..Y.@.....@.....@.....@.....@.....@......&.{1FFE8FB4-E84F-4460-8750-7986F429A342}..GX-3R..GX-3R.msi.@.....@8....@.....@......ARPPRODUCTICON.exe..&.{7DED6250-9973-44A8-BFD0-71491CF41AEA}.....@.....@.....@.....@.......@.....@.....@.......@......GX-3R......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{D660CA73-6A31-4F26-AF16-A5EA2ECF7CE6}&.{1FFE8FB4-E84F-4460-8750-7986F429A342}.@......&.{B79EFD6D-4EBC-4456-A892-23A66A0B43E7}&.{1FFE8FB4-E84F-4460-8750-7986F429A342}.@......&.{0603DFE6-9D20-45DD-B513-4F04ED72CBE2}&.{1FFE8FB4-E84F-4460-8750-7986F429A342}.@......&.{DA010909-432F-4C27-8FBA-C247E3367969}&.{1FFE8FB4-E84F-4460-8750-7986F429A342}.@......&.{9523F04B-9509-4468-8C4E-F958ACE34D38}&.{1FFE8FB4-E84F-4460-8750-7986F429A342}.@......&.{BA89B7A1-E969-4C9F-A736-F4A640EC69B6}&.{1FFE8FB4-E84F-4460-8750-7986F429A342}.@......&.{436D7A21-36BE-11D2-ACBB-0080C7FCBB84}&.{1FFE8FB4-E84F-44

C:\Program Files (x86)\GX-3R\FILEMOVE.AVI

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	3.634160168998589
Encrypted:	false
SSDEEP:	384:yd1giwBlmmmbklsCfec1zxSQ6bjvWhtROS6vnivx4j6D6bXpnQ4x/4UN8l3WpTBp:qgiSlmmmbeskhx8HvWhvZ6PKx4yGX3GU
MD5:	E9445AF1E1B67FC32A3C87D9CE0C33B8
SHA1:	4678180934C6CD61876071842DB8E78DA724A04A
SHA-256:	B475C20B53529299D0B9D49D43E25291D50DBCB7212F8377DDB27FF2E1DEC83B
SHA-512:	2EC9C0D5377F019539C7E1FE6DC6EDB2A28E3AFBCA9DBFB5513F78E56D350FD721698909D8B0BE7AB79CEFB783997CA481BCE5209D9F6A592E0631F1DC6BB9F7
Malicious:	false
Preview:	RIFF(K..AVI LIST....hdrlavih8...........G\AN...."...................<........#...m......LIST....strlstrh8...vidsRLE ................@B......"...(....'..............strfh...(.......<............?..................................................................................vedt............JUNK................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GX-3R\GX3R.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4640768
Entropy (8bit):	5.85732655995438
Encrypted:	false
SSDEEP:	98304:7icit+jDLq2pOsUjH0+zP1Z296lZ4bzY8SL9DlOKdN71XYxmfji9CWueVyK/T8Vg:7icit+jDLq2pOsUjH0+zP1Z296lZ4bzZ
MD5:	A66BAEEC537FBEC8609034FD278B8FD1
SHA1:	CABAE92B4D7DB7CFF83E1053FADE4BD1422D2D01
SHA-256:	B1FAC7EB9AADC704B5164A2EE76F238161EA055DA680A01E4A261BCD212227D9
SHA-512:	A9E13D4210CD990CB5DAB4E7A22295E562A51A0EC42D69875B9B53E85B69D4CBCF8C790FD816D4B46D69C2A8185F819C7FE6C54EDCDB6EC74DC76952E17C700E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.x.....................\...4...%.......Rich............................PE..L......b..................E...................E...@..........................PG......OG.....................................D.E.(....PF.z...................................................................8... ....................................text.....E.......E................. ..`.data.........E.......E.............@....rsrc...z....PF.......E.............@..@...H............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GX-3R\RKComm.ocx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	5.26972061191781
Encrypted:	false
SSDEEP:	1536:lIAZcbTdSt/xSlh8C9YnN0AGyx6yx6koT9rJIS3u/EbKx5tH7VEM:kgt/xSlh8CYN0dqx6koT9rJIW0aW/BE
MD5:	EBDE727381080A58789C4BE6309B90D6
SHA1:	3BC0CCAF7DF2881EB26F7298AEFE53281261C8DC
SHA-256:	365BA176FA3ED2A38E8047CB2540F0A362387970F505621C270627D0EA73055C
SHA-512:	3545EB257116CEE9B2DFB54B8E5EFC73A50EE00EF1C4F692700D530BD3A70DA547E03C3BBE7BB11F067C71C3D7DDF981517CD2B1C5F223E04F93DE5BE25486B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................................^......f......Rich............PE..L...D..`...........!.........................................................p...........................................................O...................P..........................................................,............................text............................... ..`.rdata..c8.......@..................@..@.data...............................@....rsrc....O.......P..................@..@.reloc..H....P... ...@..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GX-3R\RkIrDA11.ocx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.274014695372415
Encrypted:	false
SSDEEP:	384:QTkWx9BXsNdEWapd7Y/IO5spbcgMA7ybspbdjm0MeqRDn+Nrdk0vKfupF+P:QT99tszENp/OIcjKdq0MVRbkrWUmP
MD5:	64EC983F2B4033EB6331E928487FAD95
SHA1:	A2AB55E6460AC8788E0D9002CE460AB78FAC5BE7
SHA-256:	510D9FE16528F3E1AEA176A007257A7990B0552151B777B81E0B3855930EDCD8
SHA-512:	8B3DD68860EDC6A53D06B378C3039EC06F7239A7375B94E845AE7AA25C34E0824BBC6BC6579722DC4FD0CFF678A8BA5D11FA5D827AA74AB6E40D507574D16DCD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7.m.s...s...s...%...t.......u.......r.......q.......w.......q...E...p...s...y...E...{.......r.......r...Richs...........PE..L...mV.S...........!.....0...........8.......@.......................................................................X......pR...........'...........................................................................@..T............................text....,.......0.................. ..`.rdata..%....@... ...@..............@..@.data........`.......`..............@....rsrc....'.......0...p..............@..@.reloc..\...........................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GX-3R.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Feb 17 16:28:20 2022, mtime=Mon Dec 23 06:11:14 2024, atime=Thu Feb 17 16:28:20 2022, length=4640768, window=hide
Category:	dropped
Size (bytes):	1993
Entropy (8bit):	3.8653777339761946
Encrypted:	false
SSDEEP:	48:8oj/t+dOHNv6CiddeY5OcL42ESemyvWOcL42Q/:8ojSh/5O4NcPWO4NQ
MD5:	8290AD17BDC337FAFB2F8E0C6B2B82CE
SHA1:	32AD40FFCD8C6772CCDD20294A586CA731034BE5
SHA-256:	383A50553C7FFE4C9E147CED21B23485E169C3083C38B782835609F08AC57A1F
SHA-512:	EA5382C35BA0CD1FDD4B88206A7EFCF966E331B28F2C41E309351CD1CD6492100798F567B0325F040753BA5F3397F5356F53913D0D249AE65E76439189ADEE43
Malicious:	false
Preview:	L..................F.@.. ......#$......U.....#$....F.....................q....P.O. .:i.....+00.../C:\.....................1......Yh9..PROGRA~2.........O.I.Yh9....................V.....0Q..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1......Yh9..GX-3R.<......Yh9.Yh9...........................y..G.X.-.3.R.....Z.2...F.QT.. .GX3R.exe..B......QT...Yh9..............................G.X.3.R...e.x.e.......T...............-.......S............<_......C:\Program Files (x86)\GX-3R\GX3R.exe..1.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.X.-.3.R.\.G.X.3.R...e.x.e.%.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.G.X.-.3.R.\.m.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.1.F.F.E.8.F.B.4.-.E.8.4.F.-.4.4.6.0.-.8.7.5.0.-.7.9.8.6.F.4.2.9.A.3.4.2.}.\.N.e.w.S.h.o.r.t.c.u.t.1._.0.B.E.5.A.0.A.4.C.6.5.4.4.0.4.5.B.9.A.8.B.B.1.F.5.7.F.0.A.F.D.3...e.x.e.........%SystemRoot%\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\New

C:\Users\Public\Desktop\GX-3R.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Feb 17 16:28:20 2022, mtime=Mon Dec 23 06:11:16 2024, atime=Thu Feb 17 16:28:20 2022, length=4640768, window=hide
Category:	dropped
Size (bytes):	1983
Entropy (8bit):	3.865223847847113
Encrypted:	false
SSDEEP:	48:8om/t+dOHJ6Cik0dezP5OcESemmdjWOcw/:8omGhkd5OVrjWOt
MD5:	98CAE6BB6244813644C1A7F066C1BE88
SHA1:	E710830D9790B2B041D82AC05501E8A581EF2A70
SHA-256:	19C16CA202D76AE6E7B3155C2FBF37FA291D7C2E58D6962E1DDBD1BB74EAA800
SHA-512:	B1BD8A95977D06F2876349FC6A889D75EC480A0B5029A1949936F1C77642170798098643DABA921A2650987628D58ADBD3E232C18A168856D8C076FDF30187B8
Malicious:	false
Preview:	L..................F.@.. ......#$..dQ...U.....#$....F.....................q....P.O. .:i.....+00.../C:\.....................1......Yh9..PROGRA~2.........O.I.Yh9....................V.....0Q..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1......Yh9..GX-3R.<......Yh9.Yi9..............................G.X.-.3.R.....Z.2...F.QT.. .GX3R.exe..B......QT...Yh9..............................G.X.3.R...e.x.e.......T...............-.......S............<_......C:\Program Files (x86)\GX-3R\GX3R.exe..+.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.X.-.3.R.\.G.X.3.R...e.x.e.%.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.G.X.-.3.R.\.n.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.1.F.F.E.8.F.B.4.-.E.8.4.F.-.4.4.6.0.-.8.7.5.0.-.7.9.8.6.F.4.2.9.A.3.4.2.}.\.N.e.w.S.h.o.r.t.c.u.t.1.1._.2.4.F.C.0.B.0.B.1.8.6.C.4.1.C.7.8.A.4.A.8.C.3.D.8.2.1.B.7.8.7.F...e.x.e.........%SystemRoot%\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut11

C:\Users\user\AppData\Local\Downloaded Installations\{7DED6250-9973-44A8-BFD0-71491CF41AEA}\GX-3R.msi

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Number of Characters: 0, Keywords: Installer,MSI,Database, Last Saved By: InstallShield, Number of Words: 0, Title: GX-3R - Data Logger Management Program, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2011 - Express Edition 17, Last Saved Time/Date: Thu Feb 17 13:51:10 2022, Create Time/Date: Thu Feb 17 13:51:10 2022, Last Printed: Thu Feb 17 13:51:10 2022, Revision Number: {7DED6250-9973-44A8-BFD0-71491CF41AEA}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	31188480
Entropy (8bit):	7.966901954099318
Encrypted:	false
SSDEEP:	786432:rS/x7zHby/JJkDbJOUksn0DaCEE/el6yH03y608WFE:rixuJmDFOUksn02CJfyHw
MD5:	E3D9D67C8EDE4AE70A25E1F222272E71
SHA1:	0D789AC913296C44216E3490611714A5865C6F61
SHA-256:	B887A3DB92767FAC24B9D3CFC2312DD3649EED54295E45E0DE6338F5C837AD90
SHA-512:	1AB141EB0D0C14DD4BDF1D305DB987B8AE501BC28DDB4628B2C57ED271651656FBC23769E056680F11CC9B6C11FBE848EC88ABACEE65EC7FA1A5DBD0ABC4BD93
Malicious:	false
Preview:	......................>...................................8........................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0...1...2...3...Q...............................................................................................................................................................................................................;................................................................... ..............................................."...!......#...$...%...&...'...(...)...,...+...>...-......./...0...1...2...3...4...5...6...7...U...M...:...<.......=.......?...@...A...B...C...D...E...F...G...H...I...J...K...L...N.......O...P...Q...R...S...T...W...V...i...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...k...j.......l...m...n...o...q.......r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\MSI3CCA.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.305988904093114
Encrypted:	false
SSDEEP:	384:Bh8vmTdMRR7HIWGxvKU/UOX71aUS8/0zN3fyOTZ39ug+cAB8oszkgAS90:kvmTdkRTId/VXbStfVZ39uB8osE
MD5:	73F88A86A315CE7E97FF9FBE33C13964
SHA1:	3524C2D1D0D9E48BCDD634FCDADF2E96D185D4C9
SHA-256:	A1104B6ACA5B08D0C1E3B60179BBED417907EDA805967D54F380D527C75ADF8D
SHA-512:	2989561804026FC10BC312BEB403B31C3352585C7E91BB150822D6D1EE09D15B5DD6CF1909E1FFC47CEF2DFED1847967A332DEF90C7D7972ED9F51354BE31104
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xm.X<...<...<...a...=.......(...a...........?...^...?...<.......c...=....,..=...Rich<...................PE..L......:...........!.....@...`......?........P.......................................................................Z..X....V..<....................................................................................P...............................text....?.......@.................. ..`.rdata..8....P.......P..............@..@.data...`1...`...0...`..............@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_is23C4.tmp

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	1315
Entropy (8bit):	7.814305564536485
Encrypted:	false
SSDEEP:	24:lI9cnWN0rtqLSnSEy8Uq4cZTgGVBakyT/7dpqnKvyE43IbBT5Ww8qEl:SqnprcL4dqq4chBN8/Z8nBV3IPWDvl
MD5:	2764F4CCAB685DEF3F11FF99E83E6A8C
SHA1:	0C128327D0C5C08563FE705F059C824FACAF81F9
SHA-256:	008FF64A0148DF69D74F494CCB33A9E5473FD0C0C619E90798FEFC6EDEEE0B46
SHA-512:	D6A1AD329D6D567FAC4B3BC7F3200DC0B30E4E2348BC096D1FF3DD522B10B0B86D4257C63D3488A5DB21F0BDBACA20D5CEEB0E073EE0FC2F3A44872478FEA0C4
Malicious:	false
Preview:	x..X[o.G...V....j.]...`h....&....B0.qS.'=.Y...Ch.V.ja.....s...Z....U..F...W]...R..]u.NI.........y.P...."e....X]..l.i.n..W.~.6#.A-....;Us.G./..I..^Co.....`A.mAg.."/.....-.x.%....x...H.A.An.d.zd....k..........?.u.....q..y.[....}..%....Wh..C._...s....>..R........;..:kk.CP$c".&..{?EK.q......k.-....9.......FD....d....b[..!N.<mTB..,.....:.oYU...(5Ua......_V>.G.EZ...l....h.B...;.c.3oR-.h=..G....H..V.G.m.........e.2.....~[..D..'...l,L......h.]H..y..>I.<.-...\|...-.(N........v.Z.M.......X......17.,.F.mIF.....`..r.U....5^0.../1....=B.j..W...3.....?G>..6.....w.y.j.......rx....9..b_..o..E.N.P...E).K..R...a.z..].2Z.`..ZR6t...E']..V}49/L.i.2..I...'...d...y[...y.%.;..._c...3.J...k..#....~....YW.s...X..&.n/.../<.y...2r.._yA.>k.......:./..V'2.......}u.Ht.7?.......X...FgS...."'.;.M{8.L.g..3..p?./.n.~.w..^.]m...8......K.....X.0c.'M.c.F..}r.<I.</......-...'..w..3g....=......-....&K..F'....B....*...[..N.d.rL...........$.$.....A.cED:.y@\|.......OZ

C:\Users\user\AppData\Local\Temp\_is23E4.tmp

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	4612
Entropy (8bit):	7.94996854456441
Encrypted:	false
SSDEEP:	96:cdCDrDd+ce3/8EfZf13GspoXiXP9p2jsc+r8YHNye+Dqb5f7:quVY9t1JoXiXP9Mhbre+DqbV
MD5:	A780B0F3854B6BDD2023CA312BEE05FB
SHA1:	E2839B2872128367A1358A164D3C168303C13619
SHA-256:	C79B1C4C5DC0B058814149F070B8F9EAE97753385A8586860E7860ADE5DD036F
SHA-512:	BCA565855280C0C10092509700DB3F60517BDE5BED79DDE638353EB41EC7588BA065DF569FA8DEF1B074A6C3729B57CC884B0FAF4A108D7E397F25F43F520B2D
Malicious:	false
Preview:	x...ko..q?... P....H..#...q....rl.A?P.I"L...iU..mw.3.:R...E .nogg.=.....6_....C.;6.4.6.2......96...Y..yj.fn....Y.......V.y.\|cj.......B.e....O........j.lm......g.sn.u..k.........>.-.........yeq....>....i.O...sa.n..86.O...O:...Be.m`....h.U{..==..S..c...V.....b..+X...7DA.w....>..v...C<q.'@.......g.v...@...8..8!.......;v_+K.5@v...D..n.;$.(.5.V....`5......C....'.V.r..yd,......3.{...$e.......;.D.._....g....p;..V.,...Q..=..s..kj>=..-....o.......N.."...\...I.K.p.. ..o...I..'..~W..$.u.....O.x....R...%...g....].}y.x...Ux.1^...Q.%.3....[..J.....M....y..XX.e.QG%\....m.....d.3..c...y.S............l.z.G..k..]9....."..vt..-.3b+..S..IZ.c/4....<SO.@...)H..8....~c)....w.%.&.s.....p.....Q....H...!7...=....D.P......3...^..&.-A.=.<c.D~.vOK.GP.+..('...-5:.g..%.....,..V":..]KW........tp...MC.b..fl...)YO.1......1.U@..x.........r.{.l....-+.R..f...uX.y........W.`.&...a.>.;.T.^{.#.O..5.+..h=..%...;\e..............T.x......s......L.G......U@....Q...,

C:\Users\user\AppData\Local\Temp\_is2444.tmp

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	1315
Entropy (8bit):	7.814305564536485
Encrypted:	false
SSDEEP:	24:lI9cnWN0rtqLSnSEy8Uq4cZTgGVBakyT/7dpqnKvyE43IbBT5Ww8qEl:SqnprcL4dqq4chBN8/Z8nBV3IPWDvl
MD5:	2764F4CCAB685DEF3F11FF99E83E6A8C
SHA1:	0C128327D0C5C08563FE705F059C824FACAF81F9
SHA-256:	008FF64A0148DF69D74F494CCB33A9E5473FD0C0C619E90798FEFC6EDEEE0B46
SHA-512:	D6A1AD329D6D567FAC4B3BC7F3200DC0B30E4E2348BC096D1FF3DD522B10B0B86D4257C63D3488A5DB21F0BDBACA20D5CEEB0E073EE0FC2F3A44872478FEA0C4
Malicious:	false
Preview:	x..X[o.G...V....j.]...`h....&....B0.qS.'=.Y...Ch.V.ja.....s...Z....U..F...W]...R..]u.NI.........y.P...."e....X]..l.i.n..W.~.6#.A-....;Us.G./..I..^Co.....`A.mAg.."/.....-.x.%....x...H.A.An.d.zd....k..........?.u.....q..y.[....}..%....Wh..C._...s....>..R........;..:kk.CP$c".&..{?EK.q......k.-....9.......FD....d....b[..!N.<mTB..,.....:.oYU...(5Ua......_V>.G.EZ...l....h.B...;.c.3oR-.h=..G....H..V.G.m.........e.2.....~[..D..'...l,L......h.]H..y..>I.<.-...\|...-.(N........v.Z.M.......X......17.,.F.mIF.....`..r.U....5^0.../1....=B.j..W...3.....?G>..6.....w.y.j.......rx....9..b_..o..E.N.P...E).K..R...a.z..].2Z.`..ZR6t...E']..V}49/L.i.2..I...'...d...y[...y.%.;..._c...3.J...k..#....~....YW.s...X..&.n/.../<.y...2r.._yA.>k.......:./..V'2.......}u.Ht.7?.......X...FgS...."'.;.M{8.L.g..3..p?./.n.~.w..^.]m...8......K.....X.0c.'M.c.F..}r.<I.</......-...'..w..3g....=......-....&K..F'....B....*...[..N.d.rL...........$.$.....A.cED:.y@\|.......OZ

C:\Users\user\AppData\Local\Temp\_is2455.tmp

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	1315
Entropy (8bit):	7.814305564536485
Encrypted:	false
SSDEEP:	24:lI9cnWN0rtqLSnSEy8Uq4cZTgGVBakyT/7dpqnKvyE43IbBT5Ww8qEl:SqnprcL4dqq4chBN8/Z8nBV3IPWDvl
MD5:	2764F4CCAB685DEF3F11FF99E83E6A8C
SHA1:	0C128327D0C5C08563FE705F059C824FACAF81F9
SHA-256:	008FF64A0148DF69D74F494CCB33A9E5473FD0C0C619E90798FEFC6EDEEE0B46
SHA-512:	D6A1AD329D6D567FAC4B3BC7F3200DC0B30E4E2348BC096D1FF3DD522B10B0B86D4257C63D3488A5DB21F0BDBACA20D5CEEB0E073EE0FC2F3A44872478FEA0C4
Malicious:	false
Preview:	x..X[o.G...V....j.]...`h....&....B0.qS.'=.Y...Ch.V.ja.....s...Z....U..F...W]...R..]u.NI.........y.P...."e....X]..l.i.n..W.~.6#.A-....;Us.G./..I..^Co.....`A.mAg.."/.....-.x.%....x...H.A.An.d.zd....k..........?.u.....q..y.[....}..%....Wh..C._...s....>..R........;..:kk.CP$c".&..{?EK.q......k.-....9.......FD....d....b[..!N.<mTB..,.....:.oYU...(5Ua......_V>.G.EZ...l....h.B...;.c.3oR-.h=..G....H..V.G.m.........e.2.....~[..D..'...l,L......h.]H..y..>I.<.-...\|...-.(N........v.Z.M.......X......17.,.F.mIF.....`..r.U....5^0.../1....=B.j..W...3.....?G>..6.....w.y.j.......rx....9..b_..o..E.N.P...E).K..R...a.z..].2Z.`..ZR6t...E']..V}49/L.i.2..I...'...d...y[...y.%.;..._c...3.J...k..#....~....YW.s...X..&.n/.../<.y...2r.._yA.>k.......:./..V'2.......}u.Ht.7?.......X...FgS...."'.;.M{8.L.g..3..p?./.n.~.w..^.]m...8......K.....X.0c.'M.c.F..}r.<I.</......-...'..w..3g....=......-....&K..F'....B....*...[..N.d.rL...........$.$.....A.cED:.y@\|.......OZ

C:\Users\user\AppData\Local\Temp\_is26D7.tmp

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	30046006
Entropy (8bit):	7.999562722665149
Encrypted:	true
SSDEEP:	786432:udI2cW1Jr3Rssgf6cvgJrhL8FIWnN6pu2/+ef+V0PNFg4c:uy7WZgCSgJrN8ZnN0V+exIv
MD5:	D3EF3FE3E8A1F13B1A0E8134C9C8FA39
SHA1:	2883200054EEA993AB3DD49D6AA0DE6A1E67632F
SHA-256:	4BE8F27DBCDDB5F65F0D2F33706A3A6FA6A314316BD69F91EDB0328CD97ED01A
SHA-512:	432800A80614932B3CCEA5F6A574C7E0D4E1644CFC37C25E981F5C26F2DCDB43407672524E3D17C032EB0569CAA6ED11EA32704E70D14D8CF89A89A8BA98FDF1
Malicious:	false
Preview:	x...`..8>r......H.%B.....G......_X..@@..8V"KFG.B.....M.-....n.]v{_.#...K[J.-..t.mz..P.....F.,.........y.}.{.{.....o...}......jn....R.W.....t.C..y.f...s..^....._.^.x.../.L......`.............,.0.4.4.4.4.....p..y...V...p..J......B.....0.\....r...W.....`-.:.........X.6.X.l.v...u.....(.?.<../....1...\|.......4.g.>..9...\|.......%./.\|..$.......x.....<..5..........\|......x....O.\|......>...~....?.....t.....n,O,.z.#.R...&...F.&.f...9.z.....+.....`%.k.^.p!.E......R.U...\.p9.j.+...\...`.@+.z.P&...l.........'.......................`+@. .........m.......\.......Op\..{.........l...H.....p=.....n... .p3@.`. .......v........f.4.(@. .p..q..@...P........A.[.....p..v.qV.}.S.B.!....H.... ...y~....?I?G.~o..p........J.. ..Q.....T..E9....%..Z.....RC3.xK.uom...L.7.g......[.Z@.!.i.....u...u[...A.<p..0....zN...\|....0o.:.q..j..g........=W.".a...s............._s./.......z......\.../.:##.5A..WB...GY".........G............\|.`..M.'..........x+.....x;.;......w...................>.p?.?..=.....

C:\Users\user\AppData\Local\Temp\_is3919.tmp

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	1315
Entropy (8bit):	7.814305564536485
Encrypted:	false
SSDEEP:	24:lI9cnWN0rtqLSnSEy8Uq4cZTgGVBakyT/7dpqnKvyE43IbBT5Ww8qEl:SqnprcL4dqq4chBN8/Z8nBV3IPWDvl
MD5:	2764F4CCAB685DEF3F11FF99E83E6A8C
SHA1:	0C128327D0C5C08563FE705F059C824FACAF81F9
SHA-256:	008FF64A0148DF69D74F494CCB33A9E5473FD0C0C619E90798FEFC6EDEEE0B46
SHA-512:	D6A1AD329D6D567FAC4B3BC7F3200DC0B30E4E2348BC096D1FF3DD522B10B0B86D4257C63D3488A5DB21F0BDBACA20D5CEEB0E073EE0FC2F3A44872478FEA0C4
Malicious:	false
Preview:	x..X[o.G...V....j.]...`h....&....B0.qS.'=.Y...Ch.V.ja.....s...Z....U..F...W]...R..]u.NI.........y.P...."e....X]..l.i.n..W.~.6#.A-....;Us.G./..I..^Co.....`A.mAg.."/.....-.x.%....x...H.A.An.d.zd....k..........?.u.....q..y.[....}..%....Wh..C._...s....>..R........;..:kk.CP$c".&..{?EK.q......k.-....9.......FD....d....b[..!N.<mTB..,.....:.oYU...(5Ua......_V>.G.EZ...l....h.B...;.c.3oR-.h=..G....H..V.G.m.........e.2.....~[..D..'...l,L......h.]H..y..>I.<.-...\|...-.(N........v.Z.M.......X......17.,.F.mIF.....`..r.U....5^0.../1....=B.j..W...3.....?G>..6.....w.y.j.......rx....9..b_..o..E.N.P...E).K..R...a.z..].2Z.`..ZR6t...E']..V}49/L.i.2..I...'...d...y[...y.%.;..._c...3.J...k..#....~....YW.s...X..&.n/.../<.y...2r.._yA.>k.......:./..V'2.......}u.Ht.7?.......X...FgS...."'.;.M{8.L.g..3..p?./.n.~.w..^.]m...8......K.....X.0c.'M.c.F..}r.<I.</......-...'..w..3g....=......-....&K..F'....B....*...[..N.d.rL...........$.$.....A.cED:.y@\|.......OZ

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\0x0409.ini

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	22492
Entropy (8bit):	3.484893836872466
Encrypted:	false
SSDEEP:	384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
MD5:	BE345D0260AE12C5F2F337B17E07C217
SHA1:	0976BA0982FE34F1C35A0974F6178E15C238ED7B
SHA-256:	E994689A13B9448C074F9B471EDEEC9B524890A0D82925E98AB90B658016D8F3
SHA-512:	77040DBEE29BE6B136A83B9E444D8B4F71FF739F7157E451778FB4FCCB939A67FF881A70483DE16BCB6AE1FEA64A89E00711A33EC26F4D3EEA8E16C9E9553EFF
Malicious:	false
Preview:	..[.0.x.0.4.0.9.].....1.1.0.0.=.S.e.t.u.p. .I.n.i.t.i.a.l.i.z.a.t.i.o.n. .E.r.r.o.r.....1.1.0.1.=.%.s.....1.1.0.2.=.%.1. .S.e.t.u.p. .i.s. .p.r.e.p.a.r.i.n.g. .t.h.e. .%.2.,. .w.h.i.c.h. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .p.r.o.g.r.a.m. .s.e.t.u.p. .p.r.o.c.e.s.s... . .P.l.e.a.s.e. .w.a.i.t.......1.1.0.3.=.C.h.e.c.k.i.n.g. .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m. .V.e.r.s.i.o.n.....1.1.0.4.=.C.h.e.c.k.i.n.g. .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .V.e.r.s.i.o.n.....1.1.0.5.=.C.o.n.f.i.g.u.r.i.n.g. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.C.o.n.f.i.g.u.r.i.n.g. .%.s.....1.1.0.7.=.S.e.t.u.p. .h.a.s. .c.o.m.p.l.e.t.e.d. .c.o.n.f.i.g.u.r.i.n.g. .t.h.e. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .o.n. .y.o.u.r. .s.y.s.t.e.m... .T.h.e. .s.y.s.t.e.m. .n.e.e.d.s. .t.o. .b.e. .r.e.s.t.a.r.t.e.d. .i.n. .o.r.d.e.r. .t.o. .c.o.n.t.i.n.u.e. .w.i.t.h. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n... .P.l.e.a.s.e. .c.l.i.c.k. .R.e.s.t.a.r.t. .t.o. .r.e.b.o.o.t. .t.h.e. .s.y.s.t.e.m.......1.1.0.8.

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\GX-3R.msi

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Number of Characters: 0, Keywords: Installer,MSI,Database, Last Saved By: InstallShield, Number of Words: 0, Title: GX-3R - Data Logger Management Program, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2011 - Express Edition 17, Last Saved Time/Date: Thu Feb 17 13:51:10 2022, Create Time/Date: Thu Feb 17 13:51:10 2022, Last Printed: Thu Feb 17 13:51:10 2022, Revision Number: {7DED6250-9973-44A8-BFD0-71491CF41AEA}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	31188480
Entropy (8bit):	7.966901954099318
Encrypted:	false
SSDEEP:	786432:rS/x7zHby/JJkDbJOUksn0DaCEE/el6yH03y608WFE:rixuJmDFOUksn02CJfyHw
MD5:	E3D9D67C8EDE4AE70A25E1F222272E71
SHA1:	0D789AC913296C44216E3490611714A5865C6F61
SHA-256:	B887A3DB92767FAC24B9D3CFC2312DD3649EED54295E45E0DE6338F5C837AD90
SHA-512:	1AB141EB0D0C14DD4BDF1D305DB987B8AE501BC28DDB4628B2C57ED271651656FBC23769E056680F11CC9B6C11FBE848EC88ABACEE65EC7FA1A5DBD0ABC4BD93
Malicious:	false
Preview:	......................>...................................8........................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0...1...2...3...Q...............................................................................................................................................................................................................;................................................................... ..............................................."...!......#...$...%...&...'...(...)...,...+...>...-......./...0...1...2...3...4...5...6...7...U...M...:...<.......=.......?...@...A...B...C...D...E...F...G...H...I...J...K...L...N.......O...P...Q...R...S...T...W...V...i...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...k...j.......l...m...n...o...q.......r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5110
Entropy (8bit):	3.711880596824799
Encrypted:	false
SSDEEP:	96:rEhkMaE6DZUOHq/ON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlnW:YhcrfHncuQaEZhdxoIWRGcQbPr/p005s
MD5:	BB4BFF378A6AC3A127849BAF081AA08E
SHA1:	D6B3E0F407E66A1FF163889E97956E4E492C1E32
SHA-256:	17923B330AABB043F806F8BD7A98ED9E4FEF4A5EC95BF2E54D664FE0F854C55F
SHA-512:	A36EF86D3E6D5741925F0BAA566754A3FFE949F09576C6C8E649360F2712CF2036B21117E432EAEA20B5ADB99BD7780F33CBBC554ACED40EA6A7804695C3E8AB
Malicious:	false
Preview:	..[.I.n.f.o.].....N.a.m.e.=.I.N.T.L.....V.e.r.s.i.o.n.=.1...0.0...0.0.0.....D.i.s.k.S.p.a.c.e.=.8.0.0.0...;.D.i.s.k.S.p.a.c.e. .r.e.q.u.i.r.e.m.e.n.t. .i.n. .K.B.........[.S.t.a.r.t.u.p.].....C.m.d.L.i.n.e.=.....S.u.p.p.r.e.s.s.W.r.o.n.g.O.S.=.Y.....S.c.r.i.p.t.D.r.i.v.e.n.=.0.....S.c.r.i.p.t.V.e.r.=.1...0...0...1.....D.o.t.N.e.t.O.p.t.i.o.n.a.l.I.n.s.t.a.l.l.I.f.S.i.l.e.n.t.=.N.....O.n.U.p.g.r.a.d.e.=.0.....P.r.o.d.u.c.t.=.G.X.-.3.R.....P.a.c.k.a.g.e.N.a.m.e.=.G.X.-.3.R...m.s.i.....E.n.a.b.l.e.L.a.n.g.D.l.g.=.Y.....L.o.g.R.e.s.u.l.t.s.=.N.....D.o.M.a.i.n.t.e.n.a.n.c.e.=.N.....P.r.o.d.u.c.t.C.o.d.e.=.{.1.F.F.E.8.F.B.4.-.E.8.4.F.-.4.4.6.0.-.8.7.5.0.-.7.9.8.6.F.4.2.9.A.3.4.2.}.....P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.1...0.0...0.0.5.6.....L.a.u.n.c.h.e.r.N.a.m.e.=.s.e.t.u.p...e.x.e.....P.a.c.k.a.g.e.C.o.d.e.=.{.7.D.E.D.6.2.5.0.-.9.9.7.3.-.4.4.A.8.-.B.F.D.0.-.7.1.4.9.1.C.F.4.1.A.E.A.}.........[.L.a.n.g.u.a.g.e.s.].....R.e.q.u.i.r.e.E.x.a.c.t.L.a.n.g.M.a.t.c.h.=.0.x.0.4.0.4.,.0.x.0.8.0.4.....R.T.

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\_ISMSIDEL.INI

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	2.8954618442383215
Encrypted:	false
SSDEEP:	3:Q+5lkrJ4l49:Q+s2l49
MD5:	DB9AF7503F195DF96593AC42D5519075
SHA1:	1B487531BAD10F77750B8A50ACA48593379E5F56
SHA-256:	0A33C5DFFABCF31A1F6802026E9E2EEF4B285E57FD79D52FDCD98D6502D14B13
SHA-512:	6839264E14576FE190260A4B82AFC11C88E50593A20113483851BF4ABFDB7CCA9986BEF83F4C6B8F98EF4D426F07024CF869E8AB393DF6D2B743B9B8E2544E1B
Malicious:	false
Preview:	..[.F.i.l.e.s.].....

C:\Users\user\AppData\Local\Temp\~2443.tmp

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5110
Entropy (8bit):	3.711880596824799
Encrypted:	false
SSDEEP:	96:rEhkMaE6DZUOHq/ON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlnW:YhcrfHncuQaEZhdxoIWRGcQbPr/p005s
MD5:	BB4BFF378A6AC3A127849BAF081AA08E
SHA1:	D6B3E0F407E66A1FF163889E97956E4E492C1E32
SHA-256:	17923B330AABB043F806F8BD7A98ED9E4FEF4A5EC95BF2E54D664FE0F854C55F
SHA-512:	A36EF86D3E6D5741925F0BAA566754A3FFE949F09576C6C8E649360F2712CF2036B21117E432EAEA20B5ADB99BD7780F33CBBC554ACED40EA6A7804695C3E8AB
Malicious:	false
Preview:	..[.I.n.f.o.].....N.a.m.e.=.I.N.T.L.....V.e.r.s.i.o.n.=.1...0.0...0.0.0.....D.i.s.k.S.p.a.c.e.=.8.0.0.0...;.D.i.s.k.S.p.a.c.e. .r.e.q.u.i.r.e.m.e.n.t. .i.n. .K.B.........[.S.t.a.r.t.u.p.].....C.m.d.L.i.n.e.=.....S.u.p.p.r.e.s.s.W.r.o.n.g.O.S.=.Y.....S.c.r.i.p.t.D.r.i.v.e.n.=.0.....S.c.r.i.p.t.V.e.r.=.1...0...0...1.....D.o.t.N.e.t.O.p.t.i.o.n.a.l.I.n.s.t.a.l.l.I.f.S.i.l.e.n.t.=.N.....O.n.U.p.g.r.a.d.e.=.0.....P.r.o.d.u.c.t.=.G.X.-.3.R.....P.a.c.k.a.g.e.N.a.m.e.=.G.X.-.3.R...m.s.i.....E.n.a.b.l.e.L.a.n.g.D.l.g.=.Y.....L.o.g.R.e.s.u.l.t.s.=.N.....D.o.M.a.i.n.t.e.n.a.n.c.e.=.N.....P.r.o.d.u.c.t.C.o.d.e.=.{.1.F.F.E.8.F.B.4.-.E.8.4.F.-.4.4.6.0.-.8.7.5.0.-.7.9.8.6.F.4.2.9.A.3.4.2.}.....P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.1...0.0...0.0.5.6.....L.a.u.n.c.h.e.r.N.a.m.e.=.s.e.t.u.p...e.x.e.....P.a.c.k.a.g.e.C.o.d.e.=.{.7.D.E.D.6.2.5.0.-.9.9.7.3.-.4.4.A.8.-.B.F.D.0.-.7.1.4.9.1.C.F.4.1.A.E.A.}.........[.L.a.n.g.u.a.g.e.s.].....R.e.q.u.i.r.e.E.x.a.c.t.L.a.n.g.M.a.t.c.h.=.0.x.0.4.0.4.,.0.x.0.8.0.4.....R.T.

C:\Users\user\AppData\Local\Temp\~2454.tmp

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5110
Entropy (8bit):	3.711880596824799
Encrypted:	false
SSDEEP:	96:rEhkMaE6DZUOHq/ON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlnW:YhcrfHncuQaEZhdxoIWRGcQbPr/p005s
MD5:	BB4BFF378A6AC3A127849BAF081AA08E
SHA1:	D6B3E0F407E66A1FF163889E97956E4E492C1E32
SHA-256:	17923B330AABB043F806F8BD7A98ED9E4FEF4A5EC95BF2E54D664FE0F854C55F
SHA-512:	A36EF86D3E6D5741925F0BAA566754A3FFE949F09576C6C8E649360F2712CF2036B21117E432EAEA20B5ADB99BD7780F33CBBC554ACED40EA6A7804695C3E8AB
Malicious:	false
Preview:	..[.I.n.f.o.].....N.a.m.e.=.I.N.T.L.....V.e.r.s.i.o.n.=.1...0.0...0.0.0.....D.i.s.k.S.p.a.c.e.=.8.0.0.0...;.D.i.s.k.S.p.a.c.e. .r.e.q.u.i.r.e.m.e.n.t. .i.n. .K.B.........[.S.t.a.r.t.u.p.].....C.m.d.L.i.n.e.=.....S.u.p.p.r.e.s.s.W.r.o.n.g.O.S.=.Y.....S.c.r.i.p.t.D.r.i.v.e.n.=.0.....S.c.r.i.p.t.V.e.r.=.1...0...0...1.....D.o.t.N.e.t.O.p.t.i.o.n.a.l.I.n.s.t.a.l.l.I.f.S.i.l.e.n.t.=.N.....O.n.U.p.g.r.a.d.e.=.0.....P.r.o.d.u.c.t.=.G.X.-.3.R.....P.a.c.k.a.g.e.N.a.m.e.=.G.X.-.3.R...m.s.i.....E.n.a.b.l.e.L.a.n.g.D.l.g.=.Y.....L.o.g.R.e.s.u.l.t.s.=.N.....D.o.M.a.i.n.t.e.n.a.n.c.e.=.N.....P.r.o.d.u.c.t.C.o.d.e.=.{.1.F.F.E.8.F.B.4.-.E.8.4.F.-.4.4.6.0.-.8.7.5.0.-.7.9.8.6.F.4.2.9.A.3.4.2.}.....P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.1...0.0...0.0.5.6.....L.a.u.n.c.h.e.r.N.a.m.e.=.s.e.t.u.p...e.x.e.....P.a.c.k.a.g.e.C.o.d.e.=.{.7.D.E.D.6.2.5.0.-.9.9.7.3.-.4.4.A.8.-.B.F.D.0.-.7.1.4.9.1.C.F.4.1.A.E.A.}.........[.L.a.n.g.u.a.g.e.s.].....R.e.q.u.i.r.e.E.x.a.c.t.L.a.n.g.M.a.t.c.h.=.0.x.0.4.0.4.,.0.x.0.8.0.4.....R.T.

C:\Users\user\AppData\Local\Temp\~3918.tmp

Download File

Process:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5110
Entropy (8bit):	3.711880596824799
Encrypted:	false
SSDEEP:	96:rEhkMaE6DZUOHq/ON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlnW:YhcrfHncuQaEZhdxoIWRGcQbPr/p005s
MD5:	BB4BFF378A6AC3A127849BAF081AA08E
SHA1:	D6B3E0F407E66A1FF163889E97956E4E492C1E32
SHA-256:	17923B330AABB043F806F8BD7A98ED9E4FEF4A5EC95BF2E54D664FE0F854C55F
SHA-512:	A36EF86D3E6D5741925F0BAA566754A3FFE949F09576C6C8E649360F2712CF2036B21117E432EAEA20B5ADB99BD7780F33CBBC554ACED40EA6A7804695C3E8AB
Malicious:	false
Preview:	..[.I.n.f.o.].....N.a.m.e.=.I.N.T.L.....V.e.r.s.i.o.n.=.1...0.0...0.0.0.....D.i.s.k.S.p.a.c.e.=.8.0.0.0...;.D.i.s.k.S.p.a.c.e. .r.e.q.u.i.r.e.m.e.n.t. .i.n. .K.B.........[.S.t.a.r.t.u.p.].....C.m.d.L.i.n.e.=.....S.u.p.p.r.e.s.s.W.r.o.n.g.O.S.=.Y.....S.c.r.i.p.t.D.r.i.v.e.n.=.0.....S.c.r.i.p.t.V.e.r.=.1...0...0...1.....D.o.t.N.e.t.O.p.t.i.o.n.a.l.I.n.s.t.a.l.l.I.f.S.i.l.e.n.t.=.N.....O.n.U.p.g.r.a.d.e.=.0.....P.r.o.d.u.c.t.=.G.X.-.3.R.....P.a.c.k.a.g.e.N.a.m.e.=.G.X.-.3.R...m.s.i.....E.n.a.b.l.e.L.a.n.g.D.l.g.=.Y.....L.o.g.R.e.s.u.l.t.s.=.N.....D.o.M.a.i.n.t.e.n.a.n.c.e.=.N.....P.r.o.d.u.c.t.C.o.d.e.=.{.1.F.F.E.8.F.B.4.-.E.8.4.F.-.4.4.6.0.-.8.7.5.0.-.7.9.8.6.F.4.2.9.A.3.4.2.}.....P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.1...0.0...0.0.5.6.....L.a.u.n.c.h.e.r.N.a.m.e.=.s.e.t.u.p...e.x.e.....P.a.c.k.a.g.e.C.o.d.e.=.{.7.D.E.D.6.2.5.0.-.9.9.7.3.-.4.4.A.8.-.B.F.D.0.-.7.1.4.9.1.C.F.4.1.A.E.A.}.........[.L.a.n.g.u.a.g.e.s.].....R.e.q.u.i.r.e.E.x.a.c.t.L.a.n.g.M.a.t.c.h.=.0.x.0.4.0.4.,.0.x.0.8.0.4.....R.T.

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F1122_Expsrv.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	378128
Entropy (8bit):	6.495335754600502
Encrypted:	false
SSDEEP:	6144:JWcDK/CsCMaub04303M+5Ux4HKNmD/eBGvd5ImivnX4kcxagSo:JHDKasCO04303X5U2Kc4TX8xKo
MD5:	0AEFF5B93A1C4F0D4CE170F5A5A1F6F7
SHA1:	1595A01F6E53606513C85687F68BF95DD6B24D6B
SHA-256:	A42B1C58665FF3958D1C34A27EB0B9A1CADE1593FAA340103EA66402F83A5181
SHA-512:	8EF95E8B5F904743B83C0DEBE71C93C2C7C3DD9C010187EBB6745F3488D0912676A5F5A0F85423AF4D8A7C2E727A1C131460CFD80B174DBB4D312D6533D4208D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e..e..e.H.k...e..e..e...c..e.E.v..e.Rich.e.........................PE..L...F8.5...........#.................g....... ............................... ......U9...............................c...N...S..x.... ...........................7...#............................................... ...............................text....1.......2.................. ..`ENGINE.......P.......6.............. ..`.rdata....... ......................@..@.data....].......@..................@....rsrc........ ......................@..@.reloc...@.......B..................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F248_vbajet32.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	4.704791262972123
Encrypted:	false
SSDEEP:	384:iACSIfnFd4JnB2fo9T0PsDLns6I/sojFoe+3bYGVwW8h7sQBrFgd8WI3ZWRa0W:TCSMFd4mKnDLs10ojybYldFgGWW
MD5:	9456A88DA7AF49E615D4E4B2662C7128
SHA1:	D3990C9FCA369E609FB9894EA781D264A3D88BD5
SHA-256:	36F8402F6049B29F56F3E3783F6599EAEF2F1FE2723B66209E91584B4C749195
SHA-512:	14C38563DF069877E10427908E837707577DC9E1B13DB91344F4D3A09A2A4FE6D97301D8FB17ADB47C523C36099F178655D62717304BD242659DA73F1C884DA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................................E......Rich...........PE..L...v8.5...........#.....@...J...............P.......................................................................M..f....I..(....................................................................................................................text...V>.......@.................. ..`.data...x=...P...(...D..............@....rsrc................l..............@..@.reloc..L............r..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F479_Dao360.dll.5B60FF9E_851D_11D4_A752_00B0D0428C0C

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	557328
Entropy (8bit):	6.2892220673962855
Encrypted:	false
SSDEEP:	6144:Iho/2JuarZmXHSrRz4dHOVTiuKRk2VbUnzPMvo2jwdIh61yvYbesZj+yLr1QrbVm:KtrSk5+OVV4jjwW+VXGjN
MD5:	433A3A9541636E23147A481EFDF96574
SHA1:	3957698E4783741DC97501BBBA6A28BD742E794D
SHA-256:	A68654116CAF337409486EC0BD894AAAFE5EDB229B2BA6E3D12DEC6F665FA058
SHA-512:	734549D98EEB8D8ED4A8FD1E31969969BB43681587AFD4E94386A90A4BE290D3B906AF8C4F59CE6E07E21F3FF874484A100ED194448868B83F970837DA6F27DD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................+.........a...K......Rich...................PE..L....M.8...........#.....p..........?.............s..........................p......c............................... ................@..0.................... ...O...................................................................................text....l.......p... .............. ..`.rdata.............................@..@.data...T!.......0... ..............@....rsrc...0....@.......P..............@..@.reloc...O... ...P...0..............@..B'..7@....A9K....A9X....A9b....A9m....He9z...Yw.9............MSVCRT.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.ADVAPI32.dll.ole32.dll.OLEAUT32.dll................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22288
Entropy (8bit):	4.814478820147639
Encrypted:	false
SSDEEP:	384:23Fob3slaN3oF1fHICOoMzMv/QTIBjDVquODJXsUW7ftWs6:Yo7s28JnOxzMv/QsBjRqugXspd
MD5:	3B180DA2B50B954A55FE37AFBA58D428
SHA1:	C2A409311853AD4608418E790621F04155E55000
SHA-256:	96D04CDFAF4F4D7B8722B139A15074975D4C244302F78034B7BE65DF1A92FD03
SHA-512:	CF94AD749D91169078B8829288A2FC8DE86EC2FE83D89DC27D54D03C73C0DECA66B5D83ABBEAA1FF09D0ACAC4C4352BE6502945B5187ECDE952CBB08037D07E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...rD.2....i......#.....2...................P.....w.................................................................?......*<..d....`.......................p..4...............................................X....................................text...#0.......2.......... V...... ..`.data........P.......B..............@....rsrc........`.......N..............@..@.reloc.......p.......R..............@..BkD.2(.....22...jD.2?....%.2J...........ole32.dll.KERNEL32.dll.USER32.dll.ADVAPI32.dll..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	147728
Entropy (8bit):	5.909287934496192
Encrypted:	false
SSDEEP:	3072:h+qD1Cd/Oa5kXFlqkFGr3CAP7LCyInPEggen5Ez:hlCd/OaaFEjCAPKyOE6na
MD5:	C89E401800DE62E5702E085D898EED20
SHA1:	72FB4F088C6AC02097B55FB267C76FBF5E0FA1F7
SHA-256:	DE83C9D9203050B40C098E4143EF8F577AA90016C7A64D4F2931B57A4C43E566
SHA-512:	70006D70DCB47361FF43E4F7C458655AD2474B70CB917873AA77D2CC06465A68D375D36C494D154A03DBBFF891DF7DD6CAB3D2C7B08E8650B9FF170E30838070
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ru..ru..ru..mf..ru..ru..su.Rich.ru.........................PE..L....!.6...........#..................... ........<e.........................`... ..^q..................................n.......d....0.......................@..0...P!............................................... ..L............................text...n.... ....... .............. ..`.data....d.......P..................@....rsrc........0......................@..@.reloc..v....@... ... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	598288
Entropy (8bit):	6.644743270512807
Encrypted:	false
SSDEEP:	12288:HCKynQWKglDhrUtrvT/NInIk4NDXsR6lMlpGz:HGXqB8V6lMlMz
MD5:	7B156D230278B8C914EF3F4169FEC1CC
SHA1:	6B58E20B2538CB308091DA838710F6AAD933A301
SHA-256:	BAEB2F7C1B8BE56738D34E1D1DDF8E0EEBD3A633215DC1575E14656BE38B939D
SHA-512:	E4EC2BC714069E0A6B56D89B52AABAD92E5BA741DC6F26D2FC2D72AA9AD2EC465DEA523CCCD810331AB78B5FB8A1244B2B521303418EAD5BD6BE5A58B43794C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ibW.-.9.-.9.-.9...7.(.9.{.*.,.9.-.9...9.Rich-.9.................PE..L....#.6...........#..... ...................p....4e......................... ......+................................6..%$.......................................g...................................................................................text............ ... .............. ..`.data....a...0...`...@..............@....rsrc...............................@..@.reloc...g.......p..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	164112
Entropy (8bit):	5.8462943829831575
Encrypted:	false
SSDEEP:	3072:+VrhrwLXcA2Ha/joWklbo/Acjwm4AaW7zozn/zgOh0Z76:fklbsqmyWnoz/P
MD5:	CE0155405EA902797E88B92A78443AEB
SHA1:	8ADFF69050D14A57D7F553CA8978439AF188C192
SHA-256:	789C3C45EDA1749BD939F4A96616E1E9EF1B7DCC62A2889F65088954C64D0938
SHA-512:	3FDE09067F9CA8D315DE07C8DB972F99723EA4C3F997DC58210F9D6565CAA9935C79F13E8B2D20ADC5609919A381E4C2A90A0B3123A35947997229D7C615E162
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.'r!.I!!.I!!.I!w.Z!*.I!!.I!\.I!Rich!.I!........PE..L....!.6...........#.................)... ........0_............................. ..>................................................0...3...................p...... #............................................... ...............................text...q.... ....... .............. ..`.data....X.......P..................@....rsrc....3...0...@... ..............@..@.reloc.......p... ...`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	4.083884450202126
Encrypted:	false
SSDEEP:	384:cogoEvM/uFrR+X6QNn1pcJIrWocDGWct:cogoEvM0rgqQNn3
MD5:	1B02577F0ADDEA32EB02A50D4A4CDD1E
SHA1:	36F701CCEC78A5D218FEA23FD05351890F14CF7D
SHA-256:	6EA525BFACE5467C1045C3708F339A4B92A3A273F70656E061C7F7322C56D667
SHA-512:	87FD4AA5158D09EB97B6131E651DB2A4761546907A960AF7792F8E95947C0A825E84F88ECCF42EC896FF5BB2BBC461488B898D5F1BD853847317493C44B330C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eU!.!4O.!4O.!4O.!4O. 4O.Rich!4O.................PE..L....!.6...........!.........D...............................................p...........................................................@...................`.......................................................................................rsrc....@.......B..................@..@.reloc.......`.......D..............@..B.............!.6............ .......8........!.6............P........!.6............h........!.6.....................!.6....................@:...........J................T.Y.P.E.L.I.B.MSFT................A...........*................................... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...............h...........................................L...P.......

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_ATLUnicode_f1.7EBEDD68_AA66_11D2_B980_006097C4DE24

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58938
Entropy (8bit):	6.336978867106736
Encrypted:	false
SSDEEP:	1536:RsDMyBE4TgDvwTI747yEsHPJL1s9z6cAXcZB35:qZ7qCIGyE6B1ncz35
MD5:	D16903B9431F799877AD6DF13D16BDA0
SHA1:	FF54286E980693A358E1ED8B0EBE1FA8C0A4C4B1
SHA-256:	BC2B3E03115DE69141505573607D23404659564D8A212845485FEBD86ED9659E
SHA-512:	AA44706E2148D7A2743017EA04E194CEFB5BC1749DDAE6C36BCF029D4104463E09D459A2886D06453F99F2EAF1FB1C2682B985B9284C7D8624FE3B849F8EF141
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.......................q...................#...........................Rich............................PE..L...[K.6...........!.........^......<-............>_......................... ......................................p.......x...(........"......................T...................................................................................text.............................. ..`.rdata... ......."..................@..@.data...............................@....rsrc....".......$..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	278581
Entropy (8bit):	6.371840306551786
Encrypted:	false
SSDEEP:	6144:XTHH7lfsdbunoC5XQFnqxNCDHDJDAiFMWiFaNF7R5LooRKa:XTnJfsdanocQdqaHJDAo5Bia
MD5:	4300D1A092B91E7C8DFA6F1E5E7973B2
SHA1:	63A4FCD64ECEA975C1B91DE04702C68A9F2A3C7D
SHA-256:	887EB5CE93EDB7192CA3E9220F07F9CA0F94DB02AF5862EBCBDFCB852DB99FD1
SHA-512:	DBF54F05AA371D5FF2B73AE1241A777C6BFF65C37D46FA8D10A9C23DA3B3F9D097618A5E246140AA39256BA9270EE3B7A1AB7B442B0A25F51C08BF04535A907D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@@_..._..._...=.=.\..._./.......%.M.....(.^..... .......$.......*.^...Rich_...................PE..L......8...........!.........0......(4.............x.........................@.......(..............................@5..P<.. r..6................................&...q..T...............................................D............................text...>............ .............. ..`.rdata...o.......p... ..............@..@.data...@p.......p..................@....rsrc...............................@..@.reloc...&.......0..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_VC_MFC42ANSICore_f0.51D569E2_8A28_11D2_B962_006097C4DE24

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	995383
Entropy (8bit):	6.358248371031332
Encrypted:	false
SSDEEP:	12288:Tmpjc8agXkUJBdg54X7Vcwcl+ihokY2KuobgJJvrqkTi8Ii8:T0cXg44Je+ih4Vkbl8
MD5:	71AD9EA933ACE083ADD86BBE4F265D8B
SHA1:	094929E01D6FCB22A0194F0B0CE32B7E3C80696B
SHA-256:	EC63A85030C60716ACDCF060ABFAA95A6A3528631622FA60E7D17FBEA2F751F9
SHA-512:	61E3A9AC5393CCF4E2F052F0C8D6D4F1877915B1A9D70CC578244A7D9BC3E0BFD0535630E6CC1FAD03D1D1E366CAB57562CE37885F94B6FDBC15DD2FC34A50F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........eY.I.7.I.7.I.7.I.7...7.+.$.O.7...9.L.7.0%=.O.7.I.6...7.0%<...7...1.H.7.0%3.M.7.RichI.7.........................PE..L....p.8...........!.........p......#]............@_......................... .......................................`..vm...................................0..l...@...T............................................................................text................ .............. ..`.rdata...G.......P..................@..@.data...Tt..........................@....rsrc...............................@..@.reloc..l....0.......@..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1388544
Entropy (8bit):	6.533349685071589
Encrypted:	false
SSDEEP:	24576:u5gYLuvjckzS11wIJYbvsv9NZHa2kaV7UhH+CJ+oo8lsVhpRZpyi8F3qp/:uOQuvxzS11FjNkaV7UQCJ+oo8SVYFa/
MD5:	351BC7471A9874ACACF7D386FA8BE227
SHA1:	CE82D1CCF593088D09694EF90E44C4EA2761BE92
SHA-256:	20CBF8835F6FD3878ACACBB7868F7B95A7AAE6C2C9D5D0A926337ED31378FA7A
SHA-512:	650EFE6986A8E4DADD5FE8F95812052E047421C728FB61EAFAA4512B12A41BAB074171A9E7AB56D37C34FE284491D5CD4D60931A004D40115CED80C4CB56BBC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\|.9...........#.........t.....................f.........................0......H....................................Q........... ..H....................0.......................................................................................text............................... ..`ENGINE.............................. ..`.data....n.......p..................@....rsrc........ ....... ..............@..@.reloc.......0.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\668c32.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Number of Characters: 0, Keywords: Installer,MSI,Database, Last Saved By: InstallShield, Number of Words: 0, Title: GX-3R - Data Logger Management Program, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2011 - Express Edition 17, Last Saved Time/Date: Thu Feb 17 13:51:10 2022, Create Time/Date: Thu Feb 17 13:51:10 2022, Last Printed: Thu Feb 17 13:51:10 2022, Revision Number: {7DED6250-9973-44A8-BFD0-71491CF41AEA}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	31188480
Entropy (8bit):	7.966901954099318
Encrypted:	false
SSDEEP:	786432:rS/x7zHby/JJkDbJOUksn0DaCEE/el6yH03y608WFE:rixuJmDFOUksn02CJfyHw
MD5:	E3D9D67C8EDE4AE70A25E1F222272E71
SHA1:	0D789AC913296C44216E3490611714A5865C6F61
SHA-256:	B887A3DB92767FAC24B9D3CFC2312DD3649EED54295E45E0DE6338F5C837AD90
SHA-512:	1AB141EB0D0C14DD4BDF1D305DB987B8AE501BC28DDB4628B2C57ED271651656FBC23769E056680F11CC9B6C11FBE848EC88ABACEE65EC7FA1A5DBD0ABC4BD93
Malicious:	false
Preview:	......................>...................................8........................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0...1...2...3...Q...............................................................................................................................................................................................................;................................................................... ..............................................."...!......#...$...%...&...'...(...)...,...+...>...-......./...0...1...2...3...4...5...6...7...U...M...:...<.......=.......?...@...A...B...C...D...E...F...G...H...I...J...K...L...N.......O...P...Q...R...S...T...W...V...i...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...k...j.......l...m...n...o...q.......r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\668c34.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Number of Characters: 0, Keywords: Installer,MSI,Database, Last Saved By: InstallShield, Number of Words: 0, Title: GX-3R - Data Logger Management Program, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2011 - Express Edition 17, Last Saved Time/Date: Thu Feb 17 13:51:10 2022, Create Time/Date: Thu Feb 17 13:51:10 2022, Last Printed: Thu Feb 17 13:51:10 2022, Revision Number: {7DED6250-9973-44A8-BFD0-71491CF41AEA}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	31188480
Entropy (8bit):	7.966901954099318
Encrypted:	false
SSDEEP:	786432:rS/x7zHby/JJkDbJOUksn0DaCEE/el6yH03y608WFE:rixuJmDFOUksn02CJfyHw
MD5:	E3D9D67C8EDE4AE70A25E1F222272E71
SHA1:	0D789AC913296C44216E3490611714A5865C6F61
SHA-256:	B887A3DB92767FAC24B9D3CFC2312DD3649EED54295E45E0DE6338F5C837AD90
SHA-512:	1AB141EB0D0C14DD4BDF1D305DB987B8AE501BC28DDB4628B2C57ED271651656FBC23769E056680F11CC9B6C11FBE848EC88ABACEE65EC7FA1A5DBD0ABC4BD93
Malicious:	false
Preview:	......................>...................................8........................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0...1...2...3...Q...............................................................................................................................................................................................................;................................................................... ..............................................."...!......#...$...%...&...'...(...)...,...+...>...-......./...0...1...2...3...4...5...6...7...U...M...:...<.......=.......?...@...A...B...C...D...E...F...G...H...I...J...K...L...N.......O...P...Q...R...S...T...W...V...i...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...k...j.......l...m...n...o...q.......r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI9308.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103808
Entropy (8bit):	5.754101403897092
Encrypted:	false
SSDEEP:	1536:64G6ZvLelmJkC9SUTBIFiiNFoWIIchv1DVVCUd:64G6ZgGF9gZpIIchv1Dfd
MD5:	BF4BF41B35FF879773E7F03FCF244FE7
SHA1:	EEF5BA9EF1FDFE1F44AF0654BDD87B925AA0A191
SHA-256:	D5B4D013D30C9443B72B7FE2222D4FB5958D2591D59394F86CE2C0C337DD8911
SHA-512:	FAD58050D7E6C9E64654C60C6B6ED46E5535D97FA59B65F9D5BCDBA1232D3A7B4DBABE9387AD0596A37ECC44FC845F464C72FC305DF61E2431F4F0668006BE58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l.0p..l..J...l..s...l..N.l.IO..l..l..l..J...l.LL..l.Rich.l.........PE..L....:VL...........!.................q..................................................................................`.......P............................p.. .......................................................X............................text...>........................... ..`.rdata..@........ ..................@..@.data....J... ...@... ..............@....reloc..n....p... ...`..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9413.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	269372
Entropy (8bit):	5.321032161274281
Encrypted:	false
SSDEEP:	6144:N8ychAaAyC8p6crN0hTgPhjnqQtCLl8OMlyFr84kvzp9tzZPi36BOpEvos8O9PnT:N8yDFGF
MD5:	3B432C7F72FEE6B5926E0B160FDE8678
SHA1:	0DB3F838C75F7F45DF533A8C1A9A848AC49D6192
SHA-256:	11B3EDD30A0DB1B7FFEB20AB3BCF0FA6B6F7A70AFC1094E736CCDA0B239E0A95
SHA-512:	371C741D593BCA95FCFEB127A21A205AB6DA7486D4728A866ED298C53B02A135CE3720074679D61BE9BE78D4AFDCC708EE76C538F58B5BFB038111B70ECB42E9
Malicious:	false
Preview:	...@IXOS.@.....@h..Y.@.....@.....@.....@.....@.....@......&.{1FFE8FB4-E84F-4460-8750-7986F429A342}..GX-3R..GX-3R.msi.@.....@8....@.....@......ARPPRODUCTICON.exe..&.{7DED6250-9973-44A8-BFD0-71491CF41AEA}.....@.....@.....@.....@.......@.....@.....@.......@......GX-3R......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@+....@.....@.]....&.{D660CA73-6A31-4F26-AF16-A5EA2ECF7CE6}%.C:\Program Files (x86)\GX-3R\GX3R.exe.@.......@.....@.....@......&.{B79EFD6D-4EBC-4456-A892-23A66A0B43E7}..C:\Program Files (x86)\GX-3R\.@.......@.....@.....@......&.{0603DFE6-9D20-45DD-B513-4F04ED72CBE2}).C:\Program Files (x86)\GX-3R\RkIrDA11.ocx.@.......@.....@.....@......&.{DA010909-432F-4C27-8FBA-C247E3367969}'.C:\Program Files (x86)\GX-3R\RKComm.ocx.@.......@.....@.....@......&.{9523F04B-9509-4468-8C4E-F958ACE34D38}%.C:\Users\user\AppData\Roaming\GX-3R\.@.......@.....@.....@......&.{BA89B7A1-E969-4

C:\Windows\Installer\MSI9471.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	4.301412248810523
Encrypted:	false
SSDEEP:	384:4a4KgJR6kmlCG/XVT8+I1P5sH6ASyDbapJEHGTo9WZ:4rxW/VT8jPavS6EJEmTo9E
MD5:	7682EF50FD5D119FD2F97AB017550F9E
SHA1:	C4359F5FC5019FCCD5E0EBCE0081E0778538B5D5
SHA-256:	00972E810316ED4BB96003F9B0796D2D475AB3D0FDB96B2E57FCE124CE382847
SHA-512:	B5C8188C236AAC3F8F37105EA30A32340A8CA50120C8739629944F259BC136324ACF53FE19E6B92084731A8CA846E5787D6C8DA30F308572868468C8A51112E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../y../y../y.(0s../y.C3w../y../y../y..0j../y../x../y.(0r../y.(0}../y.Rich./y.........PE..L...-.J=...........!.....0...0......{........@...............................p.......................................H..I...4D..d............................`.......................................................@...............................text...v,.......0.................. ..`.rdata..9....@.......@..............@..@.data........P.......P..............@....reloc.......`.......`..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{1FFE8FB4-E84F-4460-8750-7986F429A342}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1628411487212764
Encrypted:	false
SSDEEP:	12:JSbX72FjRAGiLIlHVRpMh/7777777777777777777777777vDHFQ9p3Xl0i8Q:JDQI5caz6F
MD5:	3CF988C151741D8506D77865E8D15A4B
SHA1:	B80FBA9F8C0FEC8DE5D75DF9861BC13DF61D7D03
SHA-256:	0BEBE868AB76DFF653E2F105E9F75A028C467B3BCF676080A049698C3F14D3BC
SHA-512:	14D7210DFEC99A3890F1D0ED9BF2E837B0D6D65F98EE209F042E4735946DFC2FEDF9609B475A0D4878006E9E1F1B744126AAEC11C09D73E6DEE5F4B4B002FA56
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.3396407051677244
Encrypted:	false
SSDEEP:	24:J0O38Pheuh3iFip1GE2yza2tJKAMBHofagUMClXtrx69vrLGda+UnlLnky:X8PheuRc06WXzWFT5i9vrLGdaphk
MD5:	8C15436BFF7919CC956B6624E2B2C6A5
SHA1:	08BA4B8DD23D0EA0A1BAE0CC5FD3BC622D1E4A53
SHA-256:	F3D193F4B44B895051986283E241AA847D8DE0EA588F5FAB82263F3A71C774D8
SHA-512:	EE5698DE55709EFA64AA9BC5BCE0671FAB6826464539D181FDD57712272B9D6D82A9B83DFC282A9EF39011A7DB23E6B227103FB8F8C8755FC826634BF23BC5B2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.163793428993322
Encrypted:	false
SSDEEP:	384:PvFMAyDNOdTdFCxfrwntajXjDWLi9Y+C5vy/Q1nDcZTqh/YNLZlNznky:VMAyYdTmPJbgqcnDcsZclNDky
MD5:	8C4096787A2DE210A1C0A8D14BFF5CD9
SHA1:	D2DE333B35E40D6C6337B5D4319E381165EF637E
SHA-256:	CB039BBBF76EB85939012297E945536B68EA530CD26A8B2573F0635B0CF04786
SHA-512:	F0122EFA713D05EC33A27D7DE275AE61681A65E4B5050872530CDC88528B6D4A6F23A4C8939AA3477F7E35723C7BBAE6A8767459EC712A53D4646946485BED4A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L..."OVL.................@...`...............P....@.........................................................................4T..(....................................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc............ ..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut11_24FC0B0B186C41C78A4A8C3D821B787F.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.301881610683859
Encrypted:	false
SSDEEP:	384:nvFMAyDNOdTdFCxfrwntajXjDWLi9Y+C5vy/Q1nDcZOyzu0IAW7nki:9MAyYdTmPJbgqcnDcRyZAW7ki
MD5:	DAF4F947BF38ECA590F9EFE1DB1A1EE2
SHA1:	0F4A43C6A7EF18D500AB7F1EABC12F9D7E8BAF7B
SHA-256:	0D429668E856B06A68EA78D7D4B3915D1FD406E40F395031E036CE49D3EA248A
SHA-512:	B01D714A8A5CFE1002CB90AACA671D13651FC0ACF20703613C0DF855E4BD126D590937D9D315940029FBF55C971A8191E76BFF103F9125CBD211FB9425E4F28E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L..."OVL.................@...`...............P....@.........................................................................4T..(.......,............................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...,........ ..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{1FFE8FB4-E84F-4460-8750-7986F429A342}\NewShortcut1_0BE5A0A4C6544045B9A8BB1F57F0AFD3.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.301881610683859
Encrypted:	false
SSDEEP:	384:nvFMAyDNOdTdFCxfrwntajXjDWLi9Y+C5vy/Q1nDcZOyzu0IAW7nki:9MAyYdTmPJbgqcnDcRyZAW7ki
MD5:	DAF4F947BF38ECA590F9EFE1DB1A1EE2
SHA1:	0F4A43C6A7EF18D500AB7F1EABC12F9D7E8BAF7B
SHA-256:	0D429668E856B06A68EA78D7D4B3915D1FD406E40F395031E036CE49D3EA248A
SHA-512:	B01D714A8A5CFE1002CB90AACA671D13651FC0ACF20703613C0DF855E4BD126D590937D9D315940029FBF55C971A8191E76BFF103F9125CBD211FB9425E4F28E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L..."OVL.................@...`...............P....@.........................................................................4T..(.......,............................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...,........ ..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375168710631416
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauZ:zTtbmkExhMJCIpErM
MD5:	0359E8772807B00B43316FE2889457B3
SHA1:	FA6A194EBA2ABDF699E3681DC41AE7D36BDE05CE
SHA-256:	26181616396686B6C0E9025F1D26DC306CD42B3307BD2AACBAD1C7E174457118
SHA-512:	5C6719103D6C3A2BF06682A1DE0D373DE4FA1F3BCE9A9259ACCE7B73630FFAC50C013E1EC6E9B114EF7F9DB32E2466A339C5B61EEF085382CDEB27769795EB1B
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\JETCOMP.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	4.663698208666807
Encrypted:	false
SSDEEP:	768:0cXhA6Hxa27y9FjoZXEhg3SRgytd+wGVw:0whzRfAsUfgy/+wJ
MD5:	CC16517F72C7F5CA48CF556B615C0857
SHA1:	97F47E9C00898FA35A2D2B2E1C6C715535E716C5
SHA-256:	63904E401BD11F3606371086BC2E8672B94438D9115A86C57FF18FD9608BE235
SHA-512:	7FEBA89E8EB12F74515D3AF35B46CAF572913CB40845F538796F78888E361F2449AFA860E2BA464F05112041B9DF4F0490ECF32148540BBF85A5D06885803B17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lbS............................Rich............PE..L...B.N5.................@...^.......&.......P....@..........................................................................T.......................................................................................P..P............................text...6?.......@.................. ..`.rdata..l....P.......D..............@..@.data....:...`...4...P..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Odbcjet.cnt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows help file Content, based "odbcjet.hlp", ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6902
Entropy (8bit):	5.104744204108463
Encrypted:	false
SSDEEP:	192:FDaXTRFKPGdAMPNE90nMY1kO0CTB7+TRxx:FDiKPsP1VMY1kO0Cl7+T9
MD5:	A86A0C4CDEBA48F34C2460FFD6081F75
SHA1:	7616F5A0CC9F6D2C7C6748567294069CA7C87A5F
SHA-256:	FA99C073C69AE72A6E6F2152595A776C2A6CA570B0AAAC7A2FC27BEDD98964A5
SHA-512:	ACE980514354ECB9ED116A12D14F0FC40C86B4BAE04F5138E70235277B6A9B516884EAE3F86A1B63D655F22DBBB06B98CD998C0F9DDF768ACDB2CE3B27354F14
Malicious:	false
Preview:	:Base odbcjet.hlp..:Title ODBC Microsoft Desktop Database Drivers Help..:Index ODBC Desktop Database Drivers Help=odbcjet.hlp..1 Overview (all users)..2 Overview=Overview>ref..2 Hardware and Software Requirements=Requirements>ref..2 ODBC Component Files=ODBCComponentFiles>ref..2 Product Support=ProductSupport>ref..2 Setting Up Drivers=SettingUpDrivers>ref..1 Working with Data Sources (all users)..2 Adding a Data Source=AddingADataSource>howto..2 Data Source Conversion=DataSourceConversion>ref..2 Modifying a Data Source=ModifyingADataSource>howto..2 Deleting a Data Source=DeletingADataSource>howto..2 ODBC Setup Dialog Box..3 Approximate Row Count=ApproximateRowCount>ref..3 Buffer Size=BufferSize>ref..3 Collating Sequence=CollatingSequence>ref..3 Data Source Name=DataSourceName>ref..3 Database=Database>ref..3 Define Format=DefineFormat>ref..3 Description=Description>ref..3 Directory=Directory>ref..3 Exclusive=Exclusive>ref..3 Extensions List=ExtensionsList>ref..3 Page Timeout=PageTimeout

C:\Windows\SysWOW64\Odbcjet.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Sat Apr 4 00:37:56 1998, 170865 bytes
Category:	dropped
Size (bytes):	170865
Entropy (8bit):	6.3244318106867325
Encrypted:	false
SSDEEP:	3072:ZKvdrBOnI4bLcAkJS8i9d+ZbgMNj8GNbZX5cPZ0:0vbOnyAkkBaZbgMNwqZX5aq
MD5:	229EA4FB6403617B7602004DFE8364C7
SHA1:	19E7BA9BCEF9A3BDEDEC9BE5DE47BBA5F89F05E5
SHA-256:	767E07C177A5DBC2B8BFB7AEF1AD9F8BF60BFBC633F96E3E152088CE728890C9
SHA-512:	B256CB6CEF400C3B9D7FD270F973B7DBD7B8E775EDB4BF50C543B429DE33800A20A23CBC925FB7F6EE7BB0489F85CD96A8501E35F137E7966F28272221AF2205
Malicious:	false
Preview:	?_...!......q....!...!...<')... ...0,`D')..:(($.:.(..`),,`..aAccessA.dvanceda.nandappl.icationa.reasBackU..1. 0..2..3U..4..5".6'.7.,.81.9bebo@xbtn_b?.'.byca.anno.tCBBCEch.aracter.`.scolumn.0...ntrolda.taD. taba.s...@BASEd.efaultDe.leteMark.dialogDi.rectoryd..psplayed.Driverd.@...s.0sdyna.m..llyexa.mpleExce lfile..sf.ollowing@forFor..m.atFoxPro.fromfunc!0.Goto..IE.inindexi.n0L.isIs...keywordL.imite!sMi.crosoftm(ust..e%.nu.mberODBC.ofonlyop...orP7.dox.returned..0ss4.Sav.!.S..ctsets.our..peci.fiedSQL..._CVT_DOU.BLE.PINTE.GER.PNUME.RIC+PSMAL.L".;PVARCH.A-.ConfigU..Si S..e..t.s.`upport.ed..leTex.ttha..eT...ist..otra.ns..p.type...su..valu.e. sWhenw.illWT.ows.with\|!!,."""",".".\"#$$)''@}($(....)(-...(\|).),).)}*..+--].)..../00.50.101S0211 .01.1..00.11121271.3..4.0831.4..516171.992..622..2.02.52....2525425...6262772.7833.3.0E../B.3.5..1.30313232@76744.Z.4.0.400055..5.0../7...0512..K53.66606006.465,&...5...5357(.790.8929597:.::=:\;<=.=<>>">,>.<[[([+[, [.\]]..][.^`AABCab ility..ab.ouK.ovea...

C:\Windows\SysWOW64\VBAR332.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	368912
Entropy (8bit):	6.468979684192829
Encrypted:	false
SSDEEP:	6144:uLa8OZI7UqK2EltlXtHTIo3+CAOlvddPxsCzp84J:/I7fKplthtHTIbUV7Px
MD5:	9D1864AE5F6FF8BBDE86A3F5A448110D
SHA1:	912DBA207D17697BE8196E46A0CB1DC13F291519
SHA-256:	DDF8F7366A4E44BD7EFCAD0B3F20C8B0EB82185CC909B03CE6935415BD8C6A10
SHA-512:	39F3730F91C464D46EF0432E85275747D515CEF33F0B85FF878C3D25946539222B147D320521DF87AFC9E2D9FE74E292E30637A608CFBF915C203B4F3783662A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......2...........#................ ........ ......................................(................................L...-......x................................=... ..................................................\|............................text...v........................... ..`ENGINE..-2.......4.................. ..`.rdata...Z... ...\..................@..@.data....Q.......6...b..............@....idata..X...........................@....rsrc...............................@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Vsflex7.ocx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	483328
Entropy (8bit):	6.338653994783018
Encrypted:	false
SSDEEP:	6144:2mGVvvj0ztFsGL3T30YcyRaDm8JiC8YRVDFUnhdabfDVaD4aimbixQf4UkfC0+l:GVQzsGLNcyRadJinY3FOObLOS+OC0
MD5:	A1B8666C3E56BF01C18E35D9F3853847
SHA1:	F0D90B99269DB41FD064D75E4B4D4C5349873CB1
SHA-256:	D98392498222D90DFF6474D58F51D3E332EA82268E4BB627235477C3642A19B5
SHA-512:	C3C58F0E69B925E1389897BC5E6FC522322EC6C734CA0B78497CEEBEF36F6CAD2268A7549E57786A16E256DA78A98119AEC987E30D85B84CAFC92FBD80D53FE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.+...x...x...xu..x...xS..x...x...x...xS..x...x..x...x..x...x...x?..xX..x...xl..x...x...x(..xQ..x...x..x...x..x...xRich...x........................PE..L..._t.=...........!.........P...................................................................................... !...............0...x.......................F......................................................0.......@....................text............................... ..`.rdata...q..........................@..@.data........0...`...0..............@....rsrc....x...0......................@..@.reloc..dO.......P..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\cmdlgjp.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28160
Entropy (8bit):	4.35305025633664
Encrypted:	false
SSDEEP:	384:GeXKv444Ie3ZhOW5HLyEf2PtAXL8W+jHVBZMlQDIEvWGe:f3hOKHrf2PtAXL5+jHHquZi
MD5:	C0115E5B67ED4F9FDB3C71D680967DCC
SHA1:	8C5B9C25F653F224C4F7D6EE57474876E5F0F690
SHA-256:	56EEC933D00E41D04ADD33F65708AA3DD5582F88E8BF2F96FA264727A6D65E8E
SHA-512:	938CD0C9C63DB7C552B7296349EC31A890F74E1B7C3D9186CDD3870ADCF984173C82CBC0B9F53F0640EB1DD88606262FF2D5B218DDA92B585F69676883F99A50
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....5...........!.........l.....................!.................................g...................................................P...........................................................................................................rsrc....h.......j..................@....reloc...............l..............@..B..............................................................]b............8.......P...............h.................]b......................]b........................................d.......e...(.........]b............@.......X.......p...........................+.......?...........................0.......H.......`.......x....................................................... .......8.......P.......h.................]b......................]b......................]b......................]b......................]b......................]b

C:\Windows\SysWOW64\comdlg32.ocx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	140488
Entropy (8bit):	6.138293118127049
Encrypted:	false
SSDEEP:	3072:3ESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzdHv2:3ETz566VgRyOJ0oDxQRHH
MD5:	B73809A916E6D7C1AE56F182A2E8F7E2
SHA1:	34E4213D8BF0E150D3F50AE0BD3F5B328E1105F5
SHA-256:	64C6EE999562961D11AF130254AD3FFD24BB725D3C18E7877F9FD362F4936195
SHA-512:	26C28CB6C7E1B47425403AB8850A765AC420DD6474327CE8469376219C830AB46218383D15A73C9EA3A23FC6B5F392EE6E2A1632A1BF644B1BD1A05A4729E333
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.6....!......#......................... ....z!.........................0......T................................s...............@...............................................................................................................text...L........................... ..`.data........0......................@....rsrc........@.......*..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\mfc42loc.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.95226020575379
Encrypted:	false
SSDEEP:	384:ZW6/tAGqyVYJ45uxyJbvvWMWT0ZU1ferOg0xn8mPESlkUZTYBK8VCb:ZvAGDiJ45bvFrOg0mmP7SxVCb
MD5:	779B6F868721C10E94631316A2AA9867
SHA1:	1712494F26EBE514CF35CEC9AA86EDAE7558536D
SHA-256:	8841C2893211C0882E9A5B4C3CAC6EFD60C23CB6A25F2BD87B2C179B83E8136A
SHA-512:	5BFC18CAB5851A8B826AEA6EAAD64148E8629EE1BBCEEE081F5A2B4CB322B542EFD51891062B3185F3869CEC4287E37AC6DCDDBB90755CEB8ACFF985B3DFC454
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.)G]..A[.Rich.A[.........PE..L....v.5...........!..............................._................................................................................................................................................................................................rsrc..............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\mscomct2.ocx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	647872
Entropy (8bit):	6.459761742924256
Encrypted:	false
SSDEEP:	12288:qxxeCsfuxdH8ZOlK/kV99RWiVwyzgAQk9yjWy6OcjKN7jsUseUbQ/D5v:qxUCwwd7T9fWQgAQkEjyOcjKJsUseuQF
MD5:	C1B4AF41A0370E4081D59AC99BCC929D
SHA1:	C0C55DE97F41A24BF50B2D08EB428371BB4A3CCE
SHA-256:	2B7A1F905486736EDA8B51ADD1BC2590C2A6D9D5A9AB7565335D989F39C0EB8E
SHA-512:	0BB987AF80AB3B598F2D3008A6005484D2D4D082958E757AED3FD1CD5CCA543F02D7B475E2C030E28E320D327DCE4B4009894F51B7AB8F03ACF54314D86D38B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Py.8.....(.....#.....B..........=........0....{'.................................>......................................2..........(........................]...1..................................................h............................text...6A.......B.................. ..`.data....c...`...d...H..............@....rsrc...............................@....reloc...].......^...n..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\mscomctl.ocx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1066176
Entropy (8bit):	6.377536905123536
Encrypted:	false
SSDEEP:	24576:K2woQX9+gWX6b+SHQjxnRC33Oej3zR/QhF7OnVz3S7HM7BHg:5kX9+V6KTpcPhkgVSglg
MD5:	714CF24FC19A20AE0DC701B48DED2CF6
SHA1:	D904D2FA7639C38FFB6E69F1EF779CA1001B8C18
SHA-256:	09F126E65D90026C3F659FF41B1287671B8CC1AA16240FC75DAE91079A6B9712
SHA-512:	D375FD9B509E58C43355263753634368FA711F02A2235F31F7FA420D1FF77504D9A29BB70AE31C87671D50BD75D6B459379A1550907FBE5C37C60DA835C60BC1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."x$9.....@.....#.........l...... ........p....X'.........................P.......................................@...............P...Z.........../...............................................................................................text............................... ..`.data....s.......r..................@....rsrc...4\...P...^...6..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msexch35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	344064
Entropy (8bit):	5.971794586150627
Encrypted:	false
SSDEEP:	6144:YcKkLidETx3sXxMonW1jaEUvrNYsbFuNJTPgvgsSfOe7hTHgVjy6yp:RjidE8xMHUXbF4fhOjLC
MD5:	6CDBCA8AA1E3D84D3C5E462AEDE82197
SHA1:	B76E21F6A3294EDF068C871B98DE184F60BCA5E4
SHA-256:	DF96FC53ECF98A7E721C070BAC8DA32C1AB2419131C2E8AB523198AAE45FF093
SHA-512:	1E53F085B4695E614201D7A54A05F222A4388F7C003801DAC4294C3FCFB53B1C80C37745F2C971795C17B987DB2ADB0CE4EC3D426F14E3B7F35E5554E20C2986
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......3...........#..............................;..........................p...............}...................... O.......S.......0.......................@...+..@R...............................................................................text....V.......`.................. ..`CURSORS......p.......p.............. ..`BASE.........0.......0.............. ..`.data....V.......0..................@....rsrc........0......................@..@.reloc...+...@...0..................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msexcl35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	252688
Entropy (8bit):	6.513353863198272
Encrypted:	false
SSDEEP:	6144:C6F24gl8wB3xOnadfJkqO+tagQmBTmS5KQdpMix:vbgWYxvdh0MwmBTmctd
MD5:	29281B0FA3B49C18B900072B26702F14
SHA1:	015F3891E4880ADFF77BC8C14C95EF1726F207A6
SHA-256:	AE1B44A86BC9666E65921F1CB6F85A49FAC774E7249101A5CF2081D1D76098CE
SHA-512:	8D3CA40CEB57AAB6C950B4E93CA392A6AFB89E79E0D7660541C4833365FA0EE305025ADF5C6DDDED6E4F26BC9164398BF134FE543064466BD3D867ECEDDD0359
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g.7...........#.....X..........1.............&..........................0.......;.......}.......................[..s...@\.......................................[...............................................................................text....V.......X.................. ..`.data.......p...X...^..............@....rsrc...............................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msjet35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1050896
Entropy (8bit):	6.603593620373584
Encrypted:	false
SSDEEP:	24576:mTZtL5tRvRV0sjN+YBMxd/r3oc90orxuD6AmuqbdRM+92b:6LvHAYmxdj3codNAmnb/
MD5:	2BCB3E39703A69B0235AD937C0E4B1AC
SHA1:	8A3A66C533F3E9361F698F280423DAD4BFA7431B
SHA-256:	91DC7E10F4F97C0046B4B91B04B5195B95F3F0FD36260FA6433EF2EF623CB0DC
SHA-512:	500574ED6231D2354165052DE53383190C7C187399991D3FB1CCB95709DC8CB795F4A9241D6DA4F68F66ADA5F1ADC782786E6F2FD2A7A46252D0F9C599CEFC03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...yn.7...........#.....R..........t4....... ...............................P...... ........}.......................C.......U..................................Lh...T..................................................0............................text...@P.......R.................. ..`.data...`^...p...B...X..............@....rsrc...............................@..@.reloc..Lh.......j..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msjint35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	3.381458564010772
Encrypted:	false
SSDEEP:	1536:CEhrCMnu8LylA1U4klSZ/v3P44XW9qT1z3RgYPx56gbpNvqb7m5:Coju8Lf3db1zX56gbrqba
MD5:	0B2FE7D80AA65475AF3ECC9992A1D6F2
SHA1:	0DA878965CEE2F38B25645E6B7C95553A9FA182C
SHA-256:	DDC3A3749258AE7E40C3FFC2289A52E85EB93BDF87B445DB46E2A6CA5B437815
SHA-512:	09063DABD3824DFDF89CF6D2E47963BB234900403A1017EE0AD78821A568220798AD5C2A78BB638E840963957AAE7B0A64CFBFDECA7A6A19CC424594F8CB6E14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......3...........#.........................@....#.......................... ......fV.......}......................P(..\....%..<....P..x...............................................................................x............................text............ .................. ..`WEP_TEXT.....0.......0.............. ..`.data........@.......@..............@....rsrc...x....P.......P..............@..@.reloc..D...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msjt4jlt.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1238288
Entropy (8bit):	5.9384359329930225
Encrypted:	false
SSDEEP:	24576:TDY2rw5X9wH3ute3tv+fLhAb02Jfz07Tb3Tzw7etlbokTuJj0:TsVX9wHori/z07TbTzxlY
MD5:	731831EFA9182992F9C5E4C65D0BD077
SHA1:	190B62FBD3674D3CAB85E9B1169AE6430B4E6696
SHA-256:	9329F42AC6F2C7470C070863AF04572C9F32148C1D86CDBB6E0E301C7F5D780E
SHA-512:	6FA121F48077BAFE82A36DA39B74F8500A469B6544C6CD03E7FAFE4EC18EBDF4E6DB46C74DD78C095CC4983E0EB740BF07D1E651927213AC19C5D82B5B4EED93
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......7...........#.................\....... ....R................................._e.......}..............................@....................................h..@...................................................0............................text............................... ..`.data...L_...0...X..................@....rsrc................v..............@..@.reloc...h.......j...z..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msjter35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	24848
Entropy (8bit):	5.167828345439299
Encrypted:	false
SSDEEP:	384:Nj13lSJr+vZqNhbzRKLfsg+E08IC1cjyr/IBPKqBPERNU4ij50XHyWk4SVWX:Z134rOZbV70R4cj4aKYmyzj58H1/
MD5:	72F160302EE06A2CB12FA2FFA10BA3F0
SHA1:	099E3C78F511665CA9E9DB3ACCA5DC244BCB744F
SHA-256:	3430B3680415B494BA7EB41F7BC83933DA68D364A94287B9C07384B2FE3DCB54
SHA-512:	5F794B9A48C82764B9790FD084933030CD5A34EAA6BFF5A99D74F625015FA50F4918E3F80625537023EC253B7DE390AFDA224A76622E0C41C371D45F744656B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......3...........#.....,...6...............@...."..........................................}.......................5......@7..X....p..........................D....6...............................................................................text...r*.......,.................. ..`.data....,...@...&...2..............@....rsrc........p.......X..............@..@.reloc..D............\..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msltus35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	168720
Entropy (8bit):	6.465195588511486
Encrypted:	false
SSDEEP:	3072:e8668sapcCUnvx/IVj8FCqMq8N6lW4L2GyD0LqseLA3tomWSoOmr0eA3aatcx:e81FLO6Ccl9L2AWhmy9SoOmhA3V
MD5:	89C1D25C3ADB055130F42840E2663BE6
SHA1:	ACF4D7463BC8A656199079A87824CA8DB9C6A539
SHA-256:	E8C87E978A87246A32693F83027488EA204B7C6182BD80A9156BB60709276DE7
SHA-512:	3D4186213B20CCC4CA74952D3BB9EA103ED19EA3CD4514662DEB763C7724267451A6D0EBAEA1BCB649E165FB4B45D2CCDC93C1162BE0B51560E614E3E6277847
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g.7...........#.....<...v....................+..........................................}.......................A..s....C..................................L...@B...............................................................................text...t;.......<.................. ..`.data....Z...P...6...B..............@....rsrc................x..............@..@.reloc..L............\|..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\mspdox35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	250128
Entropy (8bit):	6.547386571080297
Encrypted:	false
SSDEEP:	3072:PIewErfPt0RTebO1DQ6jfSZqqRzKsGNM3RxZ1/9IhBaVXrnXGK4CJ4KCK3sNioj5:PIen0RSOZSAsvZX2Ba8CJ4VZd6jLf4p
MD5:	EC7713BD6CF95BAAE1A2F67C75B74376
SHA1:	239F0C53F6241C0B78FF404EB7912A1E9936E4CB
SHA-256:	B7BD9FB77332B113DC615A307F24D10DF999860220B0B822E21C43E6990C51EB
SHA-512:	BB898434A2ABD4CF510D2F14E2B20E15310D7778895E36E3DDD7A32C41E48114F8C38721D0D9B6C6D7DBF1997AB4DBD3AA3A094928DDB0AD285B1502899EC60F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N\7...........#.....z...n............................................... ......1........}..........................s...@...x.......................................................................................h............................text....x.......z.................. ..`.data....S.......6..................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msrd2x35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.29353052694812
Encrypted:	false
SSDEEP:	6144:DI0uKc+/y/n20qecWHUe+4nwO6WP2ypU:9i2BenHUTzXWOyy
MD5:	34D390EA0D5969DB0D7DD133EFF0A48A
SHA1:	522FFDDB883314940EE6843B631FE15D96F5C12A
SHA-256:	544886CD823E8B04E3CC88456C669ECE1DEB186B804A07C11E4A1DE318AAF4F7
SHA-512:	A809AE31B6FEB0591D70981AA5D0E01FB0DD0F7B5D51A608A235D0B8119C0ED24F698BBF849F83535CEC7E99704C413B38EC89C8C293AD572CD472000FC6EA31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......3...........#.....p...z.......I....................................... ...............}..........................s.......d....................................................................................... ............................text....n.......p.................. ..`.rdata...*.......0..................@..@.data....#..........................@....idata..V...........................@....rsrc...............................@..@.reloc.."........ ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msrepl35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	415504
Entropy (8bit):	6.3630004127627995
Encrypted:	false
SSDEEP:	12288:tZE9GvGy6JJKHZuieu1RXQ1YFEx40uGQnJpiMED:tZ0GvG3JJKHZuieu1NQeFExzQfi
MD5:	87BE086E054CCFDCE2C7913D56CB4CA2
SHA1:	D8F6B78C2C11BD023BD5A48238F1317A59C8BE46
SHA-256:	0DD108A0ACE7101E55E2991F37EBCEFA1D0258763D121A04B5516F037C0DE2C8
SHA-512:	7C6B92DA42BDD081158509B5CD994347B7E5FB217686A23843B89DE0B1B06C60DB2883E0090C1AD9F09788561BCD4C72440894C83C8D290FCC6EDC062F2216AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.7...........#........."......3B..............................................l........}..............................@....................................M...................................................................................text............................... ..`.rdata..L1.......2..................@..@.data...............................@....idata..............................@....rsrc...............................@..@.reloc...M.......N..................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msrpfs35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	44304
Entropy (8bit):	6.096356471089552
Encrypted:	false
SSDEEP:	768:Ybu5JOyft+0C5oqOhNXqnlGOa+owIOH4LCNHPWaNGtGsCyec06COk6:Ybu5JO6eGe9wgHOpttd06CF6
MD5:	FEA9EF60AAAAEF0D1A369EA8A2E07325
SHA1:	7B3AFE0AE8A0AF8C9FAE3E106ADECB3820AB275F
SHA-256:	D01CAD3B3F9AA803036D29F3C19F5B1504FE025C133B8FF677E8B3D8CD23B20F
SHA-512:	528F3C50319843B5E46D1AE8BC7ED564E20301DCB0228A894A7BD748E5BE512941C59191A40E61D24713A2513037AB624DEDB57BBB4FC06B1BE6967D15B0935B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$7...........#.........*.......V............A................................."2.......}..........................Y.......d...............................d.......................................................d............................text............................... ..`.rdata..............................@..@.data...............................@....idata..............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\mstext35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	166672
Entropy (8bit):	6.485048210872015
Encrypted:	false
SSDEEP:	3072:1stEwxdSml/eK5iN2ri2KLpYCQpj3JZba6VQktD3pdyo+hJKnaHjn6nf/oyv3c/n:1zwxdVheK5i8ri2KdYCQpj3JZ+ktD3E8
MD5:	8E29AFFBF309490CBB33BCB25FD1F8BB
SHA1:	546EC23CB9868252E0B2B7B90CDA625A52DA964E
SHA-256:	AE8F54C2FD76B33803C4877EAAB73E133469B34436808EC6A8185616B8FF98A2
SHA-512:	0DA47D5525CFCDF7151290D6246AE1832D8D68893CE2197D60213A29CB612157B74589B610C706E283E73FF160EE3384224D14B0679AA3C7AA800982A8CD13B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s..7...........#........................`....3.................................8........}......................@0..s....1.......................................0...............................................................................text....)......................... ..`.data....g...@...@...0..............@....rsrc................p..............@..@.reloc...............t..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\msxbse35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.44614051236428
Encrypted:	false
SSDEEP:	6144:IYRLqA0GnZzZpWVDYv+BGUwFqbDq4FDaTU5BrVQJokp4EAQ+:3OA0GZzZgYvJUwFqb+4FTTep4EAQ
MD5:	FBA99D04ED1B2A29DCA48932C8926355
SHA1:	1E786DBF4F056835E4F6FA699D102E63009193AD
SHA-256:	E2C0E5D5B3772E012942C2AF3D611B94F45D73442A6B1CD2406ED25CF49E655E
SHA-512:	B18FD0B056944716727F923F4B91E3CCEDAE0AB64A5016084A657AACD240D6A63EB7621DCC70DC933F4ABEADE325962F88F2F75C366D9FF6F1BA48095155F123
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......3...........#.........z......n........P....6..........................................}..........................s.......x....p..........................p...@................................................................................text...\........................... ..`.data....W.......@..................@....rsrc........p.......P..............@..@.reloc..p........ ...`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\richtx32.ocx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	260096
Entropy (8bit):	5.087630341542848
Encrypted:	false
SSDEEP:	3072:y2yywZ8NOAf90tLOsFZdASaIaOXUX1RmY1viVb6y/yg9FdYJEhN9dTm7kSkR/Umn:S78vfEBFZdASUT1RmMFkFdYJErWD6/
MD5:	F5943C2F7CD00CDD27EE233B30EBD5C7
SHA1:	EBA5337B95B9767F062C9ED439798235DA77A7A4
SHA-256:	9B0EA442AF9E7E2DD19A009FE0DD2447E9E21835AD98201F677C308FE9BFCF7A
SHA-512:	4DE6A3708AEE6AEFB311E76C337BB145D54CA612B9A411D2F35A1F0162089176C0547C87EC2368BE49C7E89E030676308D1A98C7F37E582780FAFD05DE12F647
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...go/9...........#.........8..................... .........................@.......z..............................p...........8...............................4....................................................................................text............................... ....data...............................@....rsrc...............................@....reloc...@..........................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\vb6jp.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	102160
Entropy (8bit):	4.370323462888631
Encrypted:	false
SSDEEP:	1536:/qg/n05tZTFYFWLv3Kt4u1XAs8+23IRhO:/Jc9FYkLv29XAs8+23ch
MD5:	63823B03781553CA634D5E26FDB38F8A
SHA1:	6015D45132E5D7B0F22D656D5520FF3792BC5255
SHA-256:	9CC88B36B1A508C7CFD5D5853635A4D4E373047379244E7047C0F1C8DE3E6741
SHA-512:	326899858DDDE045CE8AE59732088369F8E97D5C201CC9795618012A93BA47C30EAA19654A94C4B3BEEEFE1DC78F32691F756E0C7E12097F2F395B717CC47B04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......9...........#..............................cf................................f&............................................... ...)...........................................................................................................rdata..p...........................@..@.rsrc...\|.... ......................@..@.reloc..............................@..B.......................9...........................9................\..........9................`.......................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3101E1CF17682C07.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF62855858F2B57AC5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.3396407051677244
Encrypted:	false
SSDEEP:	24:J0O38Pheuh3iFip1GE2yza2tJKAMBHofagUMClXtrx69vrLGda+UnlLnky:X8PheuRc06WXzWFT5i9vrLGdaphk
MD5:	8C15436BFF7919CC956B6624E2B2C6A5
SHA1:	08BA4B8DD23D0EA0A1BAE0CC5FD3BC622D1E4A53
SHA-256:	F3D193F4B44B895051986283E241AA847D8DE0EA588F5FAB82263F3A71C774D8
SHA-512:	EE5698DE55709EFA64AA9BC5BCE0671FAB6826464539D181FDD57712272B9D6D82A9B83DFC282A9EF39011A7DB23E6B227103FB8F8C8755FC826634BF23BC5B2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF64CA6C966608898C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAFE7AE4365303E8D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB4B5561EA1C62E25.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB523FF4DB6D23A9F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB5E05CA8EF464CBE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.7650143603800743
Encrypted:	false
SSDEEP:	192:hPW5Jt1rhxwJQjeNAdfc+qAJrhxwJQjeNAV:he5JHrhxwQeNAdkAJrhxwQeNAV
MD5:	113C76E33BC751393AF9D6F45E615750
SHA1:	6C40EB36E0E6D170D75129A720CAF4781AC512FD
SHA-256:	92B4C119500B254EB7EBE361732B26E245897C577CCA92436613BAD086E91744
SHA-512:	D1A8B3AB687544C04C38A6F24995E9C0F9DE071D7C706451CEA6C699EE10B491CE997AA506B17A57AA635F289AF8591AF74AFE9F8CFE6A7B77FBFC59DB0B52A3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC22E59278A416764.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.7650143603800743
Encrypted:	false
SSDEEP:	192:hPW5Jt1rhxwJQjeNAdfc+qAJrhxwJQjeNAV:he5JHrhxwQeNAdkAJrhxwQeNAV
MD5:	113C76E33BC751393AF9D6F45E615750
SHA1:	6C40EB36E0E6D170D75129A720CAF4781AC512FD
SHA-256:	92B4C119500B254EB7EBE361732B26E245897C577CCA92436613BAD086E91744
SHA-512:	D1A8B3AB687544C04C38A6F24995E9C0F9DE071D7C706451CEA6C699EE10B491CE997AA506B17A57AA635F289AF8591AF74AFE9F8CFE6A7B77FBFC59DB0B52A3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD0966FA1C9EC326E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	0.6343175175765062
Encrypted:	false
SSDEEP:	192:7qAJrhxwJQjeNAVHt1rhxwJQjeNAdfcI:uAJrhxwQeNAVHHrhxwQeNAdT
MD5:	3FB70F6D3DB99BC54792FF052BD6A944
SHA1:	B7B8AE5EBE309C0A56C52212E042AC8CD930FA23
SHA-256:	1047CCDD2062146BC9ABA51AEB86F3D2C2D1205D12F60652FE27E5419B34F9A2
SHA-512:	B3D8F35DAF170825D7A25D19CA5CAA231EAF707FE69F63DFF034FA75FD17136A41477410DE6F7A8C98F50728957A81B107CE7A5D812CED55239740334DCB5DB4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD111047A5858290E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06946706543922561
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOePA7LqqtyVky6l3X:2F0i8n0itFzDHFQKr3X
MD5:	C08A5E190CA42ED22F40E04F6B6F85FF
SHA1:	52D50A1E5B07E1F6847B34E68BE178AB7829E356
SHA-256:	F8929F117E2D72D7E7006D5D7516D5BC0544D913B2CFCC5E84099438916A4FAA
SHA-512:	144F0B88D14FFDF332F1CB15BCA601E0F00D9E102EE1EBC867BDE7A84FDBE5826DB9CC7D1FB0601A55CD8CE4E6CAC2D20F09114A769B6434CC18EC3008E2DED0
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF4EEF877781A8475.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.3396407051677244
Encrypted:	false
SSDEEP:	24:J0O38Pheuh3iFip1GE2yza2tJKAMBHofagUMClXtrx69vrLGda+UnlLnky:X8PheuRc06WXzWFT5i9vrLGdaphk
MD5:	8C15436BFF7919CC956B6624E2B2C6A5
SHA1:	08BA4B8DD23D0EA0A1BAE0CC5FD3BC622D1E4A53
SHA-256:	F3D193F4B44B895051986283E241AA847D8DE0EA588F5FAB82263F3A71C774D8
SHA-512:	EE5698DE55709EFA64AA9BC5BCE0671FAB6826464539D181FDD57712272B9D6D82A9B83DFC282A9EF39011A7DB23E6B227103FB8F8C8755FC826634BF23BC5B2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFCB40E8BB23CDD0A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.7650143603800743
Encrypted:	false
SSDEEP:	192:hPW5Jt1rhxwJQjeNAdfc+qAJrhxwJQjeNAV:he5JHrhxwQeNAdkAJrhxwQeNAV
MD5:	113C76E33BC751393AF9D6F45E615750
SHA1:	6C40EB36E0E6D170D75129A720CAF4781AC512FD
SHA-256:	92B4C119500B254EB7EBE361732B26E245897C577CCA92436613BAD086E91744
SHA-512:	D1A8B3AB687544C04C38A6F24995E9C0F9DE071D7C706451CEA6C699EE10B491CE997AA506B17A57AA635F289AF8591AF74AFE9F8CFE6A7B77FBFC59DB0B52A3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.993763422939572
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SW-GX-3R(EX)_06293_setup.exe
File size:	31'250'995 bytes
MD5:	5e1e66319cace2ea52f37e9f025e40fb
SHA1:	2fd7c9e96c17ab5da52b43108cb9e4a44213a536
SHA256:	30d2957b6b44309b4121193bc52f9e3a6bf4bb2b36bf53c19db7607f3f07cc5a
SHA512:	80bbe20b8f6d1afbc5dd59833cb3d12c48774f0531332cc7364ad788daff0d8298b966087653f05d1284b43f783032b738d7b88d8cbcce6a626d2e755a0bfe19
SSDEEP:	786432:AuYzWkHfHnY0X4xv+zCsXyz+IgbkdwHoj8OZqpqI1GmGhe:AuYzWk/ILsXyyI5wTWhWh3
TLSH:	2767332375C2C03FD2A219324C6F8EB446E2BC639931465BB564FF282EF8582B517F59
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6.NWW..WW..WW..^/..\W..^/..NW..^/...W..p...TW..I...TW..p...BW..WW...V..^/..#W..I...VW..^/..VW..RichWW..........PE..L......L...

File Icon


Icon Hash:	55497933cc61714d

Static PE Info

General

Entrypoint:	0x468208
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4CAB8D18 [Tue Oct 5 20:39:52 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	f18e688283da41095f81f4c165a6dcf3

Entrypoint Preview

Instruction
call 00007F3D0CEBCF36h
jmp 00007F3D0CEAA63Eh
test eax, eax
je 00007F3D0CEAA7CFh
xor ecx, ecx
test eax, eax
setnle cl
lea ecx, dword ptr [ecx+ecx-01h]
mov eax, ecx
ret
movzx eax, byte ptr [eax]
movzx ecx, byte ptr [ecx]
sub eax, ecx
je 00007F3D0CEAA7CFh
xor ecx, ecx
test eax, eax
setnle cl
lea ecx, dword ptr [ecx+ecx-01h]
mov eax, ecx
ret
mov ax, word ptr [esi]
cmp ax, word ptr [ecx]
je 00007F3D0CEAA7F7h
movzx edx, byte ptr [ecx]
movzx eax, al
sub eax, edx
je 00007F3D0CEAA7D3h
xor edx, edx
test eax, eax
setnle dl
lea edx, dword ptr [edx+edx-01h]
mov eax, edx
test eax, eax
jne 00007F3D0CEAA7DEh
movzx eax, byte ptr [esi+01h]
movzx ecx, byte ptr [ecx+01h]
sub eax, ecx
je 00007F3D0CEAA7D2h
xor ecx, ecx
test eax, eax
setnle cl
lea ecx, dword ptr [ecx+ecx-01h]
mov eax, ecx
ret
xor eax, eax
ret
mov eax, dword ptr [esi]
cmp eax, dword ptr [ecx]
je 00007F3D0CEAA831h
movzx edx, byte ptr [ecx]
movzx eax, al
sub eax, edx
je 00007F3D0CEAA7D3h
xor edx, edx
test eax, eax
setnle dl
lea edx, dword ptr [edx+edx-01h]
mov eax, edx
test eax, eax
jne 00007F3D0CEAA818h
movzx eax, byte ptr [esi+01h]
movzx edx, byte ptr [ecx+01h]
sub eax, edx
je 00007F3D0CEAA7D3h
xor edx, edx
test eax, eax
setnle dl
lea edx, dword ptr [edx+edx-01h]
mov eax, edx
test eax, eax
jne 00007F3D0CEAA7FBh
movzx eax, byte ptr [esi+02h]
movzx edx, byte ptr [ecx+02h]
sub eax, edx
je 00007F3D0CEAA7D3h
xor edx, edx
test eax, eax
setnle dl
lea edx, dword ptr [edx+edx+00h]

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 SP1 build 30729
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd2ec4	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xde000	0x4dfb4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xac630	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xbdfa0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xac000	0x558	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xd2da0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xaaf3e	0xab000	6c7594cb61faecefce315249f2b24199	False	0.5059693096673976	data	6.58572320893553	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xac000	0x28b2c	0x28c00	76a655cd5437e948d551b0926ba6199b	False	0.3869524060582822	data	4.940020702409299	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xd5000	0x87a8	0x2800	baf876a6f50721d2d18b5f322763255f	False	0.308203125	data	4.5804095131540965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xde000	0x4dfb4	0x4e000	e47414611295fed4859f1b816c56d4b4	False	0.3771659655448718	data	6.572290282899665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
GIF	0xdee54	0x5731	GIF image data, version 89a, 175 x 312			1.0007168137628242
GIF	0xe4588	0x6592	GIF image data, version 89a, 175 x 312	English	United States	0.9916544881162987
RT_BITMAP	0xeab1c	0x14220	Device independent bitmap graphic, 220 x 370 x 8, image size 81400			0.34390764454792394
RT_BITMAP	0xfed3c	0x1b5c	Device independent bitmap graphic, 180 x 75 x 4, image size 6900			0.18046830382638493
RT_BITMAP	0x100898	0x38e4	Device independent bitmap graphic, 180 x 75 x 8, image size 13500			0.26689096402087337
RT_BITMAP	0x10417c	0x1238	Device independent bitmap graphic, 60 x 60 x 8, image size 3600			0.23499142367066894
RT_BITMAP	0x1053b4	0x6588	Device independent bitmap graphic, 161 x 152 x 8, image size 24928, resolution 3796 x 3796 px/m, 256 important colors			0.3035934133579563
RT_BITMAP	0x10b93c	0x11f88	Device independent bitmap graphic, 161 x 152 x 24, image size 73568, resolution 3780 x 3780 px/m			0.12790729268557766
RT_ICON	0x11d8c4	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0			0.21341463414634146
RT_ICON	0x11df2c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0			0.34139784946236557
RT_ICON	0x11e214	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0			0.5202702702702703
RT_ICON	0x11e33c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.47334754797441364
RT_ICON	0x11f1e4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.6101083032490975
RT_ICON	0x11fa8c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.596820809248555
RT_ICON	0x11fff4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.2932572614107884
RT_ICON	0x12259c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.4343339587242026
RT_ICON	0x123644	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.7198581560283688
RT_ICON	0x123aac	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.35618279569892475
RT_ICON	0x123d94	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.42473118279569894
RT_DIALOG	0x12407c	0x1fe	data			0.4745098039215686
RT_DIALOG	0x12427c	0x296	data			0.44108761329305135
RT_DIALOG	0x124514	0x2e0	data			0.43342391304347827
RT_DIALOG	0x1247f4	0x64	data			0.68
RT_DIALOG	0x124858	0x42	data			0.8333333333333334
RT_DIALOG	0x12489c	0xe6	data			0.6434782608695652
RT_DIALOG	0x124984	0x124	data			0.5068493150684932
RT_DIALOG	0x124aa8	0xe6	data			0.5826086956521739
RT_DIALOG	0x124b90	0x276	data			0.45396825396825397
RT_DIALOG	0x124e08	0x3d8	data			0.41971544715447157
RT_DIALOG	0x1251e0	0x182	data			0.5233160621761658
RT_DIALOG	0x125364	0x21c	data			0.48148148148148145
RT_DIALOG	0x125580	0x1fa	data			0.5079051383399209
RT_DIALOG	0x12577c	0x222	data			0.4835164835164835
RT_DIALOG	0x1259a0	0x8c	data			0.7285714285714285
RT_DIALOG	0x125a2c	0x3cc	data			0.43209876543209874
RT_DIALOG	0x125df8	0x158	data			0.5494186046511628
RT_DIALOG	0x125f50	0x1ea	data			0.5163265306122449
RT_DIALOG	0x12613c	0x116	data			0.6079136690647482
RT_DIALOG	0x126254	0xee	data			0.6260504201680672
RT_DIALOG	0x126344	0x1d4	data			0.5021367521367521
RT_DIALOG	0x126518	0x1ec	data			0.5142276422764228
RT_DIALOG	0x126704	0x2b8	data			0.4813218390804598
RT_STRING	0x1269bc	0x160	data	English	United States	0.5340909090909091
RT_STRING	0x126b1c	0x23e	data	English	United States	0.40418118466898956
RT_STRING	0x126d5c	0x378	data	English	United States	0.4222972972972973
RT_STRING	0x1270d4	0x252	data	English	United States	0.4393939393939394
RT_STRING	0x127328	0x1f4	data	English	United States	0.442
RT_STRING	0x12751c	0x66c	data	English	United States	0.36253041362530414
RT_STRING	0x127b88	0x366	data	English	United States	0.41379310344827586
RT_STRING	0x127ef0	0x27e	data	English	United States	0.4561128526645768
RT_STRING	0x128170	0x518	data	English	United States	0.39800613496932513
RT_STRING	0x128688	0x882	data	English	United States	0.3002754820936639
RT_STRING	0x128f0c	0x23e	data	English	United States	0.45121951219512196
RT_STRING	0x12914c	0x3ba	data	English	United States	0.3280922431865828
RT_STRING	0x129508	0x12c	data	English	United States	0.5266666666666666
RT_STRING	0x129634	0x4a	data	English	United States	0.6756756756756757
RT_STRING	0x129680	0xda	data	English	United States	0.6100917431192661
RT_STRING	0x12975c	0x110	data	English	United States	0.5845588235294118
RT_STRING	0x12986c	0x20a	data	English	United States	0.4521072796934866
RT_STRING	0x129a78	0xba	Matlab v4 mat-file (little endian) P, numeric, rows 0, columns 0	English	United States	0.5860215053763441
RT_STRING	0x129b34	0xa8	data	English	United States	0.6607142857142857
RT_STRING	0x129bdc	0x12a	data	English	United States	0.5201342281879194
RT_STRING	0x129d08	0x422	data	English	United States	0.2741020793950851
RT_STRING	0x12a12c	0x5c2	data	English	United States	0.37720488466757124
RT_STRING	0x12a6f0	0x40	data	English	United States	0.671875
RT_STRING	0x12a730	0xcaa	data	English	United States	0.2313386798272671
RT_STRING	0x12b3dc	0x284	data	English	United States	0.43788819875776397
RT_GROUP_ICON	0x12b660	0x84	data			0.6363636363636364
RT_GROUP_ICON	0x12b6e4	0x14	data			1.25
RT_GROUP_ICON	0x12b6f8	0x14	data			1.25
RT_VERSION	0x12b70c	0x438	data			0.42962962962962964
RT_MANIFEST	0x12bb44	0x470	XML 1.0 document, ASCII text, with CRLF line terminators			0.46742957746478875

Imports

DLL	Import
VERSION.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
COMCTL32.dll
KERNEL32.dll	FindResourceW, GlobalUnlock, GlobalLock, GlobalFree, GetTickCount, GetExitCodeThread, CreateThread, CopyFileW, InterlockedIncrement, GetVersionExW, CompareStringA, CompareStringW, CreateEventW, InterlockedDecrement, QueryPerformanceFrequency, lstrcatW, GetTempFileNameW, LoadLibraryW, FreeLibrary, GetProcAddress, GetSystemDefaultLangID, GetUserDefaultLangID, lstrcmpW, lstrcmpiW, VerLanguageNameW, FindClose, FindNextFileW, CompareFileTime, FindFirstFileW, MoveFileW, GetPrivateProfileStringW, CreateDirectoryW, SetFileAttributesW, GetSystemTimeAsFileTime, LocalFree, FormatMessageW, GetSystemInfo, MulDiv, RaiseException, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, LoadLibraryExW, GetModuleHandleW, GetVersion, GetLocalTime, IsValidLocale, GetFileAttributesW, GetCommandLineW, lstrcmpiA, SetEndOfFile, lstrcpyA, VirtualQuery, IsBadReadPtr, FlushFileBuffers, GetDriveTypeW, GetLocaleInfoW, GetCurrentThread, GetDiskFreeSpaceW, GetExitCodeProcess, GetModuleFileNameW, InterlockedExchange, LoadLibraryA, LoadResource, SetStdHandle, GetTimeZoneInformation, GetConsoleMode, GetConsoleCP, LCMapStringA, InitializeCriticalSectionAndSpinCount, SetThreadContext, GetStringTypeW, GetStringTypeA, EnumSystemLocalesA, GetLocaleInfoA, GetUserDefaultLCID, GetDateFormatA, GetTimeFormatA, GetStartupInfoA, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapDestroy, HeapCreate, HeapReAlloc, VirtualAlloc, VirtualFree, FatalAppExitA, GetModuleHandleA, LCMapStringW, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, HeapSize, GetCurrentThreadId, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, GetModuleFileNameA, GetStdHandle, GetStartupInfoW, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlUnwind, lstrcpynA, lstrcmpA, lstrlenW, SearchPathW, VirtualProtect, SystemTimeToFileTime, QueryPerformanceCounter, SetEvent, ResetEvent, GetCurrentProcessId, GetDateFormatW, GetTimeFormatW, GetCurrentDirectoryW, FindResourceExW, TerminateProcess, OpenProcess, GetProcessTimes, lstrcpynW, GetProcessHeap, HeapAlloc, SizeofResource, GlobalAlloc, LockResource, ExpandEnvironmentStringsW, GetTempPathW, SetErrorMode, GetWindowsDirectoryW, lstrcpyW, GetSystemDirectoryW, SetCurrentDirectoryW, CreateProcessW, WaitForSingleObject, DeleteFileW, RemoveDirectoryW, Sleep, ExitProcess, GetCurrentProcess, DuplicateHandle, GetThreadContext, VirtualProtectEx, WriteProcessMemory, FlushInstructionCache, HeapFree, WriteFile, ReadFile, SetFilePointer, MultiByteToWideChar, WideCharToMultiByte, CreateFileW, GetFileSize, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, CloseHandle, lstrlenA, GetLastError, SetLastError, SetConsoleCtrlHandler, ResumeThread, SetEnvironmentVariableA, CreateFileA, WriteConsoleW, LocalAlloc, WriteConsoleA, GetConsoleOutputCP
USER32.dll	wvsprintfW, CharUpperW, ExitWindowsEx, SendDlgItemMessageW, CharPrevW, LoadImageW, CreateDialogParamW, MoveWindow, SetCursor, GetDlgItemTextW, GetWindow, SetFocus, EnableWindow, SetDlgItemTextW, SetForegroundWindow, SetActiveWindow, GetDlgCtrlID, GetDC, GetSysColor, GetSysColorBrush, SendMessageW, IsDialogMessageW, GetWindowRect, GetSystemMetrics, SetRect, FindWindowW, IntersectRect, SubtractRect, IsWindow, DestroyWindow, CreateDialogIndirectParamW, CharNextW, MessageBoxW, WaitForInputIdle, GetWindowLongW, SetWindowLongW, GetClientRect, ClientToScreen, SetWindowPos, GetWindowDC, ReleaseDC, EndPaint, BeginPaint, EndDialog, SetWindowTextW, GetDlgItem, ShowWindow, DialogBoxIndirectParamW, GetDesktopWindow, MsgWaitForMultipleObjects, PeekMessageW, wsprintfW, LoadIconW, LoadCursorW, RegisterClassW, CreateWindowExW, GetMessageW, TranslateMessage, DispatchMessageW, DefWindowProcW, PostMessageW, KillTimer, PostQuitMessage, SetTimer, FillRect
GDI32.dll	GetDIBColorTable, GetSystemPaletteEntries, CreatePalette, CreateHalftonePalette, UnrealizeObject, SelectPalette, RealizePalette, CreateFontW, SetBkMode, SetTextColor, GetObjectW, GetDeviceCaps, CreateFontIndirectW, CreateSolidBrush, CreateCompatibleDC, SelectObject, BitBlt, CreateDIBitmap, DeleteDC, DeleteObject, GetStockObject, TranslateCharsetInfo
ADVAPI32.dll	RegEnumKeyW, OpenThreadToken, OpenProcessToken, GetTokenInformation, AllocateAndInitializeSid, EqualSid, FreeSid, InitializeSecurityDescriptor, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, SetSecurityDescriptorDacl, RegEnumKeyExW, RegQueryInfoKeyW, RegDeleteKeyW, RegEnumValueW, RegSetValueExW, RegCreateKeyExW, RegDeleteValueW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, RegOpenKeyW, RegCreateKeyW, LookupPrivilegeValueW, AdjustTokenPrivileges
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetMalloc, SHGetSpecialFolderLocation, ShellExecuteExW, ShellExecuteW, CommandLineToArgvW
ole32.dll	CoTaskMemFree, CoTaskMemRealloc, CoTaskMemAlloc, CLSIDFromProgID, CoInitialize, CoCreateGuid, CreateItemMoniker, GetRunningObjectTable, StringFromGUID2, ProgIDFromCLSID, CoUninitialize, CoInitializeSecurity, CoCreateInstance
OLEAUT32.dll	VariantClear, VarBstrFromDate, SysStringByteLen, SysAllocStringByteLen, SysAllocString, VarBstrCat, GetErrorInfo, VarUI4FromStr, SystemTimeToVariantTime, CreateErrorInfo, SysStringLen, SysReAllocStringLen, LoadTypeLib, RegisterTypeLib, SetErrorInfo, VariantChangeType, SysFreeString, SysAllocStringLen
RPCRT4.dll	UuidCreate, RpcStringFreeW, UuidToStringW, UuidFromStringW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	02:10:45
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SW-GX-3R(EX)_06293_setup.exe"
Imagebase:	0x400000
File size:	31'250'995 bytes
MD5 hash:	5E1E66319CACE2EA52F37E9F025E40FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:10:51
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Downloaded Installations\{7DED6250-9973-44A8-BFD0-71491CF41AEA}\GX-3R.msi" SETUPEXEDIR="C:\Users\user\Desktop" SETUPEXENAME="SW-GX-3R(EX)_06293_setup.exe"
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:10:51
Start date:	23/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6902e0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:10:51
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 965794F20A6A7A4389D97787515D8009 C
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:11:14
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding A68C3EFAC0AEFE0BC0AA104F747B6A98
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:11:17
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 588624F03B769A27B304CA4FE9239E00 M Global\MSI0000
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:11:17
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexch35.dll"
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:11:17
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexcl35.dll"
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:11:17
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjet35.dll"
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:11:17
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjt4jlt.dll"
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:11:17
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msltus35.dll"
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:11:17
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mspdox35.dll"
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:11:18
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msrd2x35.dll"
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:11:18
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mstext35.dll"
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:11:18
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msxbse35.dll"
Imagebase:	0x950000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	72

Executed Functions

Function 0043E15A Relevance: 90.6, APIs: 26, Strings: 25, Instructions: 1394COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0043E1AE

Part of subcall function 00444B64: GetVersionExW.KERNEL32(?), ref: 00444B88

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000104), ref: 0043E21B
_memset.LIBCMT ref: 0043E280
GetCommandLineW.KERNEL32(?), ref: 0043E295
CommandLineToArgvW.SHELL32(00000000), ref: 0043E29C

Part of subcall function 0043C6DF: __EH_prolog3.LIBCMT ref: 0043C6E9
Part of subcall function 0043C6DF: _memset.LIBCMT ref: 0043C712
Part of subcall function 0043C6DF: _memset.LIBCMT ref: 0043C72F
Part of subcall function 0043C6DF: _memset.LIBCMT ref: 0043C749
Part of subcall function 0043C6DF: _memset.LIBCMT ref: 0043C763
Part of subcall function 0043C6DF: _memset.LIBCMT ref: 0043C77D
Part of subcall function 0043C6DF: _memset.LIBCMT ref: 0043C797
Part of subcall function 0043C6DF: InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 0043C7A5
Part of subcall function 0043C6DF: GetModuleHandleW.KERNEL32(Advapi32,CreateWellKnownSid), ref: 0043C7C3
Part of subcall function 0043C6DF: GetProcAddress.KERNEL32(00000000), ref: 0043C7C6

Part of subcall function 0043D353: __EH_prolog3.LIBCMT ref: 0043D35A

Part of subcall function 0043DC84: __EH_prolog3.LIBCMT ref: 0043DC8B

CoUninitialize.COMBASE(00000000,?,?), ref: 0043E502

Strings

Running as remove major upgrade, xrefs: 0043E603
ISSetup.dll, xrefs: 0043EDF8
E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\Setup.cpp, xrefs: 0043E3B1, 0043E416, 0043E5EA, 0043F34C, 0043F58A
setup.isn, xrefs: 0043EF15
%s\%04x.mst, xrefs: 0043F167, 0043F194
Setup returning %d, xrefs: 0043F584
%s%s, xrefs: 0043E782
reboot, xrefs: 0043E3E9
runfromtemp, xrefs: 0043E3D9
count, xrefs: 0043F006
Skin, xrefs: 0043EEEF
Languages, xrefs: 0043F00B, 0043F059
%s /q"%s" /tempdisk1folder"%s" %s, xrefs: 0043F2EC
%s\0x%04x.ini, xrefs: 0043F09F, 0043F0CC
Running after reboot, xrefs: 0043E42F
debuglog, xrefs: 0043E2E9
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 0043E276, 0043EA2A, 0043F254
%s %s, xrefs: 0043E6F3
tempdisk1folder, xrefs: 0043E907
InstallShield setup.exe (Unicode) started, cmdline: %s, xrefs: 0043E3AB
ISSetup.dll, xrefs: 0043ED97
key%d, xrefs: 0043F03E
removeasmajorupgrade, xrefs: 0043E5B0
Relaunching setup from temp, xrefs: 0043F366
Startup, xrefs: 0043EEF4

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$H_prolog3$CommandInitializeLineModule$AddressArgvDescriptorFileHandleNameProcSecurityUninitializeVersion
String ID: %s %s$%s /q"%s" /tempdisk1folder"%s" %s$%s%s$%s\%04x.mst$%s\0x%04x.ini$C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\Setup.cpp$ISSetup.dll$ISSetup.dll$InstallShield setup.exe (Unicode) started, cmdline: %s$Languages$Relaunching setup from temp$Running after reboot$Running as remove major upgrade$Setup returning %d$Skin$Startup$count$debuglog$key%d$reboot$removeasmajorupgrade$runfromtemp$setup.isn$tempdisk1folder
API String ID: 3841865988-2412288663
Opcode ID: 3bb954b707224dcfa1cc4275823e014d1894c02e7aa19c331e2ae6327ac39d6c
Instruction ID: d40286dd32ad08b6dba93b08a9d22a2d4c5ca5bf70b6206142633b1d0498c2a1
Opcode Fuzzy Hash: 3bb954b707224dcfa1cc4275823e014d1894c02e7aa19c331e2ae6327ac39d6c
Instruction Fuzzy Hash: 96D2C27180118CEEDF21EFA5CD55BEE7B78AF15308F44406EE4096B192DB785B08CB69

Function 0042C448 Relevance: 74.6, APIs: 10, Strings: 32, Instructions: 1091librarystringloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F5AC: __EH_prolog3.LIBCMT ref: 0040F5B3

Part of subcall function 0043791D: __EH_prolog3_GS.LIBCMT ref: 00437924

_memset.LIBCMT ref: 0042C59B
_memset.LIBCMT ref: 0042C5B2
_memset.LIBCMT ref: 0042C6FF
wsprintfW.USER32 ref: 0042C728

Part of subcall function 00415B3A: _wcslen.LIBCMT ref: 00415B41

___FUnloadDelayLoadedDLL2@4.DELAYIMP ref: 0042CC6A
lstrlenW.KERNEL32(?,-00000008,?,?,?,?,00000007,80C21959,?,00000000,00000001), ref: 0042C5FE

Part of subcall function 00407126: _wcslen.LIBCMT ref: 0040712D

LoadLibraryW.KERNEL32(?,?,00000642,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0042D090
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0042D154
GetProcAddress.KERNEL32(00000000,ISExternalUIInstall), ref: 0042D0AB

Part of subcall function 0041E68E: IsWindow.USER32(0042D218), ref: 0041E694
Part of subcall function 0041E68E: ShowWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0041E6A6

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0042D224

Strings

ISExternalUI.dll, xrefs: 0042D00C
MsiAction::InstallMsi - calling Reboot, xrefs: 0042CB08
ISExternalUIInstall, xrefs: 0042D0A5
%s /i "%s" %s, xrefs: 0042C86E
%s /p "%s" %s, xrefs: 0042C8B2
/qb, xrefs: 0042CF05
First time install uses billboard support, xrefs: 0042CFC6
E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 0042CAEF, 0042CBEB, 0042CC79, 0042CF79, 0042CFB1, 0042D194, 0042D265
/qn, xrefs: 0042CF1D
SETUPEXEDIR, xrefs: 0042C717
%s /j%s "%s" %s, xrefs: 0042C9E1
ProductCode, xrefs: 0042CD33
/p"%s" %s, xrefs: 0042C903
/passive, xrefs: 0042CF47
ISSCRIPTCMDLINE, xrefs: 0042C628
Attempted unloaded of msi.dll: %d, xrefs: 0042CC73
ISSCRIPTCMDLINE=", xrefs: 0042C680
Failed to get UI DLL from setup.exe for billboard support. This installation will run without billboards., xrefs: 0042D1A9
Loading ISExternalUI.dll from '%s', xrefs: 0042D062
Failed to locate ISSetup.dll (%s), xrefs: 0042CBE5
%s /a "%s"%s, xrefs: 0042CAB6
%s /f%s "%s" %s, xrefs: 0042CA5A
%s /x "%s" %s, xrefs: 0042C978
msi.dll, xrefs: 0042CC65
/quiet, xrefs: 0042CF32
/t , xrefs: 0042C7A7
Failed to load UI DLL, last error %x, install will run without billboards, xrefs: 0042D15E
SETUPEXENAME, xrefs: 0042C70B
TRANSFORMS=, xrefs: 0042C7C1
Disabling WOW64 file system redirection to prevent issues with 64-bit MSI packages (costing error 2324), xrefs: 0042D27A
%s="%s" %s="%s", xrefs: 0042C722
Startup, xrefs: 0042CD4C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$TimeWindow_wcslen$AddressDelayErrorFileH_prolog3H_prolog3_L2@4LastLibraryLoadLoadedProcShowSystemUnloadlstrlenwsprintf
String ID: %s /a "%s"%s$%s /f%s "%s" %s$%s /i "%s" %s$%s /j%s "%s" %s$%s /p "%s" %s$%s /x "%s" %s$%s="%s" %s="%s"$/p"%s" %s$/passive$/qb$/qn$/quiet$/t $Attempted unloaded of msi.dll: %d$Disabling WOW64 file system redirection to prevent issues with 64-bit MSI packages (costing error 2324)$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$Failed to get UI DLL from setup.exe for billboard support. This installation will run without billboards.$Failed to load UI DLL, last error %x, install will run without billboards$Failed to locate ISSetup.dll (%s)$First time install uses billboard support$ISExternalUI.dll$ISExternalUIInstall$ISSCRIPTCMDLINE$ISSCRIPTCMDLINE="$Loading ISExternalUI.dll from '%s'$MsiAction::InstallMsi - calling Reboot$ProductCode$SETUPEXEDIR$SETUPEXENAME$Startup$TRANSFORMS=$msi.dll
API String ID: 3529244496-3995820057
Opcode ID: c3eeab3c61cf2a75c4ea02e969a3c55aed1bb11fc0decadeefa32ebbc9903549
Instruction ID: 531089ae007044de52f12f077c7c43eaed9768f3627a5ab35d3b48b2e3cd7e65
Opcode Fuzzy Hash: c3eeab3c61cf2a75c4ea02e969a3c55aed1bb11fc0decadeefa32ebbc9903549
Instruction Fuzzy Hash: 42A2F271A00258EFDF20DF94DC85BEE77B8AF15304F54406BE405AB291DB789B48CBA9

Function 0043C6DF Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 243
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0043C6E9
_memset.LIBCMT ref: 0043C712
_memset.LIBCMT ref: 0043C72F
_memset.LIBCMT ref: 0043C749
_memset.LIBCMT ref: 0043C763
_memset.LIBCMT ref: 0043C77D
_memset.LIBCMT ref: 0043C797
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 0043C7A5
GetModuleHandleW.KERNEL32(Advapi32,CreateWellKnownSid), ref: 0043C7C3
GetProcAddress.KERNEL32(00000000), ref: 0043C7C6
GetModuleHandleW.KERNEL32(advapi32,SetEntriesInAclW), ref: 0043C944
GetProcAddress.KERNEL32(00000000), ref: 0043C947
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 0043C980
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 0043C996
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0043C9AA
CoInitializeSecurity.COMBASE(?,000000FF,00000000,00000000,00000006,00000002,00000000,00002000,00000000), ref: 0043C9C6

Strings

Advapi32, xrefs: 0043C7BE
CreateWellKnownSid, xrefs: 0043C7B9
advapi32, xrefs: 0043C8B5
SetEntriesInAclW, xrefs: 0043C8A4

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$Security$Descriptor$AddressHandleInitializeModuleProc$DaclGroupH_prolog3Owner
String ID: Advapi32$CreateWellKnownSid$SetEntriesInAclW$advapi32
API String ID: 3927332225-1508711180
Opcode ID: 0e897cd5044921b13b9dec6c9624f499905d7bec6b8de66cec20ff0b3d7c8024
Instruction ID: 1c179c7b77e7089f5d6ef9545f72bbe66c9b99922218a951247329d37f8a7d1b
Opcode Fuzzy Hash: 0e897cd5044921b13b9dec6c9624f499905d7bec6b8de66cec20ff0b3d7c8024
Instruction Fuzzy Hash: 16A1C8B1D0122DAEDB20DFA5CC85BEEBBB8BF09700F5045AAE119F6240D7745A84CF65

Function 004097D1 Relevance: 19.6, APIs: 13, Instructions: 110
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(?,00000000), ref: 004097EB
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0040980E
HeapAlloc.KERNEL32(00000000), ref: 00409811
ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00409833
lstrlenA.KERNEL32(00000000), ref: 00409842
__alloca_probe_16.LIBCMT ref: 0040985A
GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 00409877
HeapFree.KERNEL32(00000000), ref: 0040987A
GetProcessHeap.KERNEL32(00000008,00000003), ref: 0040988A
HeapAlloc.KERNEL32(00000000), ref: 0040988D
ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 004098AB
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004098C9
HeapFree.KERNEL32(00000000), ref: 004098CC

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Heap$Process$File$AllocFreeRead$Size__alloca_probe_16lstrlen
String ID:
API String ID: 3453809332-0
Opcode ID: 5c96bea8a422aaa37f33992a11c1527653e36e647af606de18147db6dc1a46e6
Instruction ID: 0e86db69d5c6c4827ea6ab64851db035da6fb5e14928f81f1d494c1ad0476a77
Opcode Fuzzy Hash: 5c96bea8a422aaa37f33992a11c1527653e36e647af606de18147db6dc1a46e6
Instruction Fuzzy Hash: 86317472610205BBDB10ABA5CC89FAB7BACEB4A354F008439F905EB2D1DA749D04CB65

Function 0042217D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 122filetimeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042219C
_memset.LIBCMT ref: 004221BF
GetTempPathW.KERNEL32(00000400,?,?,?,0000003C), ref: 004221D3
FindFirstFileW.KERNELBASE(?,?,?,?,?,0000003C), ref: 00422250
CompareFileTime.KERNEL32(?,?,00000000,?,?,?,?,0000003C), ref: 0042226D
DeleteFileW.KERNEL32(?,?,?,?,?,?,0000003C), ref: 004222DA
FindNextFileW.KERNEL32(000000FF,00000000,?,?,?,?,0000003C), ref: 004222F6

Strings

*.mst, xrefs: 004221FA

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$Find$CompareDeleteFirstH_prolog3NextPathTempTime_memset
String ID: *.mst
API String ID: 4075916226-516677590
Opcode ID: 7b4b954dd40aa5b92bad554b3ab37b09cb7fef51f55cd68f2ec4b1c47d6caf1f
Instruction ID: 24824e56d334abcf567bbd60ed747fcfd85b895ed247396cbfd52b30e3a1dad8
Opcode Fuzzy Hash: 7b4b954dd40aa5b92bad554b3ab37b09cb7fef51f55cd68f2ec4b1c47d6caf1f
Instruction Fuzzy Hash: 70518131501288EFDB60EF94DD89FEE7778AF15304F40416AE505AB1A1EB745B08CB65

Function 00441F61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 97librarystringloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KERNEL32,?,00000000,00000001,?,0041FB35,?,?), ref: 00441F9B
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExW), ref: 00441FB2
lstrcpyW.KERNEL32(?,?,?,0041FB35,?,?), ref: 00441FC4

Part of subcall function 00441823: CharNextW.USER32(?,00441FD3,?,?,0041FB35,?,?), ref: 0044182E

GetDiskFreeSpaceExW.KERNELBASE(?,?,?,?,?,?,0041FB35,?,?), ref: 00441FF0

Part of subcall function 00441D16: CharNextW.USER32(?,?,?,?,00441DA7,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441D2C
Part of subcall function 00441D16: CharPrevW.USER32(?,?,?,?,?,00441DA7,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441D36
Part of subcall function 00441D16: CharNextW.USER32(00000000,?,?,?,?,00441DA7,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441D4F

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?,0041FB35,?,?), ref: 00442052
FreeLibrary.KERNEL32(?,?,0041FB35,?,?), ref: 00442076

Strings

GetDiskFreeSpaceExW, xrefs: 00441FAC
KERNEL32, xrefs: 00441F91

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Char$FreeNext$DiskLibrarySpace$AddressLoadPrevProclstrcpy
String ID: GetDiskFreeSpaceExW$KERNEL32
API String ID: 2811192779-2151859404
Opcode ID: 1b67f5718d365187dc3555cf7739f73037076aa6b00d28b71935f9c3d01d54a6
Instruction ID: f588101955d2a862bf3f22a72d31a33ad260d0db3ed0f266f0dc343e6d1e249a
Opcode Fuzzy Hash: 1b67f5718d365187dc3555cf7739f73037076aa6b00d28b71935f9c3d01d54a6
Instruction Fuzzy Hash: 5D41F97690024D9BDB20DFE4CD84AEEB7B8FF08300F14052AE519EB215D778AA45CF64

Function 00440295 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 118fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044029C
VirtualQuery.KERNEL32(?,?,0000001C,00000054,0044040B,?,?,00000000,0044062A,?,?,00000409,?,00000010,004406AC,?), ref: 004402D8
GetSystemInfo.KERNELBASE(?,?,?,0000001C,00000054,0044040B,?,?,00000000,0044062A,?,?,00000409,?,00000010,004406AC), ref: 0044036D
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,?,?,?,?,?,0000001C,00000054,0044040B,?,?,00000000,0044062A,?), ref: 0044038C

Part of subcall function 0043FA98: CompareStringA.KERNELBASE(00000400,00000001,?,00000008,0044062A,000000FF,?,?,004402F2,.debug,?,?,0000001C,00000054,0044040B,?), ref: 0043FABA

Strings

.debug, xrefs: 004402E8
.rdata, xrefs: 0044030A
.text, xrefs: 0044031B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CompareFileH_prolog3InfoQueryStringSystemViewVirtual
String ID: .debug$.rdata$.text
API String ID: 3690134103-733372908
Opcode ID: d4fe69a21421aaed95e741915e711de36fe2ba78076eb86ed8fbdb4ed8bf5b08
Instruction ID: 3cc63de286f74f05355f9e35420027bb937ebe9d0ace5542f0f2376cc64ee4e9
Opcode Fuzzy Hash: d4fe69a21421aaed95e741915e711de36fe2ba78076eb86ed8fbdb4ed8bf5b08
Instruction Fuzzy Hash: AC418431E0021A8FEB14DFA5C8456AEB7B1BF44314F15406EE915E7391EB78ED01CB98

Function 004177BA Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?), ref: 004177CB
SizeofResource.KERNEL32(?,00000000), ref: 004177D7
LoadResource.KERNEL32(?,00000000), ref: 004177E3
LockResource.KERNEL32(00000000), ref: 004177EA

Part of subcall function 00417587: __EH_prolog3.LIBCMT ref: 00417591
Part of subcall function 00417587: GetWindowDC.USER32(00000000), ref: 0041766B
Part of subcall function 00417587: CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 00417684
Part of subcall function 00417587: ReleaseDC.USER32(00000000,00000000), ref: 00417695

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Resource$BitmapCreateFindH_prolog3LoadLockReleaseSizeofWindow
String ID:
API String ID: 2954183908-0
Opcode ID: b6ebe427446e1eac1ae6d5c6b290c5c6ed6510515bc026f82da368bb762406d2
Instruction ID: 719081caa33656e657abdf6e9577afa542e34bf5af8655f6f65eb7b62454f027
Opcode Fuzzy Hash: b6ebe427446e1eac1ae6d5c6b290c5c6ed6510515bc026f82da368bb762406d2
Instruction Fuzzy Hash: 4DE0E577505118BFDB511F95DC8CCEF3F6EEB5A2A17004425F90586120C6764D51DBB4

Function 00432A7F Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00432AB8
GetSystemInfo.KERNELBASE(?), ref: 00432AEC

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: InfoSystemVersion
String ID:
API String ID: 1934062620-0
Opcode ID: a931f9ef4d1bf5bd8f77312a65818d986a02400c3b91ee98ac29a9375867d120
Instruction ID: f5f29541818a2601ed323ee1ccef628d64d1c9d603461f2a4ed11cb0ed57aabe
Opcode Fuzzy Hash: a931f9ef4d1bf5bd8f77312a65818d986a02400c3b91ee98ac29a9375867d120
Instruction Fuzzy Hash: 7D21C370D0025C8BCB24DFE5D9447AEFBB4FB08309F14402BE416AB284E7B86946DF69

Function 0041EB1C Relevance: 73.9, APIs: 41, Strings: 1, Instructions: 356
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0041EB35
SetBkMode.GDI32(?,00000001), ref: 0041EBA1
GetDlgCtrlID.USER32(?), ref: 0041EBA8
GetStockObject.GDI32(00000005), ref: 0041EBCF
SendMessageW.USER32(00000405,00000000,00000000,00000078), ref: 0041EBFE
PostMessageW.USER32(00000000,00008032,00000000,00000000), ref: 0041EC52
SetWindowTextW.USER32(?,-00000008), ref: 0041ECAB
SetTimer.USER32(?,000003E9,000000FA,00000000), ref: 0041ECCD
GetDlgItem.USER32(?,000003E9), ref: 0041ECDB
GetDlgItem.USER32(?,000003EB), ref: 0041ECE6
GetDlgItem.USER32(?,0000012D), ref: 0041ECF1
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 0041ED00
GetDlgItem.USER32(?,000003EE), ref: 0041ED52
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 0041ED5C
GetObjectW.GDI32(00000000,0000005C,?), ref: 0041ED6E
GetDC.USER32(000000FF), ref: 0041ED77
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041ED83
ReleaseDC.USER32(000000FF,?), ref: 0041ED9B
GetDlgItem.USER32(?,00000409), ref: 0041EEFA
GetClientRect.USER32(00000000,?), ref: 0041EF0B
GetClientRect.USER32(?,?), ref: 0041EF12
GetStockObject.GDI32(00000000), ref: 0041EF2A
FillRect.USER32(?,?,00000000), ref: 0041EF3E
GetSysColor.USER32(0000000F), ref: 0041EF42
GetSysColorBrush.USER32(00000000), ref: 0041EF4C
CreateSolidBrush.GDI32(?), ref: 0041EF5B
FillRect.USER32(?,?,00000000), ref: 0041EF80
DeleteObject.GDI32(00000000), ref: 0041EF83
DeleteObject.GDI32(00000078), ref: 0041EF9A
DeleteObject.GDI32 ref: 0041EFAB
DeleteObject.GDI32 ref: 0041EFB3
DeleteObject.GDI32 ref: 0041EFBB

Strings

Tahoma, xrefs: 0041EDB0, 0041EE2A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Object$DeleteItem$MessageRect$Send$BrushClientColorFillStock$CapsCreateCtrlDeviceH_prolog3ModePostReleaseSolidTextTimerWindow
String ID: Tahoma
API String ID: 3653334742-3580928618
Opcode ID: a70944430ddaeff5e0e54fe3b43715070e1156f3ae70465c565e438021cdd7bf
Instruction ID: ae61c13bab871fdc6a0bd66710f400e10f43cd54976df51d2bd770c8e3fb0b7c
Opcode Fuzzy Hash: a70944430ddaeff5e0e54fe3b43715070e1156f3ae70465c565e438021cdd7bf
Instruction Fuzzy Hash: ABD16D75941248FFDB019FA5DC89EAE7BB8FB09701F00402BF905E62A0D7789D81DB59

Function 0042689E Relevance: 51.8, APIs: 13, Strings: 16, Instructions: 1046
filelibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00421D14: __EH_prolog3.LIBCMT ref: 00421D1B

Part of subcall function 00439D2C: __EH_prolog3_GS.LIBCMT ref: 00439D33

LoadLibraryW.KERNELBASE(SHFolder.dll,?,00000000,00000000,?,?,?,00000000,?,000000FE,0000000A,?,80C21959,?,00000000,00000001), ref: 00426A84
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00426AF1
CopyFileW.KERNELBASE(?,?,00000001), ref: 00426F42
GetLastError.KERNEL32 ref: 00426F4C

Part of subcall function 00425B2C: _memset.LIBCMT ref: 00425BD5
Part of subcall function 00425B2C: _memset.LIBCMT ref: 00425BE1
Part of subcall function 00425B2C: SHBrowseForFolderW.SHELL32(?), ref: 00425C3A
Part of subcall function 00425B2C: SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00425C5E
Part of subcall function 00425B2C: SHGetMalloc.SHELL32(00000000), ref: 00425C68

FreeLibrary.KERNELBASE(?,?,?,?,00000000,00000001), ref: 00426C2A

Part of subcall function 00425B2C: __EH_prolog3.LIBCMT ref: 00425B4E

CopyFileW.KERNEL32(?,?,00000000,?,?,0000000A,00000001), ref: 004271B1
CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,00000000,00000000), ref: 00427329
CopyFileW.KERNEL32(?,?,00000000,?,?,?,004DAE98), ref: 00427423
CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI,?,00000000,?,?,00000000,?,?,?,?,004DAE98), ref: 004274AB

Part of subcall function 004415C9: lstrcpyW.KERNEL32(?,?,?,?,?), ref: 004415FC
Part of subcall function 004415C9: _wcsrchr.LIBCMT ref: 00441607
Part of subcall function 004415C9: _wcsrchr.LIBCMT ref: 0044161D
Part of subcall function 004415C9: CharNextW.USER32(00000000,?,?), ref: 0044162B
Part of subcall function 004415C9: lstrcpyW.KERNEL32(?,?,?,?), ref: 00441644
Part of subcall function 004415C9: lstrcpyW.KERNEL32(?,?,?,?), ref: 00441652

Part of subcall function 00441D63: lstrlenW.KERNEL32(?,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441D6B
Part of subcall function 00441D63: lstrcpynW.KERNEL32(?,?,-00000001,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441D8D
Part of subcall function 00441D63: lstrcatW.KERNEL32(?,?,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441DAD

MoveFileW.KERNEL32(?,?), ref: 004276D8
GetLastError.KERNEL32(?,?,?,00000005,?,?,?,?,?,?,?,?,?,?,00000005), ref: 004276EC
CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000005), ref: 00427714
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000005), ref: 00427721

Strings

Failed to cache file, last error %d, prompting for alternate location, xrefs: 0042700C
.ini, xrefs: 00427299
Caching transform %s to %s, xrefs: 0042716F
Copying file for cache to %s, xrefs: 00426EC0
Caching skin %s to %s, xrefs: 004273DB
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 004270D4, 00427662
SHGetFolderPathW, xrefs: 00426AEB
CacheRoot, xrefs: 00426909
Move failed, attempting to copy and delete file, last error %d, xrefs: 004276F6
SHFolder.dll, xrefs: 00426A7F
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI, xrefs: 00427471, 00427476, 004274AA
E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 00426EC6, 00427012, 00427175, 004272F3, 004273E1, 0042747C, 004276B2
Moving file %s to %s, xrefs: 004276AD
Caching ini file %s to %s, xrefs: 004272E9, 004272F1, 0042747A
CacheFolder, xrefs: 004269DC
Cab%d, xrefs: 00427520

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$Copy$lstrcpy$ErrorH_prolog3LastLibrary_memset_wcsrchr$AddressBrowseCharDeleteFolderFreeFromH_prolog3_ListLoadMallocMoveNextPathProclstrcatlstrcpynlstrlen
String ID: .ini$C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI$Cab%d$CacheFolder$CacheRoot$Caching ini file %s to %s$Caching skin %s to %s$Caching transform %s to %s$Copying file for cache to %s$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$Failed to cache file, last error %d, prompting for alternate location$Move failed, attempting to copy and delete file, last error %d$Moving file %s to %s$SHFolder.dll$SHGetFolderPathW
API String ID: 3780194168-4218294291
Opcode ID: 9e5b6c0f1be5df698586e372779567e35711e89ec6f59fa864f9a663ed248863
Instruction ID: 99ea42b27af60bc6857adef2a5ace4d151ff6095b5e0e878d52d0961d5410483
Opcode Fuzzy Hash: 9e5b6c0f1be5df698586e372779567e35711e89ec6f59fa864f9a663ed248863
Instruction Fuzzy Hash: C5A2927190028CEFDF21EFA5CD45BDE77A8AF15304F54406EE809AB192DB785B08CB69

Function 0042A945 Relevance: 48.4, APIs: 7, Strings: 20, Instructions: 1135windowstringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0042A967

Part of subcall function 004378CA: __EH_prolog3.LIBCMT ref: 004378D1

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 0042ADB0
_memset.LIBCMT ref: 0042B000
lstrcmpiW.KERNEL32(-00000008,?,?,-00000008,PackageCode,?,00000032,?,00000000,00000000,00000138), ref: 0042B0BB
SendMessageW.USER32(?,00000401,00000000,00000001), ref: 0042AC02

Part of subcall function 0042A53C: __EH_prolog3.LIBCMT ref: 0042A558

Strings

PackageCode, xrefs: 0042B04B
Attempting to get file '%s' for MSI engine install, xrefs: 0042AC1E
Got file '%s' for MSI engine install, xrefs: 0042ADDE
yes, xrefs: 0042B8CE, 0042B8E8
Reboot not suppressed, SuppressReboot not set and MSI installed, xrefs: 0042B667
InstallSource, xrefs: 0042B1CA
SuppressReboot, xrefs: 0042B49D, 0042B4A2, 0042B513
WindowsInstaller-KB893803-x86.exe, xrefs: 0042AB9A
Attempting to get MSI 3.0 redist instead, xrefs: 0042ACFB
Reboot not suppressed, SuppressReboot set to N, xrefs: 0042B6C9
SuppressReboot set to Yes or MSI not being installed, suppressing reboot, xrefs: 0042B5DE
E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 0042AAC9, 0042AACE, 0042AB1D, 0042AC78, 0042ACE6, 0042AEFA, 0042B5C5, 0042B64E, 0042B6B0, 0042B745, 0042B8DA
Delaying redist reboot..., xrefs: 0042B75E
PackageName, xrefs: 0042B152
instmsi30.exe, xrefs: 0042AD45
Reboot needed: %s, xrefs: 0042B8E9
MSI 3.1 needs to be installed, but is not available, xrefs: 0042AF13
MSI 3.1 to be installed, was not installed with redist package, xrefs: 0042AAE0
Failed to get file, xrefs: 0042AC8A
Startup, xrefs: 0042B4B7, 0042B4BC, 0042B52C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3MessageSend$H_prolog3_catch_memsetlstrcmpi
String ID: Attempting to get MSI 3.0 redist instead$Attempting to get file '%s' for MSI engine install$Delaying redist reboot...$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$Failed to get file$Got file '%s' for MSI engine install$InstallSource$MSI 3.1 needs to be installed, but is not available$MSI 3.1 to be installed, was not installed with redist package$PackageCode$PackageName$Reboot needed: %s$Reboot not suppressed, SuppressReboot not set and MSI installed$Reboot not suppressed, SuppressReboot set to N$Startup$SuppressReboot$SuppressReboot set to Yes or MSI not being installed, suppressing reboot$WindowsInstaller-KB893803-x86.exe$instmsi30.exe$yes
API String ID: 2733055128-4146643219
Opcode ID: 20f380c9950feb05e8fe06684e049f4f0012daebfc00354cb577eba920fd3cf4
Instruction ID: 36f8ddd14095c9629d7ee6359b6ace1471b790da8e95b856d9198783d52793bc
Opcode Fuzzy Hash: 20f380c9950feb05e8fe06684e049f4f0012daebfc00354cb577eba920fd3cf4
Instruction Fuzzy Hash: 1BA2E47090025CEFDF20EBA0DD95BEE7BB8AF15304F4440AEE505A7192DB785E48CB69

Function 00411F1F Relevance: 37.4, APIs: 1, Strings: 20, Instructions: 623
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00411F3E

Part of subcall function 00458474: __EH_prolog3.LIBCMT ref: 0045847B

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 004584FE: __EH_prolog3.LIBCMT ref: 00458520

Strings

ProductCode, xrefs: 00412097
LauncherName, xrefs: 0041258B
setup.exe, xrefs: 00412570
Product, xrefs: 0041203C
CompanyURL, xrefs: 004123A9
SplashTime, xrefs: 004121C2
ScriptDriven, xrefs: 00411FDB
InstallGUID, xrefs: 00412512
CheckMD5, xrefs: 004122D4
ErrorReportURL, xrefs: 0041249B
ShowPasswordDialog, xrefs: 00412292
http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d : 0x%x&ErrorInfo=%s, xrefs: 00412480
Skin, xrefs: 00412422
cmdline, xrefs: 00412604
AllUsers, xrefs: 0041220C
SmallProgress, xrefs: 0041224F
LogMode, xrefs: 0041217F
CompanyName, xrefs: 00412330
MediaFormat, xrefs: 0041213D
Startup, xrefs: 00411FF6, 00411FFB, 00412057, 004120E8, 00412158, 0041219A, 004121DD, 00412227, 0041226A, 004122AD, 004122EF, 0041234B, 004123C4, 0041243D, 004124B6, 0041252D, 004125A6, 0041261F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: AllUsers$CheckMD5$CompanyName$CompanyURL$ErrorReportURL$InstallGUID$LauncherName$LogMode$MediaFormat$Product$ProductCode$ScriptDriven$ShowPasswordDialog$Skin$SmallProgress$SplashTime$Startup$cmdline$http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d : 0x%x&ErrorInfo=%s$setup.exe
API String ID: 431132790-2489255479
Opcode ID: 07817720002cf0860c895ba3b0f5d9ee5c8c2c277dff7bac98afa0a1e4578cfd
Instruction ID: 45f51b6317449bf295fef30f331f14934c6df749e20d54c3fd50b3e5654e45fc
Opcode Fuzzy Hash: 07817720002cf0860c895ba3b0f5d9ee5c8c2c277dff7bac98afa0a1e4578cfd
Instruction Fuzzy Hash: 3A3257B1D05288FADB01EBE9C956BEE7FBC9B15304F10405EE40567182EB785B09CBA7

Function 00428981 Relevance: 35.8, APIs: 3, Strings: 17, Instructions: 770
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00439D2C: __EH_prolog3_GS.LIBCMT ref: 00439D33

Part of subcall function 00421D14: __EH_prolog3.LIBCMT ref: 00421D1B

Part of subcall function 00439BC1: __EH_prolog3_GS.LIBCMT ref: 00439BCB

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0042121C: __EH_prolog3.LIBCMT ref: 00421223

Part of subcall function 0040F5AC: __EH_prolog3.LIBCMT ref: 0040F5B3

Part of subcall function 00402290: SysStringLen.OLEAUT32(?), ref: 004022AC
Part of subcall function 00402290: SysReAllocStringLen.OLEAUT32(?,00000000,00000000), ref: 004022D5

Part of subcall function 004434F4: __EH_prolog3.LIBCMT ref: 00443513
Part of subcall function 004434F4: _memset.LIBCMT ref: 0044354C
Part of subcall function 004434F4: GetModuleFileNameW.KERNEL32(?,00000104,?,?,00000010), ref: 00443567
Part of subcall function 004434F4: _memset.LIBCMT ref: 00443591
Part of subcall function 004434F4: _memset.LIBCMT ref: 004435CD
Part of subcall function 004434F4: GetTempPathW.KERNEL32(00000104,?,?,?,?,?,?,?,?,?,00000010), ref: 004435DD
Part of subcall function 004434F4: GetTempFileNameW.KERNELBASE(?,004B2AE0,00000000,?,?,?,?,?,?,?,?,?,00000010), ref: 004435F7

Part of subcall function 00402060: GetLastError.KERNEL32(80C21959,?,?,?,?,?,?,?,?,?,?,?,00000000,004AB698,000000FF), ref: 00402088
Part of subcall function 00402060: _DebugHeapAllocator.LIBCPMTD ref: 004020E2
Part of subcall function 00402060: SetLastError.KERNEL32(004AB698,?,?,?,?,?,?,?,?,?,?,?,00000000,004AB698,000000FF), ref: 004020FA

__wcstoui64.LIBCMT ref: 004290CE
__wcstoui64.LIBCMT ref: 004290ED
__wsplitpath.LIBCMT ref: 00429146

Part of subcall function 00415EC8: __EH_prolog3_GS.LIBCMT ref: 00415ECF

Strings

Getting file from web install, xrefs: 00428D0A
GetFile: file '%s', ini section '%s', full path '%s', location %d, xrefs: 00428A54
File to get to '%s', xrefs: 00428BB6
CabsSize, xrefs: 0042909F
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 00428BFB, 00429111, 0042913E
Location, xrefs: 00428AF9
/URL, xrefs: 00428DAB
E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 00428A59, 00428CF5, 00428DE5, 00429207
Type, xrefs: 00428AA1
dotnetfx.exe, xrefs: 004289B6
Getting file from temp location, '%s', xrefs: 00428C5F
Getting file from web download, xrefs: 00428DFA
C:\Users\user\Desktop, xrefs: 00429291
Getting file from source, '%s', xrefs: 004292F9
Cab%d, xrefs: 00428F2E
isnetfx.exe, xrefs: 004289B5
Getting file from setup.exe, xrefs: 0042921C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3__memset$ErrorFileLastNameStringTemp__wcstoui64$AllocAllocatorDebugHeapModulePath__wsplitpath
String ID: /URL$C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$C:\Users\user\Desktop$Cab%d$CabsSize$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$File to get to '%s'$GetFile: file '%s', ini section '%s', full path '%s', location %d$Getting file from setup.exe$Getting file from source, '%s'$Getting file from temp location, '%s'$Getting file from web download$Getting file from web install$Location$Type$dotnetfx.exe$isnetfx.exe
API String ID: 2233696111-3277220254
Opcode ID: a117ebb497b6f6b97edf4d24bbc43930d81bc17fd952749c183a7b5f7115c072
Instruction ID: f29f1bc40e6b5ec10a7624937981c451d840c20a3439d3a65ecea04106eb2b14
Opcode Fuzzy Hash: a117ebb497b6f6b97edf4d24bbc43930d81bc17fd952749c183a7b5f7115c072
Instruction Fuzzy Hash: F962CF7190124CEAEF11EBA5CD45BEE7BB8AF11304F5440AEF405A7292DB785F08CBA5

Function 004412A3 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 152
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyW.KERNEL32(?,004BDF40,?), ref: 004412EA
lstrcpyW.KERNEL32(?,004BDF40), ref: 004412F0
GetFileVersionInfoSizeW.VERSION(?,?), ref: 004412F7
_malloc.LIBCMT ref: 00441307

Part of subcall function 00467A06: __FF_MSGBANNER.LIBCMT ref: 00467A29
Part of subcall function 00467A06: __NMSG_WRITE.LIBCMT ref: 00467A30
Part of subcall function 00467A06: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,0046EB1E,00000001,00000001,00000001,?,004756DB,00000018,004D2228,0000000C,0047576C), ref: 00467A7D

_memset.LIBCMT ref: 00441313
GetFileVersionInfoW.VERSION(?,00000000,00000000,?,?,?), ref: 00441323
_memset.LIBCMT ref: 0044133A
VerQueryValueW.VERSION(?,004AE53C,?,?,00000000,00000000,?,?,?), ref: 00441355
wsprintfW.USER32 ref: 0044137F
_memset.LIBCMT ref: 00441391
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,004AE53C,?,?,00000000,00000000,?,?,?), ref: 004413A9
_memset.LIBCMT ref: 004413CE
wsprintfW.USER32 ref: 0044140F
wsprintfW.USER32 ref: 00441423
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004AE53C,?,?,00000000), ref: 00441433

Strings

%u.%u.%u.%u, xrefs: 00441377
\VarFileInfo\Translation, xrefs: 004413A1
%s,%u, xrefs: 0044141D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$lstrcpywsprintf$FileInfoQueryValueVersion$AllocateHeapSize_malloc
String ID: %s,%u$%u.%u.%u.%u$\VarFileInfo\Translation
API String ID: 3799987724-1385173819
Opcode ID: 843900f6323ee23063e95ec6819625f1aa22f1d618250409a0ec74a8d1bb9d1f
Instruction ID: 437c87cab5ff91bed495fc3e041e86f638760cac0a943e1ecaa031f36bc7a3ae
Opcode Fuzzy Hash: 843900f6323ee23063e95ec6819625f1aa22f1d618250409a0ec74a8d1bb9d1f
Instruction Fuzzy Hash: 25516271D00218BBDB11EFD5EC85EEEBB7CEF04704F10402AF905B6251EA399915CB68

Function 004680BA Relevance: 21.1, APIs: 14, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00468105
__mtinit.LIBCMT ref: 0046810B
_fast_error_exit.LIBCMT ref: 00468116
__RTC_Initialize.LIBCMT ref: 0046811C
__ioinit.LIBCMT ref: 00468124
__amsg_exit.LIBCMT ref: 0046812F
GetCommandLineW.KERNEL32 ref: 00468135
__wsetargv.LIBCMT ref: 00468149
__amsg_exit.LIBCMT ref: 00468154
__wsetenvp.LIBCMT ref: 0046815A
__amsg_exit.LIBCMT ref: 00468165
__cinit.LIBCMT ref: 0046816C
__amsg_exit.LIBCMT ref: 00468177
__wwincmdln.LIBCMT ref: 0046817D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandInitializeLine__cinit__ioinit__mtinit__wsetargv__wsetenvp__wwincmdln
String ID:
API String ID: 2477803136-0
Opcode ID: efb5da05b60bbf02843caffbad4d6a5620da126077b6d1f0746661837fc72074
Instruction ID: 3e5622c66dfaae1ac1b7f794c79446f0af549ecc4ed3f9f4a29c217800f7e354
Opcode Fuzzy Hash: efb5da05b60bbf02843caffbad4d6a5620da126077b6d1f0746661837fc72074
Instruction Fuzzy Hash: 5321C4B094031599DB147BB39C56BEE23A4AF1170CF15892FF4446A182FE7D88468A5F

Function 0043B66A Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 365
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0043B68C

Part of subcall function 0043B0A5: __EH_prolog3_catch.LIBCMT ref: 0043B0C4

IsValidLocale.KERNEL32(?,00000001,?,?,?,?,?,00000084), ref: 0043B722
_memset.LIBCMT ref: 0043B7A2
__itow.LIBCMT ref: 0043B7BB
_wcscat.LIBCMT ref: 0043B7DE

Part of subcall function 00410C1B: __EH_prolog3.LIBCMT ref: 00410C22

Part of subcall function 0040B2F1: __EH_prolog3.LIBCMT ref: 0040B2F8

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

Part of subcall function 00441D63: lstrlenW.KERNEL32(?,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441D6B
Part of subcall function 00441D63: lstrcpynW.KERNEL32(?,?,-00000001,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441D8D
Part of subcall function 00441D63: lstrcatW.KERNEL32(?,?,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441DAD

Part of subcall function 0040B14B: __EH_prolog3.LIBCMT ref: 0040B152
Part of subcall function 0040B14B: GetLastError.KERNEL32(00000038,0040C732), ref: 0040B159
Part of subcall function 0040B14B: SetLastError.KERNEL32(00000000), ref: 0040B1A3

Part of subcall function 0043A3EC: __EH_prolog3.LIBCMT ref: 0043A3F3

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 00415EC8: __EH_prolog3_GS.LIBCMT ref: 00415ECF

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\session.cpp, xrefs: 0043B6FD, 0043B83B, 0043BA83
Using language transforms from setup.exe location, xrefs: 0043BA9C
Default language: %d, got code page %d, xrefs: 0043B6F7
Language transforms in stream, xrefs: 0043B854
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 0043B8C8
/LangTransform, xrefs: 0043B912, 0043B9BA

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ErrorLastString$AllocH_prolog3_H_prolog3_catchLocaleValid__itow_memset_wcscatlstrcatlstrcpynlstrlen
String ID: /LangTransform$C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$Default language: %d, got code page %d$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\session.cpp$Language transforms in stream$Using language transforms from setup.exe location
API String ID: 2231109018-2789445465
Opcode ID: 4b7cd61165fa40f7c237a73cd4e0d5c1dbdfb4faf356f6f49cf35b76520255c6
Instruction ID: c2b0cba942a176ec4b9fd388dd09b3bedb800e86d561c09f36fec8e6d492e2f2
Opcode Fuzzy Hash: 4b7cd61165fa40f7c237a73cd4e0d5c1dbdfb4faf356f6f49cf35b76520255c6
Instruction Fuzzy Hash: 98E17E71900208ABDB14EFA5C895FEE77B8EF04304F50456FF516A71D1EB38AA05CBA9

Function 00424D03 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00424D1F

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 00424D2C, 00424D47, 0042501C, 004250B3
x64, xrefs: 00424F44
Package is 32-bit, xrefs: 004250C5
Package is 64-bit, xrefs: 0042502E
Status returned obtaining PID_TEMPLATE property: %d, xrefs: 00424EC9
Status returned from summary info: %d, xrefs: 00424DEE
Checking package platform..., xrefs: 00424D5C
AMD64, xrefs: 00424F76
Intel64, xrefs: 00424F19
Template summary for current package: %s, xrefs: 00424EF9

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: AMD64$Checking package platform...$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$Intel64$Package is 32-bit$Package is 64-bit$Status returned from summary info: %d$Status returned obtaining PID_TEMPLATE property: %d$Template summary for current package: %s$x64
API String ID: 431132790-1781301053
Opcode ID: bc49747f839417dc7dc4b330c170d0e8bc366242251ab34253b786c23a1f463f
Instruction ID: 5065e3c7b514c9af7b73e36a5ccc4e4e476ab4fcb7c14ba3795a92ba642f6431
Opcode Fuzzy Hash: bc49747f839417dc7dc4b330c170d0e8bc366242251ab34253b786c23a1f463f
Instruction Fuzzy Hash: 87D1BF71800148EEEB11EFA1DD81BEE7BB8AF15308F54426EF905A3191D7789F08CBA5

Function 0043AC73 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 268
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0043AC95

Part of subcall function 00432A27: __EH_prolog3.LIBCMT ref: 00432A2E

Part of subcall function 00432A7F: GetVersionExW.KERNEL32(?), ref: 00432AB8
Part of subcall function 00432A7F: GetSystemInfo.KERNELBASE(?), ref: 00432AEC

lstrlenW.KERNEL32(?,?,0000044F,?,000000A0), ref: 0043AF53

Part of subcall function 0040DB19: __EH_prolog3.LIBCMT ref: 0040DB20

Part of subcall function 00413011: __EH_prolog3.LIBCMT ref: 00413033

~_Task_impl.LIBCPMT ref: 0043AFB0
~_Task_impl.LIBCPMT ref: 0043AFEC

Part of subcall function 00438589: __EH_prolog3_catch.LIBCMT ref: 00438590
Part of subcall function 00438589: lstrcmpW.KERNEL32(?,004BDF40,?,?,004BDF40,?,?,00000004,0043AD19,Startup,Source,00000001,?,00000400,00000452), ref: 004385B8

Part of subcall function 00439369: __EH_prolog3_GS.LIBCMT ref: 00439373

Part of subcall function 004317AE: __EH_prolog3_GS.LIBCMT ref: 004317B8

Strings

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI, xrefs: 0043ADB5
Source, xrefs: 0043AD07
BetaMarker.dat, xrefs: 0043AE37
KEY, xrefs: 0043AF45
PASSWORD, xrefs: 0043AF40
EvalMarker.dat, xrefs: 0043AE5D
Startup, xrefs: 0043AD0C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_Task_impl$H_prolog3_catchInfoSystemVersionlstrcmplstrlen
String ID: BetaMarker.dat$C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI$EvalMarker.dat$KEY$PASSWORD$Source$Startup
API String ID: 1268296633-3903794669
Opcode ID: b214733f8d4245eba7b13125b4da7af23f0ffed950761e3125239434fdcdbce0
Instruction ID: 312c0db8785693123277a6f4a37a6f0846a679bc146babd283b23738d051f689
Opcode Fuzzy Hash: b214733f8d4245eba7b13125b4da7af23f0ffed950761e3125239434fdcdbce0
Instruction Fuzzy Hash: D0A11771940244AFDF10EBB5C952AEEB7B5AF08304F10406FE086A72D2DB785E49CB1A

Function 00442E8D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 155
processwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00442EA6
_memset.LIBCMT ref: 00442ECE
_memset.LIBCMT ref: 00442EDC
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?), ref: 00442F58
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00442F96
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00442FB8
GetExitCodeProcess.KERNELBASE(?,00000008), ref: 00442FC5
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00000060), ref: 00442FD6

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\utils.cpp, xrefs: 00442F11, 00442FDF, 00442FEF
Attempting to launch: %s, xrefs: 00442F0B
Launch result %d, exit code %d, xrefs: 00442FEA

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Process_memset$CloseCodeCreateExitH_prolog3HandleMessageMultipleObjectsPeekWait
String ID: Attempting to launch: %s$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\utils.cpp$Launch result %d, exit code %d
API String ID: 446905164-1832684909
Opcode ID: c6a067d617d481f78eee0f708743ba67272eda5f8a558b9369f55c1f5fd8b66d
Instruction ID: 425453424750abe3ab80a1fcf24555c8ccd78bdfc3e92c02879af3d8210d3fe9
Opcode Fuzzy Hash: c6a067d617d481f78eee0f708743ba67272eda5f8a558b9369f55c1f5fd8b66d
Instruction Fuzzy Hash: 01514CB190024CAFEB04DF94CD85DEE7BB8EB09358F50422AF916A7290D7759E04CB69

Function 0049BF20 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0049C04C
GetLastError.KERNEL32 ref: 0049C06E

Strings

1.2.3, xrefs: 0049BFD6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: 1.2.3
API String ID: 1214770103-2310465506
Opcode ID: e8e701687df879b23302bce23c400e6747f8cadb368fe96440543ae4afe9a6ff
Instruction ID: 72034bda7cfe0625e4bad177ff31ae92ea564d177fae415288f84a3174a8d673
Opcode Fuzzy Hash: e8e701687df879b23302bce23c400e6747f8cadb368fe96440543ae4afe9a6ff
Instruction Fuzzy Hash: D4D108B0804628DBDB20DF64DC45B9EB770EB44314F9082EAE759B62D1DB385A98CF58

Function 0040C659 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000104,80C21959), ref: 0040C720

Strings

Folders, xrefs: 0040C940
NO_KEY_VALUE, xrefs: 0040C8D9, 0040C93A
Files, xrefs: 0040C8DF
_ISMSIDEL.INI, xrefs: 0040C764
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 0040C69B, 0040C6A0, 0040C759, 0040C76B, 0040C7AC, 0040C865

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$Files$Folders$NO_KEY_VALUE$_ISMSIDEL.INI
API String ID: 514040917-1309465835
Opcode ID: a8f3662aa4967e3f1664da3050eb0a1af93fb357f119b62f3711a7af78f16919
Instruction ID: 56974a1790cb7d425264242f708fb47a6305442b0738f6d7f6bf1c1c607e72b4
Opcode Fuzzy Hash: a8f3662aa4967e3f1664da3050eb0a1af93fb357f119b62f3711a7af78f16919
Instruction Fuzzy Hash: 0191A171900248AFDF20EBA5CD85BDE37A8AF01304F54416BF905AB1D1EBB89B05C76A

Function 004434F4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 146
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00443513
_memset.LIBCMT ref: 0044354C
GetModuleFileNameW.KERNEL32(?,00000104,?,?,00000010), ref: 00443567

Part of subcall function 0044063F: __EH_prolog3.LIBCMT ref: 00440646
Part of subcall function 0044063F: lstrcpyW.KERNEL32(?,?,0000000C,0044357C,?,?,?,00000010), ref: 0044069E
Part of subcall function 0044063F: CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000010), ref: 004406C7
Part of subcall function 0044063F: GetLastError.KERNEL32(?,?,00000010), ref: 004406D8

_memset.LIBCMT ref: 00443591

Part of subcall function 00441B9D: _memset.LIBCMT ref: 00441BB5

_memset.LIBCMT ref: 004435CD
GetTempPathW.KERNEL32(00000104,?,?,?,?,?,?,?,?,?,00000010), ref: 004435DD
GetTempFileNameW.KERNELBASE(?,004B2AE0,00000000,?,?,?,?,?,?,?,?,?,00000010), ref: 004435F7
lstrcpyW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI,?,?,?,?,?,00000010), ref: 0044362D
DeleteFileW.KERNELBASE(?,00000000,?,004BDF40,?,?,?,?,?,00710000,?,?,?,?,?,?), ref: 004436C1

Strings

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI, xrefs: 00443617, 00443621

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File_memset$H_prolog3NameTemplstrcpy$CreateDeleteErrorLastModulePath
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI
API String ID: 1559788710-3978022597
Opcode ID: 66c95820472bad15f2951f6da92ac7e4a6ebef4053672f885de11efca38db91b
Instruction ID: 5cdfe015c49f2b02df778a2b2dd13f4e96b6b0eeae47fc45c40b96ea0f852bbf
Opcode Fuzzy Hash: 66c95820472bad15f2951f6da92ac7e4a6ebef4053672f885de11efca38db91b
Instruction Fuzzy Hash: F5515E71500188AAEF70EFA4CC89BEE37A9BF45304F14412BF909D7191EB395709CB69

Function 004178D6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004178DD
DefWindowProcW.USER32(?,?,?,?,00000064), ref: 00417907
GetWindowLongW.USER32(?,000000EB), ref: 0041791D
EndPaint.USER32(?,?), ref: 00417952
GetWindowLongW.USER32(?,000000EB), ref: 00417960
SetWindowLongW.USER32(?,000000EB,00000000), ref: 004179A8
GetClientRect.USER32(?,?), ref: 004179B5
ClientToScreen.USER32(?,?), ref: 004179C0
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000256), ref: 00417A01

Strings

GIF, xrefs: 00417A07

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Window$Long$Client$H_prolog3_PaintProcRectScreen
String ID: GIF
API String ID: 1597772338-881873598
Opcode ID: 9db7fe4ff57bde8a77a259b77f38394e40a34c2ec76a848c477910ad828b6aa2
Instruction ID: bdd95bf18fbc333e4c0368c8329d8eb0bca8b6be969077142fb6178a1e07b0e4
Opcode Fuzzy Hash: 9db7fe4ff57bde8a77a259b77f38394e40a34c2ec76a848c477910ad828b6aa2
Instruction Fuzzy Hash: BE31F371908215ABDF00AFE4DC49ABE7F75EF05724F20462AF112A61E1CB384A44DB1D

Function 00440DD2 Relevance: 16.8, APIs: 11, Instructions: 318fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00440DF1

Part of subcall function 004408E1: __EH_prolog3_GS.LIBCMT ref: 004408E8
Part of subcall function 004408E1: GetTempPathW.KERNEL32(00000104,00000000,?,00000104,0000004C,00440E20,00000068), ref: 00440937
Part of subcall function 004408E1: GetTempFileNameW.KERNELBASE(?,_is,00000000,?,?,00000104), ref: 0044097B

CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,00000068), ref: 00440E50
GetLastError.KERNEL32 ref: 00440E5A
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000000,00000000), ref: 00440ED8
GetLastError.KERNEL32 ref: 00440EE2
CloseHandle.KERNEL32(?), ref: 00440EF1
WriteFile.KERNELBASE(?,00000008,?,?,00000000), ref: 00440F98
ReadFile.KERNELBASE(?,00000008,00000000,?,00000000,?), ref: 00440FE2
CloseHandle.KERNELBASE(?), ref: 00440FF5
FlushFileBuffers.KERNEL32(?), ref: 00440FFA
CloseHandle.KERNEL32(?), ref: 00441003

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$CloseHandle$CreateErrorLastTemp$BuffersFlushH_prolog3H_prolog3_NamePathReadWrite
String ID:
API String ID: 2535771005-0
Opcode ID: 0ed47c550e7f3c54bf1f6871832dd98a1cedf69e0bade4258603df21d2eb927f
Instruction ID: cd91346ac68dce590abfb569c08116f684d3bedb401046a69e251d4e2e688af5
Opcode Fuzzy Hash: 0ed47c550e7f3c54bf1f6871832dd98a1cedf69e0bade4258603df21d2eb927f
Instruction Fuzzy Hash: 73C17C71900248EFEF21DFA4CD80AEEBBB4EF05304F14412AF901A72A1DB395E55DB99

Function 0040CB74 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72windowregistryCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(?,InstallShieldMSIDelete10), ref: 0040CBA3
LoadCursorW.USER32(00000000,00007F00), ref: 0040CBB2
GetStockObject.GDI32(00000004), ref: 0040CBBD
RegisterClassW.USER32(00000003), ref: 0040CBD0
CreateWindowExW.USER32(00000000,InstallShieldMSIDelete10,InstallShieldMSIDelete10,80000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0040CBF1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040CC1E

Strings

InstallShieldMSIDelete10, xrefs: 0040CB80, 0040CB85, 0040CBEE, 0040CBEF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Load$ClassCreateCursorIconMessageObjectRegisterStockWindow
String ID: InstallShieldMSIDelete10
API String ID: 195796534-324135598
Opcode ID: 118df152001c6d28298b09375be3f6546eb44198eddb3f8e40e874df7d15f96d
Instruction ID: 9542e0f325d3f4c10a5083e5273eb51d46b0a71756862ec4d5470597c6e0ba98
Opcode Fuzzy Hash: 118df152001c6d28298b09375be3f6546eb44198eddb3f8e40e874df7d15f96d
Instruction Fuzzy Hash: D311C9B1D05218EBDB109FA5DD88AEEBFBCEF49745B10402AE505F2250D7789501CB68

Function 00447D7B Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00447D82
GetModuleHandleW.KERNEL32(kernel32.dll,CreateDirectoryW,00000004,0044B9A4,?,00000001,?,?,00000000,?,?,00000000,00000001,?,00000078,0044BA45), ref: 00447DA2
GetProcAddress.KERNEL32(00000000), ref: 00447DAB
CreateDirectoryW.KERNELBASE(?,?,?,?,00000000,?,?,00000000,00000001,?,00000078,0044BA45,?,00000000,00000000), ref: 00447DC1
GetModuleHandleW.KERNEL32(kernel32.dll,CreateDirectoryA,?,?,00000000,?,?,00000000,00000001,?,00000078,0044BA45,?,00000000,00000000), ref: 00447DDB
GetProcAddress.KERNEL32(00000000), ref: 00447DDE

Strings

CreateDirectoryW, xrefs: 00447D97
kernel32.dll, xrefs: 00447D9C, 00447DA1, 00447DDA
CreateDirectoryA, xrefs: 00447DD5

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc$CreateDirectoryH_prolog3
String ID: CreateDirectoryA$CreateDirectoryW$kernel32.dll
API String ID: 662308948-2917578371
Opcode ID: 0fbea2f359c1df4a362811460554ed47b798ba0862c3e3c00e07a6d806b81232
Instruction ID: 9179b2b5d6e47d62f9633f5d09c819b78aee28206b2523caee4686c5e45fd4f3
Opcode Fuzzy Hash: 0fbea2f359c1df4a362811460554ed47b798ba0862c3e3c00e07a6d806b81232
Instruction Fuzzy Hash: 190184B1A10219ABCF11EF75CC409EF7AA5AF09341F15451BF811B7142DB7CD901CB98

Function 00447C1C Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00447C23
GetModuleHandleW.KERNEL32(kernel32.dll,GetFileAttributesW,00000000,0044CF65,?,00000001,?,?,?,?,?,?,?,?,000000D4,0040C7A5), ref: 00447C3D
GetProcAddress.KERNEL32(00000000), ref: 00447C46
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,000000D4,0040C7A5,?,?,00000001), ref: 00447C59
GetModuleHandleW.KERNEL32(kernel32.dll,GetFileAttributesA,?,?,?,?,?,?,?,?,000000D4,0040C7A5,?,?,00000001), ref: 00447C73
GetProcAddress.KERNEL32(00000000), ref: 00447C76

Strings

GetFileAttributesA, xrefs: 00447C6D
kernel32.dll, xrefs: 00447C37, 00447C3C, 00447C72
GetFileAttributesW, xrefs: 00447C32

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc$AttributesFileH_prolog3
String ID: GetFileAttributesA$GetFileAttributesW$kernel32.dll
API String ID: 3512441749-1399581607
Opcode ID: 4b67daa50cca6a0b5dfc39af31e5d4a18815c679711d1e8010d67cfdda76db66
Instruction ID: 2fb3f7f15f9d9fc351ed8d5bb3c3d65db75374976357e9373c0a6f07164fc0c1
Opcode Fuzzy Hash: 4b67daa50cca6a0b5dfc39af31e5d4a18815c679711d1e8010d67cfdda76db66
Instruction Fuzzy Hash: DBF0C871A04324A7DB11FF758CD1A9F66989F05745F42496BB80167242DF7CED028BEC

Function 00440420 Relevance: 15.1, APIs: 10, Instructions: 132fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00440427
CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000038,004405E5,?,?,00000000,?,?,00000010,004406AC), ref: 00440455
GetLastError.KERNEL32(?,?,00000010), ref: 0044046A
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000,?,?,00000010), ref: 004404A6
GetSystemInfo.KERNELBASE(?,?,?,00000010), ref: 004404BE
MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,?,?,?,00000010), ref: 004404D2
IsBadReadPtr.KERNEL32(?,000000F8), ref: 004404FD
UnmapViewOfFile.KERNEL32(?,?,?,00000010), ref: 0044051B
MapViewOfFile.KERNEL32(?,00000004,00000000,00000000,00000008,?,?,00000010), ref: 0044052B
IsBadReadPtr.KERNEL32(?,000000F8), ref: 00440552

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$View$CreateRead$ErrorH_prolog3InfoLastMappingSystemUnmap
String ID:
API String ID: 2433704077-0
Opcode ID: 438bc25b7b1fa61394102bc2e07dcb0c1e6dfab88b4ca478ab20794f12470613
Instruction ID: 64e28f40d4ca59566299ea79c847f5d981823cced5c81f00386a1562f1546c4c
Opcode Fuzzy Hash: 438bc25b7b1fa61394102bc2e07dcb0c1e6dfab88b4ca478ab20794f12470613
Instruction Fuzzy Hash: AF51387190020AEFEF20DF94CD85AAEBBB4FF05345F50452AE601A7290D7785E54CFA9

Function 00447156 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 55libraryloaderfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileW,?,?,00000001,?,00438463,?,?,?,?,?,?,?,?,00000001), ref: 0044716D
GetProcAddress.KERNEL32(00000000), ref: 00447176
CreateFileW.KERNELBASE(?,0044CF36,0000014C,00000001,?,00000000,00000000,?,00000001,?,00438463,?,?,?,?,?), ref: 004471A0
GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileA,?,00000001,?,00438463,?,?,?,?,?,?,?,?,00000001,?), ref: 004471AA
GetProcAddress.KERNEL32(00000000), ref: 004471AD

Strings

CreateFileA, xrefs: 004471A4
kernel32.dll, xrefs: 00447167, 0044716C, 004471A9
CreateFileW, xrefs: 00447162

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc$CreateFile
String ID: CreateFileA$CreateFileW$kernel32.dll
API String ID: 2362759813-3217398002
Opcode ID: 492500629854faa33ffba4118f04d966372e36dba8173f7b82fe7171e50a8622
Instruction ID: 385da8b58aea177b5dca75113c9211ed3e3416483c63e769ffea634b9ec59e64
Opcode Fuzzy Hash: 492500629854faa33ffba4118f04d966372e36dba8173f7b82fe7171e50a8622
Instruction Fuzzy Hash: 8B01CC7250420DBBDF029FA5CC40CEA3F2AEF4D354B00851AFE1466260C73AE822DFA4

Function 004439A5 Relevance: 13.6, APIs: 9, Instructions: 146librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 004439EA
GetLastError.KERNEL32 ref: 004439F6
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 00443A29
InterlockedExchange.KERNEL32(?,00000000), ref: 00443A3B
LocalAlloc.KERNEL32(00000040,00000008), ref: 00443A4F
FreeLibrary.KERNEL32(00000000), ref: 00443A6C
GetProcAddress.KERNEL32(?,?), ref: 00443AC1
GetLastError.KERNEL32(?,?), ref: 00443ACD
RaiseException.KERNEL32(C06D007F,00000000,00000001,?,?,?), ref: 00443AFF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorExceptionLastLibraryRaise$AddressAllocExchangeFreeInterlockedLoadLocalProc
String ID:
API String ID: 991255547-0
Opcode ID: 58a1a7d18b0f8bc0c6d08566a5d0dc1ba8670b3fdb847c585a54217a0ae8f34f
Instruction ID: 438f36b801bf237eba0bb61f071a27959cf4e11ee8e242da418fb5e97408b3f2
Opcode Fuzzy Hash: 58a1a7d18b0f8bc0c6d08566a5d0dc1ba8670b3fdb847c585a54217a0ae8f34f
Instruction Fuzzy Hash: 4B513C71640305AFEB11CF94D884BAE7BB4EB58B42F15402EE941E7391EB74EE44CB68

Function 0044E976 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 211fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,_is,?,?,?,00000104), ref: 0044EACC
GetTempPathW.KERNEL32(00000104,00000000,?,00000104,00000124,0043E9B8,?,00000000,004BDF40,?,00000001), ref: 0044E9BE

Part of subcall function 0040B14B: __EH_prolog3.LIBCMT ref: 0040B152
Part of subcall function 0040B14B: GetLastError.KERNEL32(00000038,0040C732), ref: 0040B159
Part of subcall function 0040B14B: SetLastError.KERNEL32(00000000), ref: 0040B1A3

__EH_prolog3_GS.LIBCMT ref: 0044E980

Part of subcall function 0040B2F1: __EH_prolog3.LIBCMT ref: 0040B2F8

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

DeleteFileW.KERNEL32(?), ref: 0044EAF1

Strings

_is, xrefs: 0044EAC6
.tmp, xrefs: 0044EB13

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorFileH_prolog3LastStringTemp$AllocDeleteH_prolog3_NamePath
String ID: .tmp$_is
API String ID: 3845853708-3921807090
Opcode ID: 9c5779b5c3775c2c6bf8a5703288ce6267fc82bf2534731dea799bc541426bcb
Instruction ID: 4cb226b2a1b3ba8906f9a3c9087470177495f8fafe80334baa425f29f219070a
Opcode Fuzzy Hash: 9c5779b5c3775c2c6bf8a5703288ce6267fc82bf2534731dea799bc541426bcb
Instruction Fuzzy Hash: C8814D7180014CEAEB05EBE5CD95EDE7BB8AF15304F0440AEF50677192EB386B09DB69

Function 0044063F Relevance: 10.6, APIs: 7, Instructions: 124filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00440646
lstrcpyW.KERNEL32(?,?,0000000C,0044357C,?,?,?,00000010), ref: 0044069E

Part of subcall function 004405AB: __EH_prolog3.LIBCMT ref: 004405B2

CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,00000010), ref: 004406C7
GetLastError.KERNEL32(?,?,00000010), ref: 004406D8
_memset.LIBCMT ref: 00440704
ReadFile.KERNELBASE(?,?,0000002E,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,00000010), ref: 0044073C
ReadFile.KERNEL32(?,?,0000002E,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,00000010), ref: 004407B3

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$H_prolog3Read$CreateErrorLast_memsetlstrcpy
String ID:
API String ID: 2316094307-0
Opcode ID: 02fb3fd59ad45016464f20dd2da0a8ffe20cb4fad3ce0ed93c9969b868ab6bf1
Instruction ID: e94f3df234d3611c01a9b1d770559d5ffa6095cdd86997b305566c114efbb994
Opcode Fuzzy Hash: 02fb3fd59ad45016464f20dd2da0a8ffe20cb4fad3ce0ed93c9969b868ab6bf1
Instruction Fuzzy Hash: 5241F374500700AAEB30AF35C848BABFBE4EF94700F104A1EF5A692291D7786950CF99

Function 0044E44B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044E455
LoadLibraryW.KERNEL32(msi.dll,00000088,00430C7D,?,?,?), ref: 0044E46D
GetProcAddress.KERNEL32(00000000,MsiGetProductInfoW), ref: 0044E480

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Strings

InstalledProductName, xrefs: 0044E4DF
MsiGetProductInfoW, xrefs: 0044E476
msi.dll, xrefs: 0044E468

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressH_prolog3H_prolog3_LibraryLoadProc
String ID: InstalledProductName$MsiGetProductInfoW$msi.dll
API String ID: 2740143064-1783410467
Opcode ID: 9f4ea7232f782d7db0faf8dfaaa5c3b4db83949be148a08b35e8e1274ff004d0
Instruction ID: d0e3fa633cfcf1dda767b6660d7f66dfa7fec4ea62bc27dccd62c9913960f850
Opcode Fuzzy Hash: 9f4ea7232f782d7db0faf8dfaaa5c3b4db83949be148a08b35e8e1274ff004d0
Instruction Fuzzy Hash: 71317270900249EFDB04EFE5C955BEDB7B4AF11308F50406EF40567282EB79AE05CB69

Function 00410F36 Relevance: 9.2, APIs: 6, Instructions: 180COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00410F3D
std::_String_base::_Xlen.LIBCPMT ref: 00410F78

Part of subcall function 0040D089: __EH_prolog3.LIBCMT ref: 0040D090
Part of subcall function 0040D089: __CxxThrowException@8.LIBCMT ref: 0040D0BB

ctype.LIBCPMT ref: 00410FE5
ctype.LIBCPMT ref: 00411005

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catch_String_base::_ThrowXlenstd::_
String ID:
API String ID: 1119708605-0
Opcode ID: 43cd5fbc1895b1802ad34a6a8c39592ebdfc47c00e1251fb605430f97f8758ae
Instruction ID: 09da5b5fd071d3d9eb1506b219490880805e11ed182db133944f646cf54c4f2e
Opcode Fuzzy Hash: 43cd5fbc1895b1802ad34a6a8c39592ebdfc47c00e1251fb605430f97f8758ae
Instruction Fuzzy Hash: 4451C6B2A00704AFCF25DFA5C845A9EBBB6FF44314F14852EF5119B291DBB4A945CF04

Function 00441895 Relevance: 9.1, APIs: 6, Instructions: 67stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0000000A,00000000,00000000,?,0000000C,?,00426CA7,?,?,00000000,00000000,?,?,?,00000000,?), ref: 004418AC
lstrcpyW.KERNEL32(00000000,0000000A,?,00426CA7,?,?,00000000,00000000,?,?,?,00000000,?,000000FE,0000000A), ref: 004418CC
lstrcatW.KERNEL32(00000000,004AE53C,?,00426CA7,?,?,00000000,00000000,?,?,?,00000000,?,000000FE,0000000A), ref: 004418D8
lstrlenW.KERNEL32(00000000,?,00426CA7,?,?,00000000,00000000,?,?,?,00000000,?,000000FE,0000000A), ref: 004418E1
CreateDirectoryW.KERNELBASE(00000000,00000000,?,00426CA7,?,?,00000000,00000000,?,?,?,00000000,?,000000FE,0000000A), ref: 004418F8
GetLastError.KERNEL32(?,00426CA7,?,?,00000000,00000000,?,?,?,00000000,?,000000FE,0000000A), ref: 00441902

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: lstrlen$CreateDirectoryErrorLastlstrcatlstrcpy
String ID:
API String ID: 4043630017-0
Opcode ID: da9f478636b4e3c139685bb103406c31974f58940a413459388a21547070fd3a
Instruction ID: 800b66ca13ab665320de1f291447017b5b0d34c3ce0077314a11aaa6ff97433e
Opcode Fuzzy Hash: da9f478636b4e3c139685bb103406c31974f58940a413459388a21547070fd3a
Instruction Fuzzy Hash: 2C11C6726053149FF711ABA0AC89B7B7BE8DF97365F10041BF501C21A1EB65498186AA

Function 00417587 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00417591

Part of subcall function 00462D24: __EH_prolog3.LIBCMT ref: 00462D2B

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

GetWindowDC.USER32(00000000), ref: 0041766B
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 00417684
ReleaseDC.USER32(00000000,00000000), ref: 00417695

Strings

(, xrefs: 00417604

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$BitmapCreateReleaseWindow_malloc
String ID: (
API String ID: 1368873109-3887548279
Opcode ID: a8cb6ab74363334921d0279c994f80ab01eb37d5f4031d8f96dbaea00ad3d37a
Instruction ID: 447c26da0e9bcc47b3cd25ea88490cdf0ece2219740127f58017f5427abd266c
Opcode Fuzzy Hash: a8cb6ab74363334921d0279c994f80ab01eb37d5f4031d8f96dbaea00ad3d37a
Instruction Fuzzy Hash: 1941AFB2900218AFDB14DFA5DD81FEEBBB5BF08300F00415AF205A7292EB749A04CB65

Function 00465987 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004659A1

Part of subcall function 00467A06: __FF_MSGBANNER.LIBCMT ref: 00467A29
Part of subcall function 00467A06: __NMSG_WRITE.LIBCMT ref: 00467A30
Part of subcall function 00467A06: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,0046EB1E,00000001,00000001,00000001,?,004756DB,00000018,004D2228,0000000C,0047576C), ref: 00467A7D

std::bad_alloc::bad_alloc.LIBCMT ref: 004659C4

Part of subcall function 0046596C: std::exception::exception.LIBCMT ref: 00465978

__CxxThrowException@8.LIBCMT ref: 004659E6

Strings

DD@, xrefs: 00465989
vg@, xrefs: 0046599E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::exception::exception
String ID: DD@$vg@
API String ID: 3715980512-811002805
Opcode ID: 5bc861247156de040bf063f329119912a34fbabfac71281188880bcf6ce10fbb
Instruction ID: 43132ba2aaccbce605d76c33724411dd1eadf6162c22a73d2e72927fd7986f54
Opcode Fuzzy Hash: 5bc861247156de040bf063f329119912a34fbabfac71281188880bcf6ce10fbb
Instruction Fuzzy Hash: 15F0B4B1900649E6CF097762DC16A5A3B689F4132CF14806BF80555191FF6C894A8A9F

Function 0041C2B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Software\InstallShield\ISWI\7.0\SetupExeLog,00000000,00000001,?), ref: 0041C2C8
RegQueryValueExW.ADVAPI32(?,SetupLogFileName,00000000,00000000,004D7A00,?), ref: 0041C2EE
RegCloseKey.ADVAPI32(?), ref: 0041C302

Strings

Software\InstallShield\ISWI\7.0\SetupExeLog, xrefs: 0041C2BE
SetupLogFileName, xrefs: 0041C2DF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: SetupLogFileName$Software\InstallShield\ISWI\7.0\SetupExeLog
API String ID: 3677997916-622478307
Opcode ID: 71ef64c40ea0a9a6b6a93174b471afb56c1ec74e56274abe5810d5b043027a18
Instruction ID: 51ff1acb7a319f726640e86903da7c80edf2ef01446d26996cc67cec8ee88fb4
Opcode Fuzzy Hash: 71ef64c40ea0a9a6b6a93174b471afb56c1ec74e56274abe5810d5b043027a18
Instruction Fuzzy Hash: 91F03070684249FBEB108BD0DD8AFDE7BA8AB15B04F200066B601F1290E2F5AA44966C

Function 00442260 Relevance: 7.5, APIs: 5, Instructions: 44fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00442267

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 0044CEF2: __EH_prolog3_GS.LIBCMT ref: 0044CEFC

SetErrorMode.KERNELBASE(00008001,?), ref: 004422B4
SetFileAttributesW.KERNELBASE(?,00000080), ref: 004422BC
DeleteFileW.KERNELBASE(?), ref: 004422C3
SetErrorMode.KERNELBASE(00000000), ref: 004422D2

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorFileH_prolog3Mode$AttributesDeleteH_prolog3_
String ID:
API String ID: 2831870221-0
Opcode ID: 55fcb845f8156b2a23acc24e142fb687da8506beb04df6e37c532ba5d572bf14
Instruction ID: 67408ef268f1a320b96cdf846312cb048fa920e28bd99b0dd003aba0a57cb48e
Opcode Fuzzy Hash: 55fcb845f8156b2a23acc24e142fb687da8506beb04df6e37c532ba5d572bf14
Instruction Fuzzy Hash: 3CF0F472A502446AEB80BFB14D82B7F3B64BB12744F40406EFA11961D1DBF88A41875E

Function 00467AD0 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00467AEE

Part of subcall function 00475751: __mtinitlocknum.LIBCMT ref: 00475767
Part of subcall function 00475751: __amsg_exit.LIBCMT ref: 00475773
Part of subcall function 00475751: EnterCriticalSection.KERNEL32(0046D250,0046D250,?,00484094,00000004,004D2328,0000000C,0046EB68,00000001,0046D25F,00000000,00000000,00000000,?,0046D25F,00000001), ref: 0047577B

___sbh_find_block.LIBCMT ref: 00467AF9
___sbh_free_block.LIBCMT ref: 00467B08
RtlFreeHeap.NTDLL(00000000,00000001,004D1D68,0000000C,00475732,00000000,004D2228,0000000C,0047576C,00000001,0046D250,?,00484094,00000004,004D2328,0000000C), ref: 00467B38
GetLastError.KERNEL32(?,00484094,00000004,004D2328,0000000C,0046EB68,00000001,0046D25F,00000000,00000000,00000000,?,0046D25F,00000001,00000214), ref: 00467B49

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1e68e4671e878495f3ccd112b4e12c19412185df4fae9cb733a2ab4eb73c6ebf
Instruction ID: 380c0a0cfc243fd579615acc5fd6204f77fdf53217a4617cf0a6b39c8cfa71a6
Opcode Fuzzy Hash: 1e68e4671e878495f3ccd112b4e12c19412185df4fae9cb733a2ab4eb73c6ebf
Instruction Fuzzy Hash: DB01A731905305AADF207FB29C05B5E3BA49F10B2DF20411FF4046A190EB7CA940CA5F

Function 00416366 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00416388

Part of subcall function 00415E5D: __EH_prolog3.LIBCMT ref: 00415E64

Part of subcall function 00415D7E: __EH_prolog3.LIBCMT ref: 00415D85

Part of subcall function 0040A7C0: __EH_prolog3.LIBCMT ref: 0040A7D9

Part of subcall function 00415EC8: __EH_prolog3_GS.LIBCMT ref: 00415ECF

Part of subcall function 00458474: __EH_prolog3.LIBCMT ref: 0045847B

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 004584FE: __EH_prolog3.LIBCMT ref: 00458520

Part of subcall function 0040AE09: __EH_prolog3.LIBCMT ref: 0040AE10
Part of subcall function 0040AE09: SetLastError.KERNEL32(?,?,00000000,00000004,0040B187,?,?,00000001), ref: 0040AE74

Strings

.ini, xrefs: 004163F6
0x%04x, xrefs: 004163BD
%ld, xrefs: 004163EB

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ErrorH_prolog3_Last
String ID: %ld$.ini$0x%04x
API String ID: 3513993312-494970429
Opcode ID: 60e0dc43b3436dc67e09c8e6a4cd2b6ddb33e0def880a3dd538eb50888a7cddc
Instruction ID: f126a8e82066503a768459db48ab6e9c1751e6bf920b643244b3bcf6190de03f
Opcode Fuzzy Hash: 60e0dc43b3436dc67e09c8e6a4cd2b6ddb33e0def880a3dd538eb50888a7cddc
Instruction Fuzzy Hash: A171857190028CEBDF21EFA5CC45BEE7BB8AF15304F10446EE4456B182EB785B08C7A5

Function 00438F1E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00438F3D

Part of subcall function 00438589: __EH_prolog3_catch.LIBCMT ref: 00438590
Part of subcall function 00438589: lstrcmpW.KERNEL32(?,004BDF40,?,?,004BDF40,?,?,00000004,0043AD19,Startup,Source,00000001,?,00000400,00000452), ref: 004385B8

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\session.cpp, xrefs: 00438FC1, 004390D0
Creating setup dialog..., xrefs: 00438FD6
Startup, xrefs: 00438F71

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch_malloclstrcmp
String ID: Creating setup dialog...$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\session.cpp$Startup
API String ID: 1311337335-2410320036
Opcode ID: 324fe52276af5a34673adff2d245b82cdc4333873b1c0d4349341fda27d41750
Instruction ID: 693e8c2d8b55a7c8e9b763e1a2e712d8a61da9b80287e8d18133444a5b1ca0b5
Opcode Fuzzy Hash: 324fe52276af5a34673adff2d245b82cdc4333873b1c0d4349341fda27d41750
Instruction Fuzzy Hash: A351AE30900248EBDF14EFA4C885BEEBBB4AF14304F50442EF556A7191EB786B09CB59

Function 004408E1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004408E8

Part of subcall function 0040B2F1: __EH_prolog3.LIBCMT ref: 0040B2F8

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

GetTempPathW.KERNEL32(00000104,00000000,?,00000104,0000004C,00440E20,00000068), ref: 00440937

Part of subcall function 0040B14B: __EH_prolog3.LIBCMT ref: 0040B152
Part of subcall function 0040B14B: GetLastError.KERNEL32(00000038,0040C732), ref: 0040B159
Part of subcall function 0040B14B: SetLastError.KERNEL32(00000000), ref: 0040B1A3

GetTempFileNameW.KERNELBASE(?,_is,00000000,?,?,00000104), ref: 0044097B

Strings

_is, xrefs: 00440975

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorH_prolog3LastStringTemp$AllocFileH_prolog3_NamePath
String ID: _is
API String ID: 164374076-3851567351
Opcode ID: cc90d8245aa27ad5804a007b64695939d7b09b234c379752190daf0be0d28162
Instruction ID: dd468e14379ef9453151e3a26eb9313bf7e178f6f5f97ca454d0e9df033a8618
Opcode Fuzzy Hash: cc90d8245aa27ad5804a007b64695939d7b09b234c379752190daf0be0d28162
Instruction Fuzzy Hash: F8217170801144DEDB05EBD4C956BEC7B749F15309F1440AEF102BB1D2CBB85B05D76A

Function 0043C0A2 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043C0C1

Part of subcall function 00439E73: __EH_prolog3.LIBCMT ref: 00439E7A

Part of subcall function 0040C4EF: __EH_prolog3.LIBCMT ref: 0040C4F6

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

GetModuleFileNameW.KERNEL32(00000000,00000000,00000400,00000010), ref: 0043C223
_memset.LIBCMT ref: 0043C2B0
_memset.LIBCMT ref: 0043C2C8

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$_memset$FileModuleName_malloc
String ID:
API String ID: 2907421663-0
Opcode ID: cd7f9be39ccfb315eb3117a3e17f77f7bddf418585e9ec5a1549b3489c15b9a1
Instruction ID: 621961d43aa4b11b9c3a9a4cb1a8c5597c89bfa210763c9aff98118bf90db992
Opcode Fuzzy Hash: cd7f9be39ccfb315eb3117a3e17f77f7bddf418585e9ec5a1549b3489c15b9a1
Instruction Fuzzy Hash: 0871DEB1805B84DED721DF7984817DEFBE4BF19304F50886FD09A93281DB782608CB59

Function 0044CEF2 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044CEFC
GetLastError.KERNEL32 ref: 0044CF8F
GetLastError.KERNEL32(00000000), ref: 0044D040
__CxxThrowException@8.LIBCMT ref: 0044D09D

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0044B65A: __EH_prolog3_catch_GS.LIBCMT ref: 0044B664
Part of subcall function 0044B65A: __CxxThrowException@8.LIBCMT ref: 0044B711

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorException@8LastThrow$H_prolog3H_prolog3_H_prolog3_catch_
String ID:
API String ID: 3568709733-0
Opcode ID: 0160a0a8ae0277b65de657f7d33f111d4be3b5e69193a2f6722e3e85244d8ec9
Instruction ID: 71eca54bbaa91b0eac72d0792d4f8f30800a7e3a47b35550827bcc4e4bc801b0
Opcode Fuzzy Hash: 0160a0a8ae0277b65de657f7d33f111d4be3b5e69193a2f6722e3e85244d8ec9
Instruction Fuzzy Hash: 9341F670A012486AEF54EB25C8867ED3B655F12348F0C419FF845172E2DB7D4A8ACB4A

Function 0040E493 Relevance: 6.1, APIs: 4, Instructions: 59stringCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000000,00000001,?,00000000,00000001,004130CD,00000000,00000400,00000000,00000000,00000001,0000044F,00000000,000000B4), ref: 0040E4B2
SetErrorMode.KERNELBASE(00008003,?,00000000,00000001,004130CD,00000000,00000400,00000000,00000000,00000001,0000044F,00000000,000000B4), ref: 0040E4C1
GetWindowsDirectoryW.KERNEL32(00000001,00000000,?,00000000,00000001,004130CD,00000000,00000400,00000000,00000000,00000001,0000044F,00000000,000000B4), ref: 0040E4D9
lstrcpyW.KERNEL32(00000001,004BDF40,?,00000000,00000001,004130CD,00000000,00000400,00000000,00000000,00000001,0000044F,00000000,000000B4), ref: 0040E4F6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: DirectoryErrorModePathTempWindowslstrcpy
String ID:
API String ID: 3576100887-0
Opcode ID: 566874df9e5094c7c02bb357b506332139b017113506c58bdf316cc582eecace
Instruction ID: 08bcf1bdeb96947dd569432721a44dc4ebe85b0b153b498a7c6a74ca7f142118
Opcode Fuzzy Hash: 566874df9e5094c7c02bb357b506332139b017113506c58bdf316cc582eecace
Instruction Fuzzy Hash: FB01843260120177D61026F31D49F2B6EAC9F96798B000C3EF905E11D2F528D915967D

Function 0040CAE3 Relevance: 6.0, APIs: 4, Instructions: 42windowtimeCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000002,00000000,00000000), ref: 0040CB28
KillTimer.USER32(?,000005DC), ref: 0040CB3F
PostQuitMessage.USER32(00000000), ref: 0040CB47
SetTimer.USER32(?,000005DC,000003E8,00000000), ref: 0040CB68

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: MessagePostTimer$KillQuit
String ID:
API String ID: 143517078-0
Opcode ID: a7a5e6aab64d718a68499b15725af8fb651da3f72e31ffadffab5605885a6470
Instruction ID: e7cf11b94439fe1d9962d16f4c4498ad5d66bea17b65329dbb68bad2557a40eb
Opcode Fuzzy Hash: a7a5e6aab64d718a68499b15725af8fb651da3f72e31ffadffab5605885a6470
Instruction Fuzzy Hash: CB012130684209EFE760AF54ED8AB253BA5E704B05F004133F501BA2E0DBB8A840EF5D

Function 0041E7C6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E7F1
IsDialogMessageW.USER32(?), ref: 0041E805
TranslateMessage.USER32(?), ref: 0041E813
DispatchMessageW.USER32(?), ref: 0041E81D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: abaf2e874c1ab631b3758e6df2f5505a619884bea55c696ef1baa393a7717932
Instruction ID: ab0268e76340fadb81a55205d16907c0b0cdec7863bf1cb6aa386e0aa3285eb6
Opcode Fuzzy Hash: abaf2e874c1ab631b3758e6df2f5505a619884bea55c696ef1baa393a7717932
Instruction Fuzzy Hash: 2D01317690424AAFEB10EBE5DC99DEB7BBCAB08304B058476F512D3252E634EC45CB58

Function 0041E897 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00413859), ref: 0041E89D
GetDlgItem.USER32(0000012D), ref: 0041E8B7
SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 0041E8CD
SendMessageW.USER32(00000000,00000402,?,00000000), ref: 0041E8E8

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: MessageSend$ItemWindow
String ID:
API String ID: 591194657-0
Opcode ID: da548d49ef7418407f87f06ba676291b0cdb7bcb6d43d3efd2264a87c86af0ef
Instruction ID: 93ffc074d4304c8f85bba065a77fffa7b276ee1110892854ba8f6dfd592947bc
Opcode Fuzzy Hash: da548d49ef7418407f87f06ba676291b0cdb7bcb6d43d3efd2264a87c86af0ef
Instruction Fuzzy Hash: B3F082713402206BEA106B62ACC5E6A7BA8EB89B41F04003AF601E2290CA745C05D67C

Function 004421FE Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00442205

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 0044CEF2: __EH_prolog3_GS.LIBCMT ref: 0044CEFC

SetErrorMode.KERNELBASE(00008001), ref: 00442242
RemoveDirectoryW.KERNELBASE(?), ref: 00442247
SetErrorMode.KERNELBASE(00000000), ref: 00442254

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorH_prolog3Mode$DirectoryH_prolog3_Remove
String ID:
API String ID: 359717666-0
Opcode ID: 124d3046d10a0b9899963b933024da171a8367f8aa60ac4798feedd925b51456
Instruction ID: 1da1d8bcb3cb93c10cd14538e5b0db52f77ff9c7c1d1ac22e9415881537509da
Opcode Fuzzy Hash: 124d3046d10a0b9899963b933024da171a8367f8aa60ac4798feedd925b51456
Instruction Fuzzy Hash: 64F0E972A00205ABEF00BFA18D0276D3F60FF85350F00815BF9149A1D2DFB98A41CB8A

Function 00441936 Relevance: 6.0, APIs: 4, Instructions: 24fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008001,?,004422A5,?), ref: 00441942
CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0044195A
SetErrorMode.KERNEL32(00000000), ref: 00441967
CloseHandle.KERNELBASE(00000000), ref: 0044196F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorMode$CloseCreateFileHandle
String ID:
API String ID: 1343785229-0
Opcode ID: 7e5ad8e386653789d8a7f7246c3fab00e523d1717b5231b18efaac03b7e11cdc
Instruction ID: 9b76b6c97a03724428ba8dc2ff0e7f64da3c7f53a9a69b3f56251e7c004fea30
Opcode Fuzzy Hash: 7e5ad8e386653789d8a7f7246c3fab00e523d1717b5231b18efaac03b7e11cdc
Instruction Fuzzy Hash: 84E0CD31794214BAF66017B05C05F5A3E54BB05721F204522F351F90E0C9945440875C

Function 0040A0A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 288fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040A0BC
CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000002,00000080,00000000,000000FC), ref: 0040A0E3

Part of subcall function 00405700: CloseHandle.KERNELBASE(?,?,?,004056AF), ref: 00405725

Strings

], xrefs: 0040A1BA

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CloseCreateFileH_prolog3Handle
String ID: ]
API String ID: 2799955392-3462329250
Opcode ID: 808c2cf09c035a6ecf4407471ca1409b40081ad380cb67ad2f41d72314af3368
Instruction ID: 4743f97ca9f0bdc6c7923ada8529c4fc238c06fc2cb34b5db613118f3a960246
Opcode Fuzzy Hash: 808c2cf09c035a6ecf4407471ca1409b40081ad380cb67ad2f41d72314af3368
Instruction Fuzzy Hash: CEB17D71804248AFDB14EF65CD81EEE3B68AF14308F00416EF946B71D2DB78AE48CB65

Function 0041E3E4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041E403

Part of subcall function 0041C2B1: RegOpenKeyExW.KERNELBASE(80000001,Software\InstallShield\ISWI\7.0\SetupExeLog,00000000,00000001,?), ref: 0041C2C8
Part of subcall function 0041C2B1: RegQueryValueExW.ADVAPI32(?,SetupLogFileName,00000000,00000000,004D7A00,?), ref: 0041C2EE
Part of subcall function 0041C2B1: RegCloseKey.ADVAPI32(?), ref: 0041C302

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

Part of subcall function 0043C0A2: __EH_prolog3.LIBCMT ref: 0043C0C1
Part of subcall function 0043C0A2: GetModuleFileNameW.KERNEL32(00000000,00000000,00000400,00000010), ref: 0043C223

Strings

Setup.iss, xrefs: 0041E5AB
/f1, xrefs: 0041E5EC

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$CloseFileModuleNameOpenQueryValue_malloc
String ID: /f1$Setup.iss
API String ID: 3683501909-1350328100
Opcode ID: 6fc474801ff150366316f33378e1d26e1cb483830c6b1a6028f7f4e5ee9eec4b
Instruction ID: f10391063ce91c036dc7d45e73fd12f6a139067408853c208e339da87ce85e68
Opcode Fuzzy Hash: 6fc474801ff150366316f33378e1d26e1cb483830c6b1a6028f7f4e5ee9eec4b
Instruction Fuzzy Hash: 4F61C971904288EFCB14EFA5CD55ADEBBB4AF15304F10806FF40AAB291DB789B44CB59

Function 0040B555 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B55C

Part of subcall function 00408CB5: __EH_prolog3.LIBCMT ref: 00408CBC

__CxxThrowException@8.LIBCMT ref: 0040B592

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

map/set<T> too long, xrefs: 0040B56C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 1412866469-1285458680
Opcode ID: 456c18a0ab47c5103ee012ebcddb7cfe5530aeef5fc9a0a5f625c1bf0169b940
Instruction ID: 2a606aa8486ff028fdd206f28c3b57b4cd52fd2daf73867ea7165442c1dec6da
Opcode Fuzzy Hash: 456c18a0ab47c5103ee012ebcddb7cfe5530aeef5fc9a0a5f625c1bf0169b940
Instruction Fuzzy Hash: 1D414C316006409FDB25DF19C484BA9BBF1FF15308F1980AAE5456B3A2D77AFC81CB99

Function 004383EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004383F5

Part of subcall function 00437590: InterlockedDecrement.KERNEL32(?), ref: 004375A1
Part of subcall function 00437590: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,00438401,00000034,0044B6C3,?,80000000,00000001,00000080,00000003,00000000), ref: 004375C9
Part of subcall function 00437590: __CxxThrowException@8.LIBCMT ref: 004375EA

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

Part of subcall function 00465987: std::bad_alloc::bad_alloc.LIBCMT ref: 004659C4
Part of subcall function 00465987: __CxxThrowException@8.LIBCMT ref: 004659E6

GetLastError.KERNEL32(?,00000000,80400100,?,00000034,0044B6C3,?,80000000,00000001,00000080,00000003,00000000,00000000,?,00000001,0000014C), ref: 004384F1

Strings

toys::file, xrefs: 004384B0

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8Throw$CloseDecrementErrorH_prolog3HandleInterlockedLast_mallocstd::bad_alloc::bad_alloc
String ID: toys::file
API String ID: 2954558100-314977804
Opcode ID: d7d2d25091da7fdfee5ace0b102b6a9a1d53f57e2957f3508f8af078092d2379
Instruction ID: 3f9232666e79f700d20f48b4c46c130b08fda20a095fae889fabae00ce4622e1
Opcode Fuzzy Hash: d7d2d25091da7fdfee5ace0b102b6a9a1d53f57e2957f3508f8af078092d2379
Instruction Fuzzy Hash: EB31347150030AEFCF10AFB08C819AEB7A1AF19358F00812FF51597592EB399D018B29

Function 0049AF40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 0049AF49

Part of subcall function 004014E0: RegOpenKeyExW.KERNELBASE(?,?,00000000,00000000,00000000), ref: 0040150A

Part of subcall function 00401550: RegQueryValueExW.ADVAPI32(?,00000004,00000000,?,?,00000004), ref: 00401580

Strings

DoVerboseLogging, xrefs: 0049AF79
SOFTWARE\InstallShield\17.0\Professional, xrefs: 0049AF53

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Iterator_baseIterator_base::_OpenQueryValuestd::_
String ID: DoVerboseLogging$SOFTWARE\InstallShield\17.0\Professional
API String ID: 396298244-1048226409
Opcode ID: 853caf3c3ef6e5cac97b3173057f27937cf495381e0122851036b594d1c37f5d
Instruction ID: ef2179874c67c19896fd7e9078c88895b19769c92fb4f6242e9d645eed9db33a
Opcode Fuzzy Hash: 853caf3c3ef6e5cac97b3173057f27937cf495381e0122851036b594d1c37f5d
Instruction Fuzzy Hash: 94016D74C04249AECF04EBA1D861BFEBB74AF10348F1001AAE451731A1EB781A18C7D6

Function 00463BF0 Relevance: 4.7, APIs: 3, Instructions: 249COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00463C42
_memset.LIBCMT ref: 00463C58
_memset.LIBCMT ref: 00463C6D

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

Part of subcall function 00465987: std::bad_alloc::bad_alloc.LIBCMT ref: 004659C4
Part of subcall function 00465987: __CxxThrowException@8.LIBCMT ref: 004659E6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$Exception@8Throw_mallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 31553874-0
Opcode ID: 409078f01c6f3c0cdae470f1de755f0f3ad02144229d75dec643e792b4d70f09
Instruction ID: 03abe57135958dfc1b702f9fa4289c106b31e6a14e0723d8ad734426ff625ee1
Opcode Fuzzy Hash: 409078f01c6f3c0cdae470f1de755f0f3ad02144229d75dec643e792b4d70f09
Instruction Fuzzy Hash: 1BA1B0749007998ACB219F66C8405FEF7F5EF18705F10842FE89ACB251E3389A45CB29

Function 0040BDA1 Relevance: 4.6, APIs: 3, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040BDC0

Part of subcall function 0040B350: __EH_prolog3.LIBCMT ref: 0040B357

_memset.LIBCMT ref: 0040BDEA
_wcscpy.LIBCMT ref: 0040BE05

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$_memset_wcscpy
String ID:
API String ID: 1514613885-0
Opcode ID: d309368448d4c361bd27e1da55f4d3e5d2aa52296b9de0b487f1fc1257f87a8b
Instruction ID: a5851e284c192833eb72721d98f664c4570a39ddfc46fc003b272333c462f682
Opcode Fuzzy Hash: d309368448d4c361bd27e1da55f4d3e5d2aa52296b9de0b487f1fc1257f87a8b
Instruction Fuzzy Hash: 3031A27290424CABDB04EBA5C845AEDB7B4EF18314F14413FE416B71C2EB386B09C799

Function 00437437 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00437473
SetFilePointer.KERNELBASE(?,0000000C,00000000,00000000,?), ref: 00437481
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0043807E), ref: 004374AC

Part of subcall function 0043737D: __EH_prolog3.LIBCMT ref: 00437384

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorException@8FileH_prolog3LastPointerThrow
String ID:
API String ID: 2851322967-0
Opcode ID: 1a238684fd793cdf280dd3fa23c13f4bf2d9848f759f15e74ff7270eb9830714
Instruction ID: e984cb5b1bafb95a677adbefc3eac34d9cebe5e4581e251be7970fbd3c49a62e
Opcode Fuzzy Hash: 1a238684fd793cdf280dd3fa23c13f4bf2d9848f759f15e74ff7270eb9830714
Instruction Fuzzy Hash: 631106B2500104ABCB20AFA0DC05FDF7FA8AB59324F01852EFD96A72D0D778A954C795

Function 004392BC Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004392C3
IsWindow.USER32(?), ref: 004392CE

Part of subcall function 00416366: __EH_prolog3.LIBCMT ref: 00416388

SetWindowTextW.USER32(?,?), ref: 0043934F

Part of subcall function 00415F36: __EH_prolog3_GS.LIBCMT ref: 00415F3D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_Window$H_prolog3Text
String ID:
API String ID: 4269994840-0
Opcode ID: 4041824dc4887152495ad3649b88a85d6f5edd1e3fd0e1931c4092c9c2224bf9
Instruction ID: 6866f36086718aab1a25db9f15e26b9d3a6251f1b61fb302ea1e583996769bd6
Opcode Fuzzy Hash: 4041824dc4887152495ad3649b88a85d6f5edd1e3fd0e1931c4092c9c2224bf9
Instruction Fuzzy Hash: B7116071C00108EBDF14EBE1C985AEDB778AF19315F54402FF412A71A1DB78AE49CB29

Function 00441744 Relevance: 4.5, APIs: 3, Instructions: 42stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00441771

Part of subcall function 0044170F: _wcschr.LIBCMT ref: 00441715
Part of subcall function 0044170F: _wcsncpy.LIBCMT ref: 00441732

lstrlenW.KERNEL32(?,?,?), ref: 0044178D
GetDriveTypeW.KERNELBASE(?), ref: 0044179F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: DriveType_memset_wcschr_wcsncpylstrlen
String ID:
API String ID: 1896732343-0
Opcode ID: 4960fcff5cec98c0c2ef1d2ac8d4b3c0c670059b1eea2ab867bf2911434995ff
Instruction ID: cc347aa3041b434b99ffaa7902e9eb47ea8e6de91d1193db6efb79b2483414a8
Opcode Fuzzy Hash: 4960fcff5cec98c0c2ef1d2ac8d4b3c0c670059b1eea2ab867bf2911434995ff
Instruction Fuzzy Hash: 9B01D1B1D01208ABDB10EBB0DC89EDB77ACEF09304F5045A3E516D3152E638DA848B58

Function 00437590 Relevance: 4.5, APIs: 3, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 004375A1
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,00438401,00000034,0044B6C3,?,80000000,00000001,00000080,00000003,00000000), ref: 004375C9
__CxxThrowException@8.LIBCMT ref: 004375EA

Part of subcall function 00435C6B: InterlockedDecrement.KERNEL32(004DB924), ref: 00435C90

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: DecrementInterlocked$CloseException@8HandleThrow
String ID:
API String ID: 3177066849-0
Opcode ID: c96b21fb0e5db1c0245cbfccf402d0a3f378327decd6805de2f6f006fd8195f0
Instruction ID: de3ad57ec68dc34b9873bc647b755729fadb2aaf5d01d75bcb98548223e57f3f
Opcode Fuzzy Hash: c96b21fb0e5db1c0245cbfccf402d0a3f378327decd6805de2f6f006fd8195f0
Instruction Fuzzy Hash: BAF026B1600700A7DB38AB75DC45B5773E86F04719F00461EE497D39D0EB28DA008648

Function 00442097 Relevance: 4.5, APIs: 3, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00441D63: lstrlenW.KERNEL32(?,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441D6B
Part of subcall function 00441D63: lstrcpynW.KERNEL32(?,?,-00000001,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441D8D
Part of subcall function 00441D63: lstrcatW.KERNEL32(?,?,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441DAD

CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?), ref: 004420D8
CloseHandle.KERNEL32(00000000), ref: 004420E8
DeleteFileW.KERNELBASE(?), ref: 004420F5

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$CloseCreateDeleteHandlelstrcatlstrcpynlstrlen
String ID:
API String ID: 4178870998-0
Opcode ID: 62486d7c4d925a6547c9cb4a58eb2b26f94a8414bf4ea45772d2bcd6219ae2e6
Instruction ID: ce38f5f366918eca1963fbfd4eab7c0a2ef10d690ff1e6d77b763616bce298da
Opcode Fuzzy Hash: 62486d7c4d925a6547c9cb4a58eb2b26f94a8414bf4ea45772d2bcd6219ae2e6
Instruction Fuzzy Hash: 20F012B1A40108BFEF90EB74DE49FAA77ECFB08304F408566FA46D6190DE74D9489B54

Function 0041E650 Relevance: 4.5, APIs: 3, Instructions: 13timeCOMMON

Download Yara Rule

APIs

IsWindow.USER32(004423A8), ref: 0041E656
KillTimer.USER32(000003E9), ref: 0041E66B
KiUserCallbackDispatcher.NTDLL ref: 0041E677

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CallbackDispatcherKillTimerUserWindow
String ID:
API String ID: 990626604-0
Opcode ID: 2ba1859c7aad9b37beab47d9ddb43ffc88ed3cef298bf34dd1363536addb4d3a
Instruction ID: dc15e279bba70621d9c6f1b16fedb20157bdc518a874d9cc32c2b0ec14244ae4
Opcode Fuzzy Hash: 2ba1859c7aad9b37beab47d9ddb43ffc88ed3cef298bf34dd1363536addb4d3a
Instruction Fuzzy Hash: ACD09E35155160DFD7415F21EC98DA83F75BB8A701B490172E402D6BB0DB355C55DB1C

Function 0040C038 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 339COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040C05A

Part of subcall function 00407272: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000001,00000000,?,?,0040C07A,?,?,000000FC), ref: 00407294

Part of subcall function 00405700: CloseHandle.KERNELBASE(?,?,?,004056AF), ref: 00405725

Part of subcall function 004094E6: __EH_prolog3.LIBCMT ref: 004094ED

Part of subcall function 0040944C: __EH_prolog3.LIBCMT ref: 00409453

Part of subcall function 0040BDA1: __EH_prolog3.LIBCMT ref: 0040BDC0
Part of subcall function 0040BDA1: _memset.LIBCMT ref: 0040BDEA
Part of subcall function 0040BDA1: _wcscpy.LIBCMT ref: 0040BE05

Strings

, xrefs: 0040C1E1, 0040C3AC

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$CloseCreateFileHandle_memset_wcscpy
String ID:
API String ID: 981082260-410699589
Opcode ID: ca4d33fb86fc58180f1069ee12973208147919b9091ae93d38d4a7d53c4d086b
Instruction ID: c25501da6bd5f35cb9122dc0272c73fd4653275fdad53475e1486bf9fbbb8371
Opcode Fuzzy Hash: ca4d33fb86fc58180f1069ee12973208147919b9091ae93d38d4a7d53c4d086b
Instruction Fuzzy Hash: AFD14C71804288EADB11EBA5CD95FEE7B78AF15308F1040AEF442771C2EA785F49CB65

Function 0041EA1E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041EA25

Strings

MS Sans Serif, xrefs: 0041EA64

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: MS Sans Serif
API String ID: 431132790-168460110
Opcode ID: 75a5d3d1635898bfb5e19f028afc5475bde6e469e23e5a7d6ee87131e64c76b0
Instruction ID: fbaff0a27f4792b064e05a09904a880f6079099246d80fc3dd4ea41e154a6625
Opcode Fuzzy Hash: 75a5d3d1635898bfb5e19f028afc5475bde6e469e23e5a7d6ee87131e64c76b0
Instruction Fuzzy Hash: 39312831900109EBCF00EF96CC41BEE7BB4BF21348F14009EF9416B192E7799A95DBA8

Function 00423082 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00423089

Part of subcall function 004396FA: __EH_prolog3.LIBCMT ref: 00439719

Strings

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 004230C6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}
API String ID: 431132790-3554130927
Opcode ID: 8877de825fd559a26bf8f1f2dcf1a1f4c79849b78e74c161c623673c83190f15
Instruction ID: 84730419ee43f3ec4637ced087018992c4055cbb7eb04979785853bac26dc9f9
Opcode Fuzzy Hash: 8877de825fd559a26bf8f1f2dcf1a1f4c79849b78e74c161c623673c83190f15
Instruction Fuzzy Hash: 0221FE71A00214AAEF14EF629C16BAE37B49F01305F50452EF412A71D2EB7C9F05CB6A

Function 00439369 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00439373

Part of subcall function 0043791D: __EH_prolog3_GS.LIBCMT ref: 00437924

Part of subcall function 00438D95: __EH_prolog3_catch.LIBCMT ref: 00438D9C

Part of subcall function 004364E1: __wcstoui64.LIBCMT ref: 00436500

Strings

ProductLanguage, xrefs: 00439396

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_$H_prolog3_catch__wcstoui64
String ID: ProductLanguage
API String ID: 1814505495-16373680
Opcode ID: dac262a007350cba84a16f097359c0640e35ca15cd74ed5647ce111da3040b8a
Instruction ID: 5772605c55f28046a8f51ae01ae03131821abf7266e9c8dbd7d3ba88563f97fa
Opcode Fuzzy Hash: dac262a007350cba84a16f097359c0640e35ca15cd74ed5647ce111da3040b8a
Instruction Fuzzy Hash: 9A114C71D40208AFDB04EB95C992BEDB774AF25308F54416EE111B71D2EFB82B09CB5A

Function 00436810 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0043682F

Strings

PackageCode, xrefs: 00436860

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_catch
String ID: PackageCode
API String ID: 3886170330-1525858878
Opcode ID: 4408b1ce568cdae01403d206cdc17d497f791b2861a9a764973cec5fecf0c96f
Instruction ID: 65211e6a6746be30d61032722c2fc432c84583640571b1b6554ab1c3cfdd752a
Opcode Fuzzy Hash: 4408b1ce568cdae01403d206cdc17d497f791b2861a9a764973cec5fecf0c96f
Instruction Fuzzy Hash: 04019EB290120C9FDB24EF61D8457EEB7B0EF18314F10452FD916A7281E7786A488BA9

Function 0040679E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 004067D8

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

Strings

DD@, xrefs: 0040679E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8Throw_malloc
String ID: DD@
API String ID: 3476970888-3855696329
Opcode ID: 51f25bc94addf7f088f99b7892b5f7bee90910dc3ded069cb96bbd2f7e213855
Instruction ID: 9624e1f455576bca6c8910a74bd1ea397cfa2cb9406841dd745fdb73bf61ba2c
Opcode Fuzzy Hash: 51f25bc94addf7f088f99b7892b5f7bee90910dc3ded069cb96bbd2f7e213855
Instruction Fuzzy Hash: 0BE0D871B102045ADF0CEA75D856F5E731D5B41718F204B3FA533E24C1EBB8D529854D

Function 0043F75B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp,0041E6BE,00000000,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0043F763

Part of subcall function 0043F5FF: DestroyWindow.USER32(?,?), ref: 0043F60A

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 0043F75B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Window$DestroyShow
String ID: E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp
API String ID: 2729726617-575188679
Opcode ID: be6dd866e0035436061bc48ae1e3dcc473e0b8573e4598df20b13ed2aa088d71
Instruction ID: fcb5ac3b3b39ab70c05514aa3dbff4f70e916b992f3678271ef3e3927f052a81
Opcode Fuzzy Hash: be6dd866e0035436061bc48ae1e3dcc473e0b8573e4598df20b13ed2aa088d71
Instruction Fuzzy Hash: 15C08C329086606AE3262718DC0ABBA6E815B49708F1495BFF046465F1CBA85C89CB9C

Function 0044B8C6 Relevance: 3.1, APIs: 2, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044B8CD

Part of subcall function 0040992E: __EH_prolog3.LIBCMT ref: 00409935

Part of subcall function 004092AF: __EH_prolog3.LIBCMT ref: 004092B6

Part of subcall function 00448795: __EH_prolog3.LIBCMT ref: 0044879C

GetLastError.KERNEL32 ref: 0044B9AB

Part of subcall function 0042296E: __EH_prolog3.LIBCMT ref: 00422975

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ErrorH_prolog3_Last
String ID:
API String ID: 3513993312-0
Opcode ID: 5c3c79272381d01de55cfafc043bb2646f4e31048446c52fcda620cfe0de0e36
Instruction ID: 8147aff2aa7e63eea241d35d8321dafc1f9f76e1c5c75fce0f23c6076b111dfa
Opcode Fuzzy Hash: 5c3c79272381d01de55cfafc043bb2646f4e31048446c52fcda620cfe0de0e36
Instruction Fuzzy Hash: 7F4194B19001489EEF10FFA9C881AEE7B78EF11358F10016FE91163193EF385A09DB99

Function 004060B9 Relevance: 3.1, APIs: 2, Instructions: 55fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000400,?,00000000,?,00000000), ref: 004060F4
SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,?,00000000), ref: 00406136

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 7d8226832749cb1814f1206b2303272aaa2c613f89807b71d81001533d300eb3
Instruction ID: 18dd10aa7d317e483567ec8869e239b06f9d0cd228d38ea3f5a0b28e1b25d9a5
Opcode Fuzzy Hash: 7d8226832749cb1814f1206b2303272aaa2c613f89807b71d81001533d300eb3
Instruction Fuzzy Hash: 4411C87190415C5FDF219B784CC05EE7FA9AF02314F55416AE552BB183D63449548B58

Function 0043FFBE Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

_memset.LIBCMT ref: 0043FFE3
ReadFile.KERNELBASE(?,00000000,00000138,00000000,00000000), ref: 0043FFF9

Part of subcall function 0043FEB2: __EH_prolog3.LIBCMT ref: 0043FEB9

Part of subcall function 0043FB00: SetFilePointer.KERNELBASE(?,?,?,?,74DF3140,?,00440EA9,00000000,?,00000000,00000000), ref: 0043FB14
Part of subcall function 0043FB00: GetLastError.KERNEL32(?,00440EA9,00000000,?,00000000,00000000), ref: 0043FB1C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$ErrorH_prolog3LastPointerRead_malloc_memset
String ID:
API String ID: 3294864443-0
Opcode ID: d497e9b0b9da9082ad5166969db62893ee829b9af598231db606d1901a506e74
Instruction ID: b02c92fe15cb3dd2896bd903f68362455953115bc83189bec0fa2cb3623e70db
Opcode Fuzzy Hash: d497e9b0b9da9082ad5166969db62893ee829b9af598231db606d1901a506e74
Instruction Fuzzy Hash: 1C01D871601104BBEB159755DC86FEBB76CEF01348F104127BA04A1191DBB89D50C6A8

Function 0044A96F Relevance: 3.0, APIs: 2, Instructions: 50fileCOMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0044A9B2
ReadFile.KERNELBASE(00000000,00000001,00457EB8,00000001,00000000,00000001,?,?,?,?,0044AD42,00000000,00000004,0044B4CA,?,?), ref: 0044A9C4

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8FileReadThrow
String ID:
API String ID: 3069015558-0
Opcode ID: ba41f4e8ffd43df3873950f79380b771c824b165c1b64c80371fa11f7b2d3c48
Instruction ID: db433ebf2e912f67539c93b41a573fb9848b5b56c4a12d8b12ce8dd2b668521c
Opcode Fuzzy Hash: ba41f4e8ffd43df3873950f79380b771c824b165c1b64c80371fa11f7b2d3c48
Instruction Fuzzy Hash: 0401B1B2A40208ABEF10EFA0CC42EEF776CAF15744F01851ABD0AE6185E7789E54C7D5

Function 00437DDC Relevance: 3.0, APIs: 2, Instructions: 50fileCOMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00437E1F
ReadFile.KERNELBASE(?,0000000C,00000000,0000000C,00000000), ref: 00437E31

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8FileReadThrow
String ID:
API String ID: 3069015558-0
Opcode ID: ba41f4e8ffd43df3873950f79380b771c824b165c1b64c80371fa11f7b2d3c48
Instruction ID: 939100f1987d6f551f5182ddb80d4b761ca9e9f9bdb8f11cf1d14f9ea0336a4a
Opcode Fuzzy Hash: ba41f4e8ffd43df3873950f79380b771c824b165c1b64c80371fa11f7b2d3c48
Instruction Fuzzy Hash: C70192B25002086ACF10EA64DC42FEA77689F19715F00815ABD4AA6185E7749E44C694

Function 00453F0E Relevance: 3.0, APIs: 2, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00453F40
__CxxThrowException@8.LIBCMT ref: 00453F55

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 874180af76af7cd5a13fa0f14bc5ad7597b9ff4cb0f37c96ebbac0eb8f35b84a
Instruction ID: ac36b304552ae8a15b5ee5f99edcc79bc23e832b50c2946a6f6080479f2943bf
Opcode Fuzzy Hash: 874180af76af7cd5a13fa0f14bc5ad7597b9ff4cb0f37c96ebbac0eb8f35b84a
Instruction Fuzzy Hash: F8F05C71A101086ACF0CEF64C862A9E737C1B10352F10C62FF813D10C1DBB8D718CA49

Function 0044317C Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00443183

Part of subcall function 00416366: __EH_prolog3.LIBCMT ref: 00416388

SendDlgItemMessageW.USER32(?,?,0000000C,00000000,?), ref: 004431B6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_ItemMessageSend
String ID:
API String ID: 1513654676-0
Opcode ID: 8bb3d56cb99c26a1040308de9edccab3e1b1df83a9b53c424e0525dcb7a7acdc
Instruction ID: c4a54c0265b9a62c13945599c5b6b27d21f89742ba0bff7568dc1ef4e5263c60
Opcode Fuzzy Hash: 8bb3d56cb99c26a1040308de9edccab3e1b1df83a9b53c424e0525dcb7a7acdc
Instruction Fuzzy Hash: 9CF0F871901208EBDF04EF90CD46BDC7778AB16756F50812AF511771A1DB38AA05DB1A

Function 0043FB00 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,74DF3140,?,00440EA9,00000000,?,00000000,00000000), ref: 0043FB14
GetLastError.KERNEL32(?,00440EA9,00000000,?,00000000,00000000), ref: 0043FB1C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e5bb33aabfb4c2363c6d6a302aa4b726f3d2532acdfe8db3fe8f9e66bcda482b
Instruction ID: ba2c9b5ab8aa61979f4a40364869a9952b5cc8068c746aa00ad02679ec146026
Opcode Fuzzy Hash: e5bb33aabfb4c2363c6d6a302aa4b726f3d2532acdfe8db3fe8f9e66bcda482b
Instruction Fuzzy Hash: 8CE0D8325042025BCB114F25DC0888F7EE2DBD8360F10493AF441822B0C730C84BDB90

Function 00406BD7 Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00406BEB
WriteFile.KERNELBASE(?,0000FF03,00000000,?,00000000,?,0040A15B,000000FF,?,?,00000000,00000001,0000FEFF,00000000), ref: 00406BFF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: FileWrite_wcslen
String ID:
API String ID: 1897463218-0
Opcode ID: 6bdd9520979712f2083f0c9f4e225f920ed349155ff3bef15878b4751ba8d98b
Instruction ID: d8c1c58d090710ec0a28997ce0cd87c34cfd2fb9167347a2427c1370d60f9fe8
Opcode Fuzzy Hash: 6bdd9520979712f2083f0c9f4e225f920ed349155ff3bef15878b4751ba8d98b
Instruction Fuzzy Hash: D6E08C32008120EFDA008B04DC09E9ABBA4EF51314F028465F801AB0B2C730FC61CAAA

Function 00440875 Relevance: 3.0, APIs: 2, Instructions: 18fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044087C
DeleteFileW.KERNELBASE(?,00000004,00440E72,?,00000068), ref: 00440899

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: DeleteFileH_prolog3
String ID:
API String ID: 1724573611-0
Opcode ID: 05378265cdb745eb8a2b459a55f09c18334a5781e79c2f96fb11460d478e0db7
Instruction ID: 57baee2507886afcf5330429fe98d2964768ce9e485a2bb547bdefe7faa96627
Opcode Fuzzy Hash: 05378265cdb745eb8a2b459a55f09c18334a5781e79c2f96fb11460d478e0db7
Instruction Fuzzy Hash: 22E08670904615CBDF24FF55C90924D76F1BB42315F004A1EF19267191DB3C5A018F9E

Function 0041E68E Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

IsWindow.USER32(0042D218), ref: 0041E694
ShowWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0041E6A6

Part of subcall function 0043F75B: ShowWindow.USER32(?,00000000,E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp,0041E6BE,00000000,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0043F763

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Window$Show
String ID:
API String ID: 990937876-0
Opcode ID: 6b619b67136f0d1bd48a4d015aade7b5efa4b6290a18aac48466c75185acb204
Instruction ID: 3dbde278bdcb8a58435e5a17f2a877c560fffb9bf6f2dbe3b64ffb5a16e1241b
Opcode Fuzzy Hash: 6b619b67136f0d1bd48a4d015aade7b5efa4b6290a18aac48466c75185acb204
Instruction Fuzzy Hash: E6D0C93A2512509BD6406B25EC99FA43B61BB89701F880076F90AD67F0DF349C40DB1C

Function 00435FD8 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00435FE1
SetWindowTextW.USER32(?,00000302), ref: 00435FF1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Window$Text
String ID:
API String ID: 848690642-0
Opcode ID: f077cb35d0313fb853f2798055cdc7fb294262e2716a8d93a0b8ad9b2de72d8b
Instruction ID: d9ead03a6ae74784a5f9e95fac7fd213e3c27f60226ac53554edb772d74d239e
Opcode Fuzzy Hash: f077cb35d0313fb853f2798055cdc7fb294262e2716a8d93a0b8ad9b2de72d8b
Instruction Fuzzy Hash: D2D01276004111DBDB911F10EC489D6BFA5FF59341F140439F5C192034CB334991DF68

Function 0046ED65 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 0046ED6D

Part of subcall function 0046ED3A: GetModuleHandleW.KERNEL32(mscoree.dll,?,0046ED72,00000001,?,00467A3F,000000FF,0000001E,?,0046EB1E,00000001,00000001,00000001,?,004756DB,00000018), ref: 0046ED44
Part of subcall function 0046ED3A: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0046ED54

ExitProcess.KERNEL32 ref: 0046ED76

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 24e00b67a3949651066a4179d66ce6c956d42ffa858c8a6edca1ff29fd22dffc
Instruction ID: a1211abfe3a363b242a89b7748d213e1a9a976b0dd942c2310c536138b871f2e
Opcode Fuzzy Hash: 24e00b67a3949651066a4179d66ce6c956d42ffa858c8a6edca1ff29fd22dffc
Instruction Fuzzy Hash: C5B09B31000108BBDF012F13DC098493F55EB41354710C025F80805031DF759D519685

Function 004584FE Relevance: 1.8, APIs: 1, Instructions: 308COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00458520

Part of subcall function 0040D11C: __EH_prolog3.LIBCMT ref: 0040D123

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 00457E6F: __EH_prolog3_GS.LIBCMT ref: 00457E76

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID:
API String ID: 4240126716-0
Opcode ID: 43730b9124969ab058b19e6b933441c710f565e1cfe50bbb2980a89659dbf178
Instruction ID: c8f696d77e01c2ee1c755b19670089e6f27809466c0de35ca9b0d0910e9d6ba9
Opcode Fuzzy Hash: 43730b9124969ab058b19e6b933441c710f565e1cfe50bbb2980a89659dbf178
Instruction Fuzzy Hash: BBC19371900248EBDB15EFA5CC51BEE77B8BF14304F00452FE91AA7192EF786A09CB65

Function 00416872 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041688B

Part of subcall function 00415D50: __EH_prolog3.LIBCMT ref: 00415D57

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 5eee1cbb29b1a46d2c1c743973dbfd6c4490700c87141ac43eaaa3498bac466d
Instruction ID: 9093d69f1a0d92c86ca58c9e5867dcaae67ba1d404e4099def9bf843662adb80
Opcode Fuzzy Hash: 5eee1cbb29b1a46d2c1c743973dbfd6c4490700c87141ac43eaaa3498bac466d
Instruction Fuzzy Hash: A851B071C0524CEBDB11EFA9C945ADEBBB8AF51308F10406FF441A7282EB789B49CB55

Function 00424849 Relevance: 1.6, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00424850

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: fca6106e9a19bbf782c2354f1d8f62829c563437256917cda56087de351f840c
Instruction ID: 4ba3274a6483da65f3301cea080fe62e7c207fc2a0a8ccf335d1e5fd7c188227
Opcode Fuzzy Hash: fca6106e9a19bbf782c2354f1d8f62829c563437256917cda56087de351f840c
Instruction Fuzzy Hash: 03316DB0D00209EEDF14FFE1D8865AEBBB4AF01318F50416EE111761A1C7385A49DBA9

Function 00437F77 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00437F7E

Part of subcall function 004375FE: __CxxThrowException@8.LIBCMT ref: 0043763E
Part of subcall function 004375FE: GetFileSize.KERNEL32(?,0000000C,?), ref: 00437649
Part of subcall function 004375FE: GetLastError.KERNEL32(?,00000000,00000001), ref: 00437656

Part of subcall function 00437437: __CxxThrowException@8.LIBCMT ref: 00437473
Part of subcall function 00437437: SetFilePointer.KERNELBASE(?,0000000C,00000000,00000000,?), ref: 00437481
Part of subcall function 00437437: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0043807E), ref: 004374AC

Part of subcall function 00437DDC: __CxxThrowException@8.LIBCMT ref: 00437E1F
Part of subcall function 00437DDC: ReadFile.KERNELBASE(?,0000000C,00000000,0000000C,00000000), ref: 00437E31

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8FileThrow$ErrorLast$H_prolog3_catchPointerReadSize
String ID:
API String ID: 2307766742-0
Opcode ID: ef55fb9caf66c5d96aed30294e2f7571d336428d16a536d36c8989ef1498c616
Instruction ID: b371ad8012d64ff46a81064df6f4b7b96ecd3e8c951294f7c838e57f37a60bb0
Opcode Fuzzy Hash: ef55fb9caf66c5d96aed30294e2f7571d336428d16a536d36c8989ef1498c616
Instruction Fuzzy Hash: F22126F0809789ADEF35C66945445BFB9745B1A328F60134FF1D1621D2CB780E09876B

Function 00438D95 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00438D9C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 04f0b38646e29646346b4d395463bc382f50fda901d5cb02204580fe790eeb05
Instruction ID: 45c40c47e49c2824cd1f6f5e153258a2463d1a4b10807401faa1c03847d091d9
Opcode Fuzzy Hash: 04f0b38646e29646346b4d395463bc382f50fda901d5cb02204580fe790eeb05
Instruction Fuzzy Hash: 163173B0800249DEDB04FFA5C8967EEBBB0AF45318F14815EE1116B1D2CB785E46CBA9

Function 00457509 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00457510

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: d537d2cb9feb4304473e5298fcd576e77c809ce43cb73976b6be6528411a32b2
Instruction ID: 16b02880b746a54b54f12c93a527d672cacce34b05b41db6619e9657a6790857
Opcode Fuzzy Hash: d537d2cb9feb4304473e5298fcd576e77c809ce43cb73976b6be6528411a32b2
Instruction Fuzzy Hash: 2521D671904119AFCB04EFA8C884BEE77A99F04354F08013EF815A32D2EB7C9E45C759

Function 0041EFDE Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041F098

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: fe863bc42846159d48352a8a633352c5946f44213f343d4a82bf4e263bf2df7b
Instruction ID: 3c419cb504da0277082aa446e23594c677e2cde37c88ea667b3a95d29f44f7ca
Opcode Fuzzy Hash: fe863bc42846159d48352a8a633352c5946f44213f343d4a82bf4e263bf2df7b
Instruction Fuzzy Hash: 3D21FF72506395EEDB20DF20A8455DA7FE4AB09304F04803FE44683352D3798ECAE718

Function 0044B418 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044B422

Part of subcall function 00436D7B: __EH_prolog3.LIBCMT ref: 00436D82

Part of subcall function 00437244: __EH_prolog3.LIBCMT ref: 0043724B

Part of subcall function 004383EE: __EH_prolog3.LIBCMT ref: 004383F5

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID:
API String ID: 4240126716-0
Opcode ID: 53714b80ee2e3307d3db4b6ec2c4d9eb47a10df498dfa576f2a6ae0cbeb066e8
Instruction ID: 1fe0b1d08b8c751a178f76e4bf4c356012e29dd3dd62b5e77e9499e1dba9e3a1
Opcode Fuzzy Hash: 53714b80ee2e3307d3db4b6ec2c4d9eb47a10df498dfa576f2a6ae0cbeb066e8
Instruction Fuzzy Hash: E8215E31900358ABEB21DFA4C845BDDB774AF15704F14419EE9487B282DB78AE48CB9A

Function 00407C0B Relevance: 1.6, APIs: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00407C12

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 7e26ad234fb022c02950c7f6c10cb5883a3316996975bab022e8aff62d2a5d45
Instruction ID: ef968f509cbd5b7107859d38fbaa93902aa5a365d543a3a4ace3a8e8e02d0092
Opcode Fuzzy Hash: 7e26ad234fb022c02950c7f6c10cb5883a3316996975bab022e8aff62d2a5d45
Instruction Fuzzy Hash: 5811A271E08106EBDB04EF65858156EB7B6BB44314B20813FE425B72C0D735BE90DBDA

Function 0040BCA5 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040BCAC

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 85964956064fb0dfa66f6f56229cc04dce02b5f3125e087ec024ce2dccffbcc9
Instruction ID: e507caf0069c5f5667fb22d1ada115112ca2db9c093f6fd71b28b778a725be92
Opcode Fuzzy Hash: 85964956064fb0dfa66f6f56229cc04dce02b5f3125e087ec024ce2dccffbcc9
Instruction Fuzzy Hash: 2A111D7180410AAEDF14EF91C851EEEBB74EF11318F20412EA451B71E2DB396A05DBA9

Function 004044D0 Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 004044E6

Part of subcall function 00444710: __EH_prolog3.LIBCMT ref: 00444717
Part of subcall function 00444710: __CxxThrowException@8.LIBCMT ref: 00444742

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_
String ID:
API String ID: 1675473389-0
Opcode ID: b669dc6a0e14e7f4eeeb0eb89759cb6b344a2b383ac403bbe386a7e191f96c47
Instruction ID: 90e81045e8280382fad2610d59598727b81fdd6587b9d7804d6af479b77d381c
Opcode Fuzzy Hash: b669dc6a0e14e7f4eeeb0eb89759cb6b344a2b383ac403bbe386a7e191f96c47
Instruction Fuzzy Hash: DF11EFB4600108FFCB08DF55DA919AD7BB1AF95301F20846AEA056B385D734EF81DB59

Function 00404BB0 Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00404BC6

Part of subcall function 00444710: __EH_prolog3.LIBCMT ref: 00444717
Part of subcall function 00444710: __CxxThrowException@8.LIBCMT ref: 00444742

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_
String ID:
API String ID: 1675473389-0
Opcode ID: 643daab1fe321e859962553602f54f1bd221ba2588e319d59c9920d3ffa8f49d
Instruction ID: af968129dce1783e71956c120e0983ec1756e584d587d4f3515dd9fdbb63a2c8
Opcode Fuzzy Hash: 643daab1fe321e859962553602f54f1bd221ba2588e319d59c9920d3ffa8f49d
Instruction Fuzzy Hash: 41112174A04108FFDB08DF54D691AAE7BB1AFD5301F21856AE9066B381C734EF80DB99

Function 00402190 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMTD ref: 00402210

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: std::exception::exception
String ID:
API String ID: 2807920213-0
Opcode ID: c2cc74a6768703074b5dbacc8cf79a6f6a71b2a7888b49f0b0d4847cd1c67b5c
Instruction ID: f7df40b979a53cc736c9c647793e0e0d3387e51b367a749d68fce6579a7cf168
Opcode Fuzzy Hash: c2cc74a6768703074b5dbacc8cf79a6f6a71b2a7888b49f0b0d4847cd1c67b5c
Instruction Fuzzy Hash: 25112E74904249DBCB04DF98CD55BAEB7B4FB08718F10466EE9267B3C1D7745900CBA8

Function 00415CB4 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00415CBB

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID:
API String ID: 3355343447-0
Opcode ID: f2f121b899218c06a0989e218cd646c3ab8763dc388fe0f335be31666eedeafa
Instruction ID: f251ea296ae252c25c3a03ea8f737be6fb99ea4d6180b45bc8e7ccf60add31df
Opcode Fuzzy Hash: f2f121b899218c06a0989e218cd646c3ab8763dc388fe0f335be31666eedeafa
Instruction Fuzzy Hash: 981170B1E11208EBDF01DBA5C9497DDBB78AF55309F14403FE1016B241DB785A05CB96

Function 00457E6F Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00457E76

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0044B418: __EH_prolog3_GS.LIBCMT ref: 0044B422

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID:
API String ID: 3355343447-0
Opcode ID: ec26f0f82902d079a09ccbc8dcfeb5e7caf895a80171ffa0771032a20d324843
Instruction ID: f581b9fc31759c9333cd24f83423601174ceba691182e37d13611585b7e47074
Opcode Fuzzy Hash: ec26f0f82902d079a09ccbc8dcfeb5e7caf895a80171ffa0771032a20d324843
Instruction Fuzzy Hash: 73115271900218ABDF01EB95CD42FED7778AF15348F50006EF90177292EB796E09CBA6

Function 00437166 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00437170

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 00415D50: __EH_prolog3.LIBCMT ref: 00415D57

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 1dd8564eb8dc2e3494546a28a12b29f040725605422094028c01dbb961f02457
Instruction ID: 921432298a3b2adb3462d0955382c5263d1c61f3add0e73a1d43a93bee9c8fd9
Opcode Fuzzy Hash: 1dd8564eb8dc2e3494546a28a12b29f040725605422094028c01dbb961f02457
Instruction Fuzzy Hash: D6115E7190014CABDB05EFE5C8A6BEE77B8AF15308F10846EB0016B192DB781F49CB65

Function 004115DC Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004115E3

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: 0f972682fb84d59cc5143bd069b355894f174f6e02947a1db8f30b21e0e06410
Instruction ID: e752b9937d6d803a3f935502071787ef446fa09bc234754f4789a32e91a59068
Opcode Fuzzy Hash: 0f972682fb84d59cc5143bd069b355894f174f6e02947a1db8f30b21e0e06410
Instruction Fuzzy Hash: 8B11A071801288AFDF11EBE1C951DDE7B389B11344F24416FE151671A2E63A6B08DB49

Function 004405AB Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004405B2

Part of subcall function 00440420: __EH_prolog3.LIBCMT ref: 00440427
Part of subcall function 00440420: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000038,004405E5,?,?,00000000,?,?,00000010,004406AC), ref: 00440455
Part of subcall function 00440420: GetLastError.KERNEL32(?,?,00000010), ref: 0044046A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$CreateErrorFileLast
String ID:
API String ID: 2779009850-0
Opcode ID: 8aa36844220c513bd1740e1ef4ff3fa4d81f6d410d83d56cee53b7a999d02383
Instruction ID: 02658da7c5fdd49fbf9e1d9bec8fa825674a50a7a93a108fd289ce83cedfb860
Opcode Fuzzy Hash: 8aa36844220c513bd1740e1ef4ff3fa4d81f6d410d83d56cee53b7a999d02383
Instruction Fuzzy Hash: 07113971C0010AAADF01EFE5C9429EFBBB4AF04304F54416AE611B7292D7785B159BA6

Function 00408523 Relevance: 1.5, APIs: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00408533

Part of subcall function 00444710: __EH_prolog3.LIBCMT ref: 00444717
Part of subcall function 00444710: __CxxThrowException@8.LIBCMT ref: 00444742

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_
String ID:
API String ID: 1675473389-0
Opcode ID: 57dbad407c8efedd3e8cf473e25a9398e0f8da5554484a9f9e355834e9f3c52d
Instruction ID: c18739604deb95a58ab81d6c3d270530d1abff238f857c89aa0a5cf983a55a94
Opcode Fuzzy Hash: 57dbad407c8efedd3e8cf473e25a9398e0f8da5554484a9f9e355834e9f3c52d
Instruction Fuzzy Hash: C1F0BB7170851079D621A539AE4093F55969FD1764F11093FF4D3A32C1CE789941819F

Function 0044AD23 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044AD2A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 1d8b714c6bcfe26e166d1b2c26cbbaa6ed175c5462c0da24d4aac96cc3d90608
Instruction ID: bf44306056557cab329f025e950577f265b2663152b4231993646392475518e7
Opcode Fuzzy Hash: 1d8b714c6bcfe26e166d1b2c26cbbaa6ed175c5462c0da24d4aac96cc3d90608
Instruction Fuzzy Hash: EEF0C2B2D404616BFB04B6698C0277E62A7BFD0316F0A442FE81097652EF7D8D11568A

Function 004014E0 Relevance: 1.5, APIs: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,00000000,00000000), ref: 0040150A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d4b8903daa2e7f42f7bc90d0dd7b2f1054107ce760ce95ee72b097d9476cc1af
Instruction ID: b25d50c860270f58a9f8b0c7d9f089355404de07402777e65d914fd3505c50c5
Opcode Fuzzy Hash: d4b8903daa2e7f42f7bc90d0dd7b2f1054107ce760ce95ee72b097d9476cc1af
Instruction Fuzzy Hash: 2C01CD75D00208EFCB04DF94D985AAEBBB9EB48304F10C5AAE815AB390D7349A50CB54

Function 00407272 Relevance: 1.5, APIs: 1, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000001,00000000,?,?,0040C07A,?,?,000000FC), ref: 00407294

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 57e6ce964e83127c9f15d8b8672d81d01c99ec4dcd0f0488ec9be79cd70578b4
Instruction ID: 596e6df50d7dd6c6de98c410acfaf912ad5d98241d6794f4fe5a7b9362af4444
Opcode Fuzzy Hash: 57e6ce964e83127c9f15d8b8672d81d01c99ec4dcd0f0488ec9be79cd70578b4
Instruction Fuzzy Hash: 39F02731308200FBC5A0CA18CC85F9AB7E9BB56720F20056FF505B76C0C779B452C79A

Function 0042DCC6 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0042DD00

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8Throw_malloc
String ID:
API String ID: 3476970888-0
Opcode ID: ae9ec6f26a0cbab816825862a6a5a85cca92ef6f1a5630837f889e1b351f1ebc
Instruction ID: 4c6a40b8bc3ca9575e1ee5f4db878cb7df40ca06cf352ec1b8495b7411fcbc0e
Opcode Fuzzy Hash: ae9ec6f26a0cbab816825862a6a5a85cca92ef6f1a5630837f889e1b351f1ebc
Instruction Fuzzy Hash: C1F0A774B103045ADB0CEB36D562E2E73695B81714F20467FA413D72D0EFB4D914CA09

Function 0040CDBB Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0040CDF5

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8Throw_malloc
String ID:
API String ID: 3476970888-0
Opcode ID: 1c84b7d6b473b0251f566d2feb97b9b5817776daaccaf42815d13579a262ccf8
Instruction ID: ecf345dabdf4f3b21e4888254b212ac986141e28d0765c9ac839ba74612b833a
Opcode Fuzzy Hash: 1c84b7d6b473b0251f566d2feb97b9b5817776daaccaf42815d13579a262ccf8
Instruction Fuzzy Hash: C6E0687062020468CF0CA734A862FAE775D5B41718F204B3FB823F10C1DFB4C909444D

Function 00460C04 Relevance: 1.5, APIs: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00460C27

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: String_base::_Xlenstd::_
String ID:
API String ID: 1541887531-0
Opcode ID: 10f7cadd08943fd80d397a6c73d9cd216576e0e22e5bdabaa95323b0adeab5cf
Instruction ID: 9b75b25936d2f172677d588766c79108b0408ecc913b1d9add0a8927da8af863
Opcode Fuzzy Hash: 10f7cadd08943fd80d397a6c73d9cd216576e0e22e5bdabaa95323b0adeab5cf
Instruction Fuzzy Hash: 40F065B39047009E87749F3DA80042BF7F5AEE87103114E2FE55AC3A01E738A5464A6A

Function 0040683F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00406879

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Exception@8Throw_malloc
String ID:
API String ID: 3476970888-0
Opcode ID: 46da4a8242ba7f87ccceb4129ee35e9f4a739cabb8720718bf87de2a1ad8851a
Instruction ID: b9d617974c31516c730c71d783a04f550dfb28f89b72e41a87561327852989fe
Opcode Fuzzy Hash: 46da4a8242ba7f87ccceb4129ee35e9f4a739cabb8720718bf87de2a1ad8851a
Instruction Fuzzy Hash: 6FE0DFB1B1020829DB0CB6758D66F6EB31D1B51755F208B3FA923E10C1EFB8D928844D

Function 0040B4DB Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040B4E2

Part of subcall function 0040B476: __EH_prolog3.LIBCMT ref: 0040B47D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch
String ID:
API String ID: 1882928916-0
Opcode ID: e88461d700895c9b5d1d6279c8105f1bd5d4a6595922a0812c402092d6494c29
Instruction ID: 121eb8a9ef5e1f1320143c75d076c6925dabc1b65f95044f7105b9053f767103
Opcode Fuzzy Hash: e88461d700895c9b5d1d6279c8105f1bd5d4a6595922a0812c402092d6494c29
Instruction Fuzzy Hash: 62F0E232900209EFDF01EFD8894198D7EB1EB08314F10415EF600672D2C3764F2097DA

Function 0042E48C Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0042E493

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 19276115da75f2e06e8f627853113047ec7752a52516c3a51a69d383a9a66632
Instruction ID: 388f2cd8946ab282f86d3d19a0796bc0a3c977a759323c439f32697cc9d7b222
Opcode Fuzzy Hash: 19276115da75f2e06e8f627853113047ec7752a52516c3a51a69d383a9a66632
Instruction Fuzzy Hash: 54F0A0716002459FDB15FFA595C166D3AE0AF12308FA541AEE1054F3E2DB794E48C719

Function 00407695 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040769C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: be508f07c17963113050bb2a96732e56282f71250c164ffa0514ccac8f19a11d
Instruction ID: bef0e626fd78ff5ac75623935295176d7436b16f5a7d2b06cbdac4b11fd4c501
Opcode Fuzzy Hash: be508f07c17963113050bb2a96732e56282f71250c164ffa0514ccac8f19a11d
Instruction Fuzzy Hash: FBF0A071505241DEDB15AFA881D1AAD3EE0AF02328F2544BED2065F2E2EB3A6D48C716

Function 0043FA98 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000400,00000001,?,00000008,0044062A,000000FF,?,?,004402F2,.debug,?,?,0000001C,00000054,0044040B,?), ref: 0043FABA

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 4e4550b4c91f0d51200bbf9a3b824b63582b124fa8a8f1b1c867b78dda57bec1
Instruction ID: 0e706c455d36a6cf85149ed5c794da614940e59e6889a758658e3dc1a009720d
Opcode Fuzzy Hash: 4e4550b4c91f0d51200bbf9a3b824b63582b124fa8a8f1b1c867b78dda57bec1
Instruction Fuzzy Hash: B7E0207134470197DB30DBE44CC4AB7A2D3E7C5711F118935F66AD14C0E6E4A88DD218

Function 0040B476 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B47D

Part of subcall function 0040B3E7: __EH_prolog3.LIBCMT ref: 0040B3EE

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 697a8f5dd147aa10962548276597056b5ccd85d27bcb2ba05afb4a0f648e29c2
Instruction ID: 602b97035367db150a561abf1821d2762034c6c0d3ee86fb5d1c201a2927a186
Opcode Fuzzy Hash: 697a8f5dd147aa10962548276597056b5ccd85d27bcb2ba05afb4a0f648e29c2
Instruction Fuzzy Hash: 2DF0587490075ACFCB20EF68C44068EBBF0AF19320F10851EF9A587381D334EA00CBA5

Function 0044BA1C Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044BA23

Part of subcall function 0040A7C0: __EH_prolog3.LIBCMT ref: 0040A7D9

Part of subcall function 0044B8C6: __EH_prolog3_GS.LIBCMT ref: 0044B8CD
Part of subcall function 0044B8C6: GetLastError.KERNEL32 ref: 0044B9AB

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ErrorH_prolog3_Last
String ID:
API String ID: 3513993312-0
Opcode ID: 1aba40434559c14e49a8b729a78150c89e4cd517b238df0e1ef544dd0b945ca1
Instruction ID: 0280e9b0c67e50909873149b80e213d0c374c313ddd433098fae1e5cb92e240f
Opcode Fuzzy Hash: 1aba40434559c14e49a8b729a78150c89e4cd517b238df0e1ef544dd0b945ca1
Instruction Fuzzy Hash: 57E08CE4901200AACF00BF7588024AE37A8AF12744F00402EBC2187292EF3DC708869A

Function 004767A7 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 004767BC

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: ff80a1c35c77f65006c375e88c6b1ab590a6cece301d9ae3c3a9f36d63305919
Instruction ID: ab1a6728d9bccc5bfc48ecac65d36beee14f158d0b95c6549619c508d6a6170f
Opcode Fuzzy Hash: ff80a1c35c77f65006c375e88c6b1ab590a6cece301d9ae3c3a9f36d63305919
Instruction Fuzzy Hash: BFD05E369903495AEB005FB17C48B623BDCE384795F008476B80CC6150F674C540CA48

Function 00455212 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00455219

Part of subcall function 00454C6D: __EH_prolog3.LIBCMT ref: 00454C74

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch
String ID:
API String ID: 1882928916-0
Opcode ID: c6dc2b431fff83facaa4737d67f7686b456580b4e7b636c1e3134e1cdb73c1cd
Instruction ID: ed71e4c11a9cb4b71b80f35cf58ae9db816f08201031bc308e076824357f8ff3
Opcode Fuzzy Hash: c6dc2b431fff83facaa4737d67f7686b456580b4e7b636c1e3134e1cdb73c1cd
Instruction Fuzzy Hash: 8EE04F328043199BDF00AF15D8426DE37A0BF41326F65445AFC116B281DB39AE14CB99

Function 0045564A Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00455651

Part of subcall function 004551C0: __EH_prolog3.LIBCMT ref: 004551C7

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch
String ID:
API String ID: 1882928916-0
Opcode ID: 2583de08fcdac99d5320ebf039658b6eec93f297a6b17dab01a14615461f0035
Instruction ID: fafb13e5f54324a905ee0c3dfc33da1ddd5a390d0d199368d6d33b5a6adbee67
Opcode Fuzzy Hash: 2583de08fcdac99d5320ebf039658b6eec93f297a6b17dab01a14615461f0035
Instruction Fuzzy Hash: CFE04F369047599BDF00AF14CC4279E37B0BF01325F95440AFC242B241D779AD14CB89

Function 004617B2 Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004617B9

Part of subcall function 004611FD: __EH_prolog3_catch.LIBCMT ref: 00461204

Part of subcall function 0046128A: __EH_prolog3_catch.LIBCMT ref: 00461291

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_catch$H_prolog3
String ID:
API String ID: 3796446187-0
Opcode ID: 988b2f2bc381402b393d0c38e9ae66d2005b5fc8a2b4b90de2f66738290d5ed7
Instruction ID: fe3f0b9025748828172a93b50455858992c0869612e82668c87ec5a91adb072b
Opcode Fuzzy Hash: 988b2f2bc381402b393d0c38e9ae66d2005b5fc8a2b4b90de2f66738290d5ed7
Instruction Fuzzy Hash: 79E026720005409AC701EF92C4006DE77F47F2A300F04004FF20183652DB38A645C7DB

Function 0043205D Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00432064

Part of subcall function 00432034: __EH_prolog3.LIBCMT ref: 0043203B

Part of subcall function 0042FF00: __EH_prolog3.LIBCMT ref: 0042FF07

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: c8f1714277a244dbfb5ca43119a328c4ffa523c615036c37d0c5e522287ae5ae
Instruction ID: 8e492bba09222986b39e305065303562f7751f26c7bde92030fafe34b2334e5b
Opcode Fuzzy Hash: c8f1714277a244dbfb5ca43119a328c4ffa523c615036c37d0c5e522287ae5ae
Instruction Fuzzy Hash: 5CE0DF70901760CBCB24FF28C10138EBAF06F26718F00425EF2948B281CBB89B04C79A

Function 0040B3E7 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B3EE

Part of subcall function 0040B3C1: __EH_prolog3.LIBCMT ref: 0040B3C8

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: c4859cc409c78ce740edbec6d9659b00314b81f17f92fd1e2ab9438dedc9b578
Instruction ID: 4ad154bf63f89da7c6f44be3e8d57e983674726450edd8970a5ed660e52875b5
Opcode Fuzzy Hash: c4859cc409c78ce740edbec6d9659b00314b81f17f92fd1e2ab9438dedc9b578
Instruction Fuzzy Hash: 92E0C2B69016109BCB10FF59D80169E76B0AF91728F22432EB110A72C3CB7C5B01C7DD

Function 00415C78 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00415C7F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 32affe23985e2736fbe4bdbd69900a3a38ba5bf725e1119267e2b31cafb5087e
Instruction ID: e3baba8cb384c5edcf452891ec9edefe114e39ca97b11b64583d2ed70da31169
Opcode Fuzzy Hash: 32affe23985e2736fbe4bdbd69900a3a38ba5bf725e1119267e2b31cafb5087e
Instruction Fuzzy Hash: 2EE08C70A04611DACB21AF19C8023CD7AA0AB40314F00822EB0506A2D0D7BC4A41CB8D

Function 0040C49C Relevance: 1.5, APIs: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040C4A3

Part of subcall function 00407192: char_traits.LIBCPMTD ref: 004071B7

Part of subcall function 0040C01A: __EH_prolog3.LIBCMT ref: 0040C021

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$char_traits
String ID:
API String ID: 3598086826-0
Opcode ID: be01d6fbdeb77401fff69aa557d73e48c0b971e715396910fd4080bea0d57bce
Instruction ID: 9a6f7a18e6b49f617010eb5465971e74bd5cc826fe91ed8c0c906e9aea9537be
Opcode Fuzzy Hash: be01d6fbdeb77401fff69aa557d73e48c0b971e715396910fd4080bea0d57bce
Instruction Fuzzy Hash: 25D05E70A01210D7DF24FFA5C80379C76A1BB81728F50436EB1617A1D2DBBC2B01D68E

Function 0040B38F Relevance: 1.5, APIs: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B396

Part of subcall function 0040B371: __EH_prolog3.LIBCMT ref: 0040B378

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 5264f66aec1ba6285402d11d9fd74fba03a07686dea51a9ae910dc0b7bb44924
Instruction ID: 3e58c8e51a350353ccf764e604d9a9d1022bfbf262caaa80f82f384bb9bd5dae
Opcode Fuzzy Hash: 5264f66aec1ba6285402d11d9fd74fba03a07686dea51a9ae910dc0b7bb44924
Instruction Fuzzy Hash: 4AD05B70944711DBEF24FF51880379C75609B41725F50425EB551761C1DFBD1B01869E

Function 004936E0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004936FD

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 4019c870a085e68acb74fec8da762344846fd86adea08162f2c5a06e84f3d506
Instruction ID: e349d028e456eec8dc5aa446e886f1fab4fa34748766d9fb6bfb8ecf184fb343
Opcode Fuzzy Hash: 4019c870a085e68acb74fec8da762344846fd86adea08162f2c5a06e84f3d506
Instruction Fuzzy Hash: 95D017B200024DABCF08DF58C986AAE37A8BB00318F04842ABD2C4A340E634EA60CB45

Function 00432034 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043203B

Part of subcall function 0042EECF: __EH_prolog3.LIBCMT ref: 0042EED6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 2cd1ebcecc3a56bf65d9c46990b18cdedd44ad03e2bfa1ac7aa421e1594dbe17
Instruction ID: a214493c5edffe3c217d9464e30d7d5a48d7e83264546e90ebd04a6359a34f76
Opcode Fuzzy Hash: 2cd1ebcecc3a56bf65d9c46990b18cdedd44ad03e2bfa1ac7aa421e1594dbe17
Instruction Fuzzy Hash: 1FD09E75D001099ADF10FFDAC5429CE7ABCAF46315F51425BA121A6191DA385B048756

Function 0041E64A Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0041E6A6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 6e894d07a251c9c3703c6738bfcf139d654cec2b5ea7538de8ae53a26825e837
Instruction ID: 557d57cc02df892b4409e71ff2e5a03de4342ad2680ebddac4e5e8fe9e3fc966
Opcode Fuzzy Hash: 6e894d07a251c9c3703c6738bfcf139d654cec2b5ea7538de8ae53a26825e837
Instruction Fuzzy Hash: 99D0A93A649140CBC7849BA48C28BD83B20EB89300F880267DC0D8A7A2EA2888448769

Function 0041E61D Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

CreateDialogIndirectParamW.USER32(?,00000000,?,?,?), ref: 0041E638

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CreateDialogIndirectParam
String ID:
API String ID: 957745035-0
Opcode ID: 14a289a5611d4e92b38b66bad4e79e482da910dfd1da497743cefeef41d06b98
Instruction ID: e0716b6ab2e97e57e676aa520606c7922f56a07426ca4496c0abe278ca7ba178
Opcode Fuzzy Hash: 14a289a5611d4e92b38b66bad4e79e482da910dfd1da497743cefeef41d06b98
Instruction Fuzzy Hash: 26D0923100020DBBCF025F91EC118AA3F2AFB08254B008014FD1801120CB329970AB98

Function 00454C6D Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00454C74

Part of subcall function 00454B64: __EH_prolog3.LIBCMT ref: 00454B6B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: a14f750682ddf63cd97fee154607585b8b11cee0640b1adccff8f355ecdfdfdf
Instruction ID: d8a21810d580459ed43abcb2a34a082888c24aaa502db67df47db408a0ab13f9
Opcode Fuzzy Hash: a14f750682ddf63cd97fee154607585b8b11cee0640b1adccff8f355ecdfdfdf
Instruction Fuzzy Hash: FAD05E74901205ABEF08BF41C4023AD3660AF8130AF40C01EB9054A241CB3C8A40C64D

Function 004551C0 Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004551C7

Part of subcall function 00455079: __EH_prolog3.LIBCMT ref: 00455080

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 37386f0cec4b1d297259ab05a483c74c009c30d312e4fc07b8cf67102c13fec5
Instruction ID: 38847cd0542fb98bd65b6609a8498e1797e39c49a951cbe834dcf181110c0a8f
Opcode Fuzzy Hash: 37386f0cec4b1d297259ab05a483c74c009c30d312e4fc07b8cf67102c13fec5
Instruction Fuzzy Hash: 8CD0A7745002049BDF04BF41D4123AD3F60FF41306F00841EBD044A342DB7C4B00C64D

Function 0040B2A2 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B2A9

Part of subcall function 004090DF: __EH_prolog3.LIBCMT ref: 004090E6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 9ef4589c986540b5df83d657b4f0a57a25774e699039c2a6aff33fad5176322e
Instruction ID: e2f34d9956b907099961ffa1c56ff1efbf0a2ad316e6d793aa206ee0368e483e
Opcode Fuzzy Hash: 9ef4589c986540b5df83d657b4f0a57a25774e699039c2a6aff33fad5176322e
Instruction Fuzzy Hash: D4D09E75D0120AAADF10FFD9C5429CE7AB8AB45315F50426BA111B61D1DA385B048756

Function 004614CD Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004614D4

Part of subcall function 00456726: __EH_prolog3.LIBCMT ref: 0045672D

Part of subcall function 00460FDE: __EH_prolog3.LIBCMT ref: 00460FE5

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 2e225e5dca603ed6e95529f8e90d54ee96fb3d40fac4150ea0cf7300d8da7ab6
Instruction ID: 15c84d4141cb1ea34893d90b2cc998b0d72f868c1108a8559ef0749e85c36fc8
Opcode Fuzzy Hash: 2e225e5dca603ed6e95529f8e90d54ee96fb3d40fac4150ea0cf7300d8da7ab6
Instruction Fuzzy Hash: 3FD05E3090061087CB24FF65840229D75A06B42329F41434FA051671D2EF7C1B04C69E

Function 00457764 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045776B

Part of subcall function 00456726: __EH_prolog3.LIBCMT ref: 0045672D

Part of subcall function 0045674E: __EH_prolog3.LIBCMT ref: 00456755

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 24a8e60dfe1015294adc6ee145c4ea67a0786b81aadd9a39c156f41e2b800fd3
Instruction ID: 737e4923c1bafa3ebd920f2ba5796e613af0c01d04948cdceeb8c9997b53fa3c
Opcode Fuzzy Hash: 24a8e60dfe1015294adc6ee145c4ea67a0786b81aadd9a39c156f41e2b800fd3
Instruction Fuzzy Hash: 3CD05E3050021087CB14FF65840229C75A06F4632AF81434EB451571D2DF7C0B44C78E

Function 00437F45 Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00437F4C

Part of subcall function 00437590: InterlockedDecrement.KERNEL32(?), ref: 004375A1
Part of subcall function 00437590: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,00438401,00000034,0044B6C3,?,80000000,00000001,00000080,00000003,00000000), ref: 004375C9
Part of subcall function 00437590: __CxxThrowException@8.LIBCMT ref: 004375EA

Part of subcall function 00436C33: __EH_prolog3.LIBCMT ref: 00436C3A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$CloseDecrementException@8HandleInterlockedThrow
String ID:
API String ID: 3917188519-0
Opcode ID: 265944a97d3d0018ac8e090b8bd654390505553473908c3fbe50e1cce401ac6e
Instruction ID: 2d012135b5e7aaad02d1f13c9d1030aa7e3e187d028a2a5efd8bd878e1a82141
Opcode Fuzzy Hash: 265944a97d3d0018ac8e090b8bd654390505553473908c3fbe50e1cce401ac6e
Instruction Fuzzy Hash: 06D05BB04046169BDB14FF99C40164D76F0AF1A325F65874FA198531D2DB7C0601CA5D

Function 00456726 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045672D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 5414ffbb2796686eff36c070bb8bbafb0add0cba2368cc727f786cb685f4ad36
Instruction ID: b5a8ba73885ff03ba65f36ebfe9f9b9f5fc35c6dda60150c8e3210b9f0aed0c0
Opcode Fuzzy Hash: 5414ffbb2796686eff36c070bb8bbafb0add0cba2368cc727f786cb685f4ad36
Instruction Fuzzy Hash: C3C0127580415087DF14BF61D40234C73A1AF4275AF51045FB54017193DF7D4E40868E

Function 004548C2 Relevance: 1.5, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004548C9

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: f7b2d35faac1ad10b3bd16f12819de5668faab3315eb606f10f16dbeac022faf
Instruction ID: d9b21fe26f48203fc21785c811d32cd7727e315853dc1bb393bdcae0f3ca77e7
Opcode Fuzzy Hash: f7b2d35faac1ad10b3bd16f12819de5668faab3315eb606f10f16dbeac022faf
Instruction Fuzzy Hash: 16D0C97851022187CB14FFA585423AD75A06F42B1AF85445FB14156192EF7C1A00CA9E

Function 004548EC Relevance: 1.5, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004548F3

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 4aa766e8414e8fc296cd71a5bd7c71abdd7e302a40559e04c9d2629a629cd103
Instruction ID: 4f24e1369a28024ebcd56fcc853c362928720626d4148c076a7b268bceb62d4c
Opcode Fuzzy Hash: 4aa766e8414e8fc296cd71a5bd7c71abdd7e302a40559e04c9d2629a629cd103
Instruction Fuzzy Hash: E5D0C97050162197CF14FB5189023AD61A06F41719F81446EB14166292EFBD1E00CA9E

Function 00408E88 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00408E8F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 6b9b5dd20119aecc9c6c8426db1af77b6703976425ea185a30869d76247fde87
Instruction ID: 09f56fcf4e7d2bd08a9f2399a679133195426775baad1d143075387af9f0dbe7
Opcode Fuzzy Hash: 6b9b5dd20119aecc9c6c8426db1af77b6703976425ea185a30869d76247fde87
Instruction Fuzzy Hash: 96C02B720082307E89253221A802C7FAF05DFC0330B00C82FFC8411270CE398CA0C0AB

Function 0040AF28 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040AF2F

Part of subcall function 00408505: __EH_prolog3.LIBCMT ref: 0040850C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 157fda726e31925f06330221ed17ea76d33ae5d3a0a31f371327c65ce9ee47ed
Instruction ID: 03b27e616acaf03cc7880ebb5e04eb805faf4420bee97c4e443ac3cd0e60df65
Opcode Fuzzy Hash: 157fda726e31925f06330221ed17ea76d33ae5d3a0a31f371327c65ce9ee47ed
Instruction Fuzzy Hash: 50D0C9B090425597DF14FFA5C90339D7A70AF42329F51426EA121761D2DB7C0A009A5A

Function 00401260 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 0040126D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 6860b29048ae4c27b4f34ebb1a590837a35754f5e604498053e0bf1981ab16c6
Instruction ID: d9110cc41942385d5d8b95e213a28e05c44fd7978349349a4408709d85e75818
Opcode Fuzzy Hash: 6860b29048ae4c27b4f34ebb1a590837a35754f5e604498053e0bf1981ab16c6
Instruction Fuzzy Hash: 44C08CB250C20CBBC700CFC8FC01E6ABBACD709301F00816AFE0883340C531592086A9

Function 00415D50 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00415D57

Part of subcall function 00415CB4: __EH_prolog3_GS.LIBCMT ref: 00415CBB

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID:
API String ID: 3355343447-0
Opcode ID: 325285ee167082f63e15e8fcb4e0d651835428a0a4cd665504e00a72b6d69a6c
Instruction ID: be58d7a432c9042c6645f64a45c4be66ae02bdbea7ced20ef187312f5edd26a1
Opcode Fuzzy Hash: 325285ee167082f63e15e8fcb4e0d651835428a0a4cd665504e00a72b6d69a6c
Instruction Fuzzy Hash: 45D0C7B5500215DBDF00FF51C8067DD76B0BF5135DF00442AF50059152D7BD5A4587CD

Function 0040BE9E Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040BEA5

Part of subcall function 00408802: __EH_prolog3.LIBCMT ref: 00408809

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 959779acc8b1bd7fbf695e4f5bc4dd22a8a888656000bf9d018c9e70d6e769cf
Instruction ID: 5d251e673789ee14c7224451a941824aaf4e5ca2fe7824585d6198dc86aa250a
Opcode Fuzzy Hash: 959779acc8b1bd7fbf695e4f5bc4dd22a8a888656000bf9d018c9e70d6e769cf
Instruction Fuzzy Hash: DFD0C97090522596DF04FFA5C90739DB6B0AF42329F51826EA121661D2CB7C0A009B9E

Function 0046EFF9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 0046F005

Part of subcall function 0046EECD: __lock.LIBCMT ref: 0046EEDB
Part of subcall function 0046EECD: __decode_pointer.LIBCMT ref: 0046EF12
Part of subcall function 0046EECD: __decode_pointer.LIBCMT ref: 0046EF27
Part of subcall function 0046EECD: __decode_pointer.LIBCMT ref: 0046EF51
Part of subcall function 0046EECD: __decode_pointer.LIBCMT ref: 0046EF67
Part of subcall function 0046EECD: __decode_pointer.LIBCMT ref: 0046EF74
Part of subcall function 0046EECD: __initterm.LIBCMT ref: 0046EFA3
Part of subcall function 0046EECD: __initterm.LIBCMT ref: 0046EFB3

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 1dce3d099df6030308b11b4e5282fa59fb5a5cc2a06f442f6e01c11de33cb57a
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: F3B0927658020833DA202543EC03F063A8A87C0B64E240061BA1C191A1A9A3B961848A

Function 0040B2CB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B2D2

Part of subcall function 0040B0F1: __EH_prolog3_catch.LIBCMT ref: 0040B0F8

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch
String ID:
API String ID: 1882928916-0
Opcode ID: 55abd3304751639f74737b69d3d4e8a2ce9902fd7dff4e546cdf2d8f50d5ffbe
Instruction ID: bafb538e75531c53f585da1dd6cb3a5f554d1cceb01b212ba6c8b6d38a574a6f
Opcode Fuzzy Hash: 55abd3304751639f74737b69d3d4e8a2ce9902fd7dff4e546cdf2d8f50d5ffbe
Instruction Fuzzy Hash: C7D0C970900116DACF10BF65C90255EBA60EB42314F01822AB1206A1E1D7784A109689

Function 00401280 Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0040128B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: c50d04b4492d960cc47e8b5be73ffab8489255252cd918e6a77661e698d9c527
Instruction ID: c4325aceec6e116de335610e8e2275fbebfc228470563ccdc8713903a6984058
Opcode Fuzzy Hash: c50d04b4492d960cc47e8b5be73ffab8489255252cd918e6a77661e698d9c527
Instruction Fuzzy Hash: 51C04C7690930CA78B44DFD9E84585ABBACE719751B008159FD0883300D5719A6497A9

Function 0040B3C1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B3C8

Part of subcall function 0040B2CB: __EH_prolog3.LIBCMT ref: 0040B2D2

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 6c5b1496366d2a434ab89791ff383bf25cb9689db3ad3a2b892bda00f69d2ea4
Instruction ID: cbe602f7fd42ca9c2e62372a031c9c505563bd51c683a7df23c0a2fd7f1e2046
Opcode Fuzzy Hash: 6c5b1496366d2a434ab89791ff383bf25cb9689db3ad3a2b892bda00f69d2ea4
Instruction Fuzzy Hash: 9AD012749001199BCF00FF55CC0755D7A70FF41364F00423EB2206A1E1D7785A01C74D

Function 0043F5FF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 0043F60A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: a0f6590a0f7e58e2259ae5e29ee54474887ea6ba350dc284f5e92555f868dac3
Instruction ID: 3b1025f6ab4c0dfdd33e912a38522616fb9585e09e8f9087f9d8eef5d944bd9d
Opcode Fuzzy Hash: a0f6590a0f7e58e2259ae5e29ee54474887ea6ba350dc284f5e92555f868dac3
Instruction Fuzzy Hash: 03C02B3160471047CB304F28F80875333DC5F0D711F00882EB0A9C3110C774EC04865C

Function 004086C6 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004086CD

Part of subcall function 0040840D: __EH_prolog3.LIBCMT ref: 00408414

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: df4ff80bae0468222293139e172d8bb4a7fcef41c3e282b06e2e89a248e277d2
Instruction ID: 6835045d946da53b7ce380e6682541844e6f3bfcd7b0822bf109267118a963fa
Opcode Fuzzy Hash: df4ff80bae0468222293139e172d8bb4a7fcef41c3e282b06e2e89a248e277d2
Instruction Fuzzy Hash: 90C08CB480120682CF04BBF1880220E65A0AB42324F50036EA2201A2C2EB3C02008A2A

Function 0040B350 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B357

Part of subcall function 0040B2A2: __EH_prolog3.LIBCMT ref: 0040B2A9

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: d8b2a30ee012b84e481a2f8b63c88a0f19a390cec8bf65ac6f6d6987fe3f398d
Instruction ID: 76b43394b8e9da207550cb3345a1b146e3d20fdd6adc877e9d05b04af8f2d851
Opcode Fuzzy Hash: d8b2a30ee012b84e481a2f8b63c88a0f19a390cec8bf65ac6f6d6987fe3f398d
Instruction Fuzzy Hash: 68C04C78901656C7CF24FFAAC80755D7AB0BF42325F91476EB1306A2D5DB7D8A00874E

Function 0040B41F Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B426

Part of subcall function 0040B38F: __EH_prolog3.LIBCMT ref: 0040B396

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: abbd9f9dfee227d49da2dd881b0813ceb341686bd372f818d6774bb5dd488cb7
Instruction ID: e63c2c525850a807fec71326d5ef9e812131f0a3d4133c0fe5d6208186d64278
Opcode Fuzzy Hash: abbd9f9dfee227d49da2dd881b0813ceb341686bd372f818d6774bb5dd488cb7
Instruction Fuzzy Hash: 6BC08CB080120582CF04BFF1880321D6560AB42324F50032EA230292C1DB3C0200825F

Function 0040C01A Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040C021

Part of subcall function 0040BE9E: __EH_prolog3.LIBCMT ref: 0040BEA5

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: ac605542f025df13cd093c97ddb9cb80c2a2be336727e3ad533ae05ce1d6337d
Instruction ID: 9a97f15f021bba42c41a9f64c4ed37362a8779fe215f3854d5cb7bfea973c47e
Opcode Fuzzy Hash: ac605542f025df13cd093c97ddb9cb80c2a2be336727e3ad533ae05ce1d6337d
Instruction Fuzzy Hash: 91C04C7490165595CF54BBB5880355D7560AB42324F51436E6230551D2DB7C0604869E

Function 0040C510 Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040C517

Part of subcall function 0040C49C: __EH_prolog3.LIBCMT ref: 0040C4A3

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 49134a70cfd8ae94e511a6b8c550154c77f1192ad6362cfa0fe308c5c53f0cb1
Instruction ID: 6284a0569bb9042b631fd3b1a1ab269f9547b3508f6424b7986367330600f6ab
Opcode Fuzzy Hash: 49134a70cfd8ae94e511a6b8c550154c77f1192ad6362cfa0fe308c5c53f0cb1
Instruction Fuzzy Hash: 35C04C7990125595CF54BBF5455215D7660AB42324F5143AEA130551D1DB7C0640865A

Function 0040B284 Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B28B

Part of subcall function 0040AF28: __EH_prolog3.LIBCMT ref: 0040AF2F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: a4c9a0d42eb7371ab1ad81e659af3373604b2cfb7e4c8b684a6d0602f46f3bdd
Instruction ID: 2fef322884f80bb380abf20a7a7de15e38e80a558fad3e8af85b1192f1bf9d36
Opcode Fuzzy Hash: a4c9a0d42eb7371ab1ad81e659af3373604b2cfb7e4c8b684a6d0602f46f3bdd
Instruction Fuzzy Hash: B9C09BB4D4135695CF44BFF9840324D75606F83368F51476F6230551D1DB7C4640875F

Function 0040B371 Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B378

Part of subcall function 0040B284: __EH_prolog3.LIBCMT ref: 0040B28B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: f04383c12d52918da16a09193bae6fc268720c2334a1e6d493a379145aa95032
Instruction ID: a2a9b7af5a043c017dc33cf773c8a07ebdb212c62de9207890e0ed7b4ad3245c
Opcode Fuzzy Hash: f04383c12d52918da16a09193bae6fc268720c2334a1e6d493a379145aa95032
Instruction Fuzzy Hash: A6C09B74902257DACF54BFF5540715D7560AF43325F51436F6670552D1DB7C0600865F

Function 00435FC5 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,?), ref: 00435FCF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 7b02e37e7214b8943faad05dc80ab30625b043d4cf092271fd8db06a9c11b2c7
Instruction ID: 01f25057823b94f0aee5b142ff59cd5a58e765a86aed6878465580560175c1f2
Opcode Fuzzy Hash: 7b02e37e7214b8943faad05dc80ab30625b043d4cf092271fd8db06a9c11b2c7
Instruction Fuzzy Hash: F7B012710000009BCB424B40DD08D057F61AF65304F208035A1054803083330421EB18

Function 00402DA0 Relevance: 1.3, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,0040203F), ref: 00402DC5

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: dba41e19dc003baf1f1b6ffb1a77ef2b4842458f4e3d7ec55e2e0be9ea2afbd9
Instruction ID: c6acfc21d6c922994ea10ac0dc0548526160b066664303e5dc1365bff7991011
Opcode Fuzzy Hash: dba41e19dc003baf1f1b6ffb1a77ef2b4842458f4e3d7ec55e2e0be9ea2afbd9
Instruction Fuzzy Hash: 75E04F74504208EBCB08CF55DA4466A77B8AB49301F1040ADA804973D0CB799E04DB98

Function 00405700 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,004056AF), ref: 00405725

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 50858b7c85883ec9b3ef7f5d337069667e56f871deaeb9fe69f65e672badaf22
Instruction ID: 25640c9a50b5c57370534cb3591e9d7c6b311c00407ad547d69dd4ced6643796
Opcode Fuzzy Hash: 50858b7c85883ec9b3ef7f5d337069667e56f871deaeb9fe69f65e672badaf22
Instruction Fuzzy Hash: F7E04F74501208EBCF18DF99D94456A77B5EB49320F1042BDA8149B3D0CB389E04EF98

Non-executed Functions

Function 0045A382 Relevance: 94.6, APIs: 27, Strings: 27, Instructions: 122libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wininet.dll,00000000,00414B08,?,00000001,00000001,?,004384ED,?,00000000,80400100,?,00000034,0044B6C3,?,80000000), ref: 0045A397
GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 0045A3B7
GetProcAddress.KERNEL32(InternetOpenUrlW), ref: 0045A3C9
GetProcAddress.KERNEL32(InternetConnectW), ref: 0045A3DB
GetProcAddress.KERNEL32(InternetCrackUrlW), ref: 0045A3ED
GetProcAddress.KERNEL32(InternetCreateUrlW), ref: 0045A3FF
GetProcAddress.KERNEL32(InternetGetLastResponseInfoW), ref: 0045A411
GetProcAddress.KERNEL32(InternetSetOptionW), ref: 0045A423
GetProcAddress.KERNEL32(HttpQueryInfoW), ref: 0045A435
GetProcAddress.KERNEL32(HttpOpenRequestW), ref: 0045A447
GetProcAddress.KERNEL32(HttpSendRequestW), ref: 0045A459
GetProcAddress.KERNEL32(HttpSendRequestExW), ref: 0045A46B
GetProcAddress.KERNEL32(HttpEndRequestW), ref: 0045A47D
GetProcAddress.KERNEL32(InternetQueryOptionW), ref: 0045A48F
GetProcAddress.KERNEL32(InternetCanonicalizeUrlW), ref: 0045A4A1
GetProcAddress.KERNEL32(InternetGetCookieW), ref: 0045A4B3
GetProcAddress.KERNEL32(InternetSetCookieW), ref: 0045A4C5
GetProcAddress.KERNEL32(InternetFindNextFileW), ref: 0045A4D7
GetProcAddress.KERNEL32(FtpFindFirstFileA), ref: 0045A4E9
GetProcAddress.KERNEL32(InternetSetStatusCallbackW), ref: 0045A4FB
GetProcAddress.KERNEL32(InternetSetStatusCallback), ref: 0045A511
GetProcAddress.KERNEL32(InternetCloseHandle), ref: 0045A523
GetProcAddress.KERNEL32(InternetReadFile), ref: 0045A535
GetProcAddress.KERNEL32(InternetGetConnectedState), ref: 0045A547
GetProcAddress.KERNEL32(InternetAutodial), ref: 0045A559
GetProcAddress.KERNEL32(InternetErrorDlg), ref: 0045A56B
GetProcAddress.KERNEL32(InternetQueryDataAvailable), ref: 0045A57D

Strings

InternetCrackUrlW, xrefs: 0045A3DD
InternetErrorDlg, xrefs: 0045A55B
FtpFindFirstFileA, xrefs: 0045A4D9
HttpSendRequestW, xrefs: 0045A449
InternetCreateUrlW, xrefs: 0045A3EF
InternetSetStatusCallbackW, xrefs: 0045A4EB
InternetGetCookieW, xrefs: 0045A4A3
HttpEndRequestW, xrefs: 0045A46D
wininet.dll, xrefs: 0045A392
InternetCloseHandle, xrefs: 0045A518
InternetCanonicalizeUrlW, xrefs: 0045A491
InternetGetLastResponseInfoW, xrefs: 0045A401
InternetConnectW, xrefs: 0045A3CB
HttpQueryInfoW, xrefs: 0045A425
InternetAutodial, xrefs: 0045A549
HttpOpenRequestW, xrefs: 0045A437
InternetOpenUrlW, xrefs: 0045A3B9
InternetSetStatusCallback, xrefs: 0045A506
HttpSendRequestExW, xrefs: 0045A45B
InternetQueryDataAvailable, xrefs: 0045A56D
InternetReadFile, xrefs: 0045A525
InternetFindNextFileW, xrefs: 0045A4C7
InternetSetCookieW, xrefs: 0045A4B5
InternetGetConnectedState, xrefs: 0045A537
InternetQueryOptionW, xrefs: 0045A47F
InternetOpenW, xrefs: 0045A3B1
InternetSetOptionW, xrefs: 0045A413

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: FtpFindFirstFileA$HttpEndRequestW$HttpOpenRequestW$HttpQueryInfoW$HttpSendRequestExW$HttpSendRequestW$InternetAutodial$InternetCanonicalizeUrlW$InternetCloseHandle$InternetConnectW$InternetCrackUrlW$InternetCreateUrlW$InternetErrorDlg$InternetFindNextFileW$InternetGetConnectedState$InternetGetCookieW$InternetGetLastResponseInfoW$InternetOpenUrlW$InternetOpenW$InternetQueryDataAvailable$InternetQueryOptionW$InternetReadFile$InternetSetCookieW$InternetSetOptionW$InternetSetStatusCallback$InternetSetStatusCallbackW$wininet.dll
API String ID: 2238633743-1703109126
Opcode ID: 3026b30dc83a8d84f652513d0a67f1e6bdba3c99a1a602956cd2420ac3ae7008
Instruction ID: 73ee87a21b9d4f7b37727b4af184ddeadf851520243cf475181532ef31010643
Opcode Fuzzy Hash: 3026b30dc83a8d84f652513d0a67f1e6bdba3c99a1a602956cd2420ac3ae7008
Instruction Fuzzy Hash: DC41F4B4A43798EACB116F72EE29A553FF5E784B503120477E60092372DB79A410EEDC

Function 0047AA43 Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 0047AA7A
___getlocaleinfo.LIBCMT ref: 0047AA8F
___getlocaleinfo.LIBCMT ref: 0047AAA4
___getlocaleinfo.LIBCMT ref: 0047AAB9
___getlocaleinfo.LIBCMT ref: 0047AAD1
___getlocaleinfo.LIBCMT ref: 0047AAE6
___getlocaleinfo.LIBCMT ref: 0047AAF8
___getlocaleinfo.LIBCMT ref: 0047AB0D
___getlocaleinfo.LIBCMT ref: 0047AB25
___getlocaleinfo.LIBCMT ref: 0047AB3A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 36ab0e16ac96be99d38221aade2a066d95eb252e5a1242cf3512d8453a05dcd9
Instruction ID: fcdd8521b165a80bf74fedb58a5905c422af68ce9c654661b3bfff550c204609
Opcode Fuzzy Hash: 36ab0e16ac96be99d38221aade2a066d95eb252e5a1242cf3512d8453a05dcd9
Instruction Fuzzy Hash: 6BE1EEB2E0021DBEEF11DAE1CD85DFF77BDEB44748F04092BB216D6440EA74AA059B60

Function 00428196 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 389COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004281B8

Part of subcall function 0040B2F1: __EH_prolog3.LIBCMT ref: 0040B2F8

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

GetTempPathW.KERNEL32(00000104,00000000,?,00000104,00000094), ref: 0042822A

Part of subcall function 0040B14B: __EH_prolog3.LIBCMT ref: 0040B152
Part of subcall function 0040B14B: GetLastError.KERNEL32(00000038,0040C732), ref: 0040B159
Part of subcall function 0040B14B: SetLastError.KERNEL32(00000000), ref: 0040B1A3

CoCreateGuid.OLE32(?), ref: 00428243

Part of subcall function 00425DC8: __EH_prolog3.LIBCMT ref: 00425DCF

Part of subcall function 00415EC8: __EH_prolog3_GS.LIBCMT ref: 00415ECF

CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000000,?,00000001), ref: 004282B3
CreateDirectoryW.KERNEL32(?,00000000,?), ref: 00428547
GetPrivateProfileStringW.KERNEL32(?,-00000008,004BDF40,?,00000104,00000000), ref: 00428453

Part of subcall function 004407F8: __EH_prolog3.LIBCMT ref: 004407FF
Part of subcall function 004407F8: CloseHandle.KERNEL32(?,00000004,004436E2,00000000,?,004BDF40,?,?,?,?,?,00710000,?,?,?), ref: 0044083E

Part of subcall function 0042296E: __EH_prolog3.LIBCMT ref: 00422975

Strings

SetupDefaults, xrefs: 004283EB
E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 004284A5, 004285A9, 00428661
TempPathGuid, xrefs: 004283D2
Extracting resources for '%s' to '%s', xrefs: 004285A3
ISConfig.ini for current issetup.dll does not contain TempPathGuid., xrefs: 004284BF
IsConfig.ini, xrefs: 004282F3, 004282F8, 0042832C
Could not extract isconfig.ini from current issetup.dll, xrefs: 00428677

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$CreateString$DirectoryErrorLast$AllocCloseGuidH_prolog3_HandlePathPrivateProfileTemp
String ID: Could not extract isconfig.ini from current issetup.dll$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$Extracting resources for '%s' to '%s'$ISConfig.ini for current issetup.dll does not contain TempPathGuid.$IsConfig.ini$SetupDefaults$TempPathGuid
API String ID: 164505593-3434365748
Opcode ID: c4628a50f29d50f8ebf8953f003f7e2a18243c6baae9af795e563d08589c96d1
Instruction ID: edeba8d88058ea0ef8d47abbfba3e409a47a74d6100911168eae286ecefa8b2d
Opcode Fuzzy Hash: c4628a50f29d50f8ebf8953f003f7e2a18243c6baae9af795e563d08589c96d1
Instruction Fuzzy Hash: 3B02C47190128CEEDB21EF95CD45BDE7B78AF11304F5040AEE505AB192EB786B08CF69

Function 00458DDF Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 147threadmemoryCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00458E0D
OpenThreadToken.ADVAPI32(00000000), ref: 00458E14
GetLastError.KERNEL32 ref: 00458E24
GetCurrentProcess.KERNEL32(00000008,?), ref: 00458E33
OpenProcessToken.ADVAPI32(00000000), ref: 00458E3A
GetLastError.KERNEL32 ref: 00458E40
GetTokenInformation.ADVAPI32(00000000,00000002,00000000,00000000,?), ref: 00458E6E
GetLastError.KERNEL32 ref: 00458E74
GetTokenInformation.ADVAPI32(00000000,00000002,00000000,?,?), ref: 00458EAD
AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,-00000224,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00458EEF
EqualSid.ADVAPI32(?,?), ref: 00458F10
FreeSid.ADVAPI32(?), ref: 00458F3B

Strings

Startup, xrefs: 00458DF0

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Token$ErrorLast$CurrentInformationOpenProcessThread$AllocateEqualFreeInitialize
String ID: Startup
API String ID: 884311744-724789610
Opcode ID: 2024c9eb72d04f54f19414375fe32b960c1e92431eacb1a0ee4917b2d7f7f120
Instruction ID: a3f9859c52201bb1063fae532762d0f7c7b0744a0533aea79cfea9c973db3393
Opcode Fuzzy Hash: 2024c9eb72d04f54f19414375fe32b960c1e92431eacb1a0ee4917b2d7f7f120
Instruction Fuzzy Hash: 0741F772905209AEEF019BA4DC46AFFBBBCEF15345F10442EE940F2192DE384D498B69

Function 0045A208 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

SearchPathW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,74DEF550), ref: 0045A245
GetModuleFileNameW.KERNEL32(?,00000208), ref: 0045A268

Strings

RPAWINET.DLL, xrefs: 0045A22A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: FileModuleNamePathSearch
String ID: RPAWINET.DLL
API String ID: 1980563475-274221676
Opcode ID: cc2851ae43f561e51b139bace7affad556cea00fb8455a90155ba5453e521c5e
Instruction ID: 4d10633ce49e504e31964c14e04264481f5c6e14a8657954b08894c552115bb6
Opcode Fuzzy Hash: cc2851ae43f561e51b139bace7affad556cea00fb8455a90155ba5453e521c5e
Instruction Fuzzy Hash: 9441A271A402199BDF20DFA4DC45AFF73B8FB05314F500226ED15AB182E7386E5ACB5A

Function 004464E0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 004464EF
OpenProcessToken.ADVAPI32(00000000,00000028,?), ref: 004464FC
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00446513
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 0044653E
ExitWindowsEx.USER32(00000002,0000FFFF), ref: 0044654C

Strings

SeShutdownPrivilege, xrefs: 0044650B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentExitLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 1314775590-3733053543
Opcode ID: 88b6dd557b29a78071b9730272f0952427f0b16bf659ff8bba23cdc359eed081
Instruction ID: 770839fb7a888845bcd2a2f9610e8c90fbb8e8ac5ccf87289af39255abf82972
Opcode Fuzzy Hash: 88b6dd557b29a78071b9730272f0952427f0b16bf659ff8bba23cdc359eed081
Instruction Fuzzy Hash: 25017C71941129ABDB409FE4DC4AAEFBFBCEF0A704F000165B915E2180D6745A04CBA9

Function 004646D1 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0046EA87
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0046EA9C
UnhandledExceptionFilter.KERNEL32(004B5BB8), ref: 0046EAA7
GetCurrentProcess.KERNEL32(C0000409), ref: 0046EAC3
TerminateProcess.KERNEL32(00000000), ref: 0046EACA

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8250d90fcc0ad36d7c5dd5ef5565b517d99fc408162ef5190d0a6e371c5fab5d
Instruction ID: 3c9ea11c4442e2f9375982a96ee2ed2fe8343eed71d6ae4a92a9153c567810f3
Opcode Fuzzy Hash: 8250d90fcc0ad36d7c5dd5ef5565b517d99fc408162ef5190d0a6e371c5fab5d
Instruction Fuzzy Hash: ED21DFB5802308DFDB40EF69E8846943BF5FB49701F22417BEA0987361E7B559808F8D

Function 00496230 Relevance: 2.6, APIs: 1, Instructions: 1143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7151908210360b739e35f90b9f566f2c621c7e58ef4ecdf3294312f00142d9ee
Instruction ID: d41277f05e577d32cef5dd01dfe05fd17992fbd20911f2f993c746dcc70a6ba1
Opcode Fuzzy Hash: 7151908210360b739e35f90b9f566f2c621c7e58ef4ecdf3294312f00142d9ee
Instruction Fuzzy Hash: 4EC28878A00109EFCB08CF58D694AAEBBB2FF88314F258199D8055B356C735EE42DF95

Function 00498EB0 Relevance: 2.2, Strings: 1, Instructions: 951COMMON

Download Yara Rule

Strings

uM, xrefs: 004991F2

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID:
String ID: uM
API String ID: 0-3188990978
Opcode ID: 5d9bab2dbb8c3dd1f7b9b4249ae24fa0ea8e3ff7cbc546de1325c270fd060e2e
Instruction ID: 0254225405431e1b372cfe232bbb309f9b457ad64bd31ffa2e567de4b723a989
Opcode Fuzzy Hash: 5d9bab2dbb8c3dd1f7b9b4249ae24fa0ea8e3ff7cbc546de1325c270fd060e2e
Instruction Fuzzy Hash: 1BA2CA74A00219DFDF18CF98C894AADBBB2FF88304F248169D5056B395D739AD82CF95

Function 0047D0F4 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(Function_0007CD53,00000001), ref: 0047D10D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 39aaf0bba07ff8033e3c2e4920de0f8c0959a0547ca7fb5b050046cbcfa2f608
Instruction ID: bd7900e0c4c807744e3b3bdd4a3a3fb6bc62060f6b5975f269895e5a7e9aac04
Opcode Fuzzy Hash: 39aaf0bba07ff8033e3c2e4920de0f8c0959a0547ca7fb5b050046cbcfa2f608
Instruction Fuzzy Hash: 46D05E70F143014BD7244F2599883E57BF0EB00F19F70D95ED99A850D2C7B9A4868A88

Function 0047A13D Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0007A0FB), ref: 0047A142

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b2672013eb1bc51931b5d1f2f4b80cc7f2f88ec6c05fd114df2f37f1350c555f
Instruction ID: 05761675772a93ef214d58ba702e35b2ca48c9728a4e6b0de1060972277b9e04
Opcode Fuzzy Hash: b2672013eb1bc51931b5d1f2f4b80cc7f2f88ec6c05fd114df2f37f1350c555f
Instruction Fuzzy Hash: C19002B16912414A4A401FB05E8974A39905A9B60275289A16045D4054DE5440905D5A

Function 0045D8D8 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d6a2e424fbb72b4095edc87218035ef3b19500e4f165ffca87b72600bb520e
Instruction ID: 1d9d47bb2cddec3bb43a03f5e538392e0a0acccd03b1d0d42bc45b602545ea61
Opcode Fuzzy Hash: 66d6a2e424fbb72b4095edc87218035ef3b19500e4f165ffca87b72600bb520e
Instruction Fuzzy Hash: CC324EB7F4160A9BDB08CED5CCC1ADDB3F3BBD8314B1E9069C515E7305EA78A6068A50

Function 00469788 Relevance: .5, Instructions: 528COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd64c2352f821c812aa61f16c472048889b711753782294857e2019e02455e0
Instruction ID: 74044dbc0e1e7b2688cd60cf18f14b6000bd18acc8f4877d1807fa772e3db208
Opcode Fuzzy Hash: dbd64c2352f821c812aa61f16c472048889b711753782294857e2019e02455e0
Instruction Fuzzy Hash: 4302E373D09BB34B8B714EF941E01277AA45E0169030F87EADCD03F386E16ADD1996E6

Function 0046A85D Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: e856560e49c6473f017f6576886eea178f12b0c9d6a6e586928f83b29b04795a
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 68D162B3C0ADB30A8775812E415813BEAA26FD174031FC7E2DCE43F389E52A5D2599D6

Function 0046A43D Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 5f9c8ad7e77307d6660898c5a04cada0ef2809b67e4dbe74bd66ca2b9bf7d91d
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 32D183B3C0ADB3068775812E415813BEAA26FD175131EC3E2CCE43F389F56A9C2199D6

Function 0046A031 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 5fd328fe76898a4dd92ccaf33e0ffa655ed8c6469d0936f4643b20801cf3cdc4
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 81C17273C0ADB30A8775812E416813BEAA26FD175031FC3E2CCE43F389A56B5D2499D6

Function 004940F0 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c186e97feab3d47aaa0e23146deaa398c177777df93a38aa6e34b3606b66edd7
Instruction ID: 4935b92243938dcfbd668dfc7a1857a2ffd14756ddf8a631174ebf38320581b1
Opcode Fuzzy Hash: c186e97feab3d47aaa0e23146deaa398c177777df93a38aa6e34b3606b66edd7
Instruction Fuzzy Hash: C761F770510189ABCF44CF19C891AAA3BA2FF89355F14C12AFD298F245C239E751DF94

Function 0046C710 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 77bcd8a66336cab479b26ecfc1417119f177f46c8c60eb05e079dbb2cf55ace9
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F5110BBB24014343D6048A6ED9F8AB7A395EAD6323B2C4377D0C14B754F32AE9459E0A

Function 0045AC6D Relevance: 122.7, APIs: 35, Strings: 35, Instructions: 160libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Advapi32.dll,00000000,?,00000000,0045C508,00000004,004474AE,00008004,00000000,00000000,00000008), ref: 0045AC90
GetProcAddress.KERNEL32(00000000,CryptAcquireContextW), ref: 0045ACA5
GetProcAddress.KERNEL32(CryptSignHashW), ref: 0045ACB7
GetProcAddress.KERNEL32(CryptVerifySignatureW), ref: 0045ACC9
GetProcAddress.KERNEL32(CryptCreateHash), ref: 0045ACDB
GetProcAddress.KERNEL32(CryptDeriveKey), ref: 0045ACED
GetProcAddress.KERNEL32(CryptHashData), ref: 0045ACFF
GetProcAddress.KERNEL32(CryptImportKey), ref: 0045AD11
GetProcAddress.KERNEL32(CryptExportKey), ref: 0045AD23
GetProcAddress.KERNEL32(CryptSetHashParam), ref: 0045AD35
GetProcAddress.KERNEL32(CryptGetHashParam), ref: 0045AD47
GetProcAddress.KERNEL32(CryptReleaseContext), ref: 0045AD59
GetProcAddress.KERNEL32(CryptDestroyKey), ref: 0045AD6B
GetProcAddress.KERNEL32(CryptDestroyHash), ref: 0045AD7D
LoadLibraryW.KERNEL32(Crypt32.dll,00000000,?,00000000,0045C508,00000004,004474AE,00008004,00000000,00000000,00000008), ref: 0045AD96
GetProcAddress.KERNEL32(00000000,CertOpenSystemStoreW), ref: 0045ADAB
GetProcAddress.KERNEL32(CertNameToStrW), ref: 0045ADBD
GetProcAddress.KERNEL32(CryptMsgGetParam), ref: 0045ADCF
GetProcAddress.KERNEL32(CryptQueryObject), ref: 0045ADE1
GetProcAddress.KERNEL32(CryptMsgClose), ref: 0045ADF3
GetProcAddress.KERNEL32(CertCompareCertificate), ref: 0045AE05
GetProcAddress.KERNEL32(CryptImportPublicKeyInfo), ref: 0045AE17
GetProcAddress.KERNEL32(CertFreeCertificateContext), ref: 0045AE29
GetProcAddress.KERNEL32(CertEnumCertificatesInStore), ref: 0045AE3B
GetProcAddress.KERNEL32(CertDuplicateCertificateContext), ref: 0045AE4D
GetProcAddress.KERNEL32(CertGetIssuerCertificateFromStore), ref: 0045AE5F
GetProcAddress.KERNEL32(CertOpenStore), ref: 0045AE71
GetProcAddress.KERNEL32(CertSaveStore), ref: 0045AE83
GetProcAddress.KERNEL32(CertCloseStore), ref: 0045AE95
GetProcAddress.KERNEL32(CertFindCertificateInStore), ref: 0045AEA7
GetProcAddress.KERNEL32(CertAddCertificateContextToStore), ref: 0045AEB9
GetProcAddress.KERNEL32(CertGetCertificateChain), ref: 0045AECB
GetProcAddress.KERNEL32(CertFreeCertificateChain), ref: 0045AEDD
LoadLibraryW.KERNEL32(WinTrust.dll,00000000,?,00000000,0045C508,00000004,004474AE,00008004,00000000,00000000,00000008), ref: 0045AEF2
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 0045AF03

Strings

CertGetCertificateChain, xrefs: 0045AEBB
CertOpenStore, xrefs: 0045AE61
CryptMsgGetParam, xrefs: 0045ADBF
CryptImportKey, xrefs: 0045AD01
CertCompareCertificate, xrefs: 0045ADF5
CryptDeriveKey, xrefs: 0045ACDD
CryptQueryObject, xrefs: 0045ADD1
CryptExportKey, xrefs: 0045AD13
CryptVerifySignatureW, xrefs: 0045ACB9
CertEnumCertificatesInStore, xrefs: 0045AE2B
CryptReleaseContext, xrefs: 0045AD49
CryptMsgClose, xrefs: 0045ADE3
CertDuplicateCertificateContext, xrefs: 0045AE3D
CertNameToStrW, xrefs: 0045ADAD
CryptGetHashParam, xrefs: 0045AD37
Advapi32.dll, xrefs: 0045AC8B
CertOpenSystemStoreW, xrefs: 0045ADA5
CryptSetHashParam, xrefs: 0045AD25
CryptDestroyKey, xrefs: 0045AD5B
CryptSignHashW, xrefs: 0045ACA7
CertFreeCertificateChain, xrefs: 0045AECD
CertCloseStore, xrefs: 0045AE85
CryptCreateHash, xrefs: 0045ACCB
CryptAcquireContextW, xrefs: 0045AC9F
CertAddCertificateContextToStore, xrefs: 0045AEA9
CryptDestroyHash, xrefs: 0045AD6D
CryptImportPublicKeyInfo, xrefs: 0045AE07
CertSaveStore, xrefs: 0045AE73
CertFreeCertificateContext, xrefs: 0045AE19
CryptHashData, xrefs: 0045ACEF
CertGetIssuerCertificateFromStore, xrefs: 0045AE4F
WinVerifyTrust, xrefs: 0045AEFD
Crypt32.dll, xrefs: 0045AD91
WinTrust.dll, xrefs: 0045AEED
CertFindCertificateInStore, xrefs: 0045AE97

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Advapi32.dll$CertAddCertificateContextToStore$CertCloseStore$CertCompareCertificate$CertDuplicateCertificateContext$CertEnumCertificatesInStore$CertFindCertificateInStore$CertFreeCertificateChain$CertFreeCertificateContext$CertGetCertificateChain$CertGetIssuerCertificateFromStore$CertNameToStrW$CertOpenStore$CertOpenSystemStoreW$CertSaveStore$Crypt32.dll$CryptAcquireContextW$CryptCreateHash$CryptDeriveKey$CryptDestroyHash$CryptDestroyKey$CryptExportKey$CryptGetHashParam$CryptHashData$CryptImportKey$CryptImportPublicKeyInfo$CryptMsgClose$CryptMsgGetParam$CryptQueryObject$CryptReleaseContext$CryptSetHashParam$CryptSignHashW$CryptVerifySignatureW$WinTrust.dll$WinVerifyTrust
API String ID: 2238633743-4279443395
Opcode ID: f7253967b711d490298446fd5624928f3c5dce9b841ccd2b96e61dbb748c286d
Instruction ID: 5612b445fde575f1958ed08f6e8fca9ec228e03607355ae818cb586d92674ee4
Opcode Fuzzy Hash: f7253967b711d490298446fd5624928f3c5dce9b841ccd2b96e61dbb748c286d
Instruction Fuzzy Hash: 5751E9F4D43394EACB116FB1AD69A667FE1EB88B5031205B7AA0492372D7798010DEDC

Function 00448B55 Relevance: 73.9, APIs: 1, Strings: 41, Instructions: 389COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00448B5C

Part of subcall function 0040E918: _wcslen.LIBCMT ref: 0040E91F

Strings

turkish, xrefs: 004490CF
english, xrefs: 00448C58
korean, xrefs: 00448F11
polish, xrefs: 00448F9A
canadian, xrefs: 00448CE1
finnish, xrefs: 00448D27
english-uk, xrefs: 00448C78
portuguese-brazilian, xrefs: 00448FE0
italian-swiss, xrefs: 00448ECB
greek, xrefs: 00448E3F
spanish, xrefs: 00449049
german-swiss, xrefs: 00448E1C
czech, xrefs: 00448BCC
spanish-mexican, xrefs: 0044906C
english-nz, xrefs: 00448D04
dutch, xrefs: 00448C12
french, xrefs: 00448D4A
swedish, xrefs: 004490AF
spanish-modern, xrefs: 0044908F
danish, xrefs: 00448BEF
dutch-belgian, xrefs: 00448C35
french-swiss, xrefs: 00448D90
norwegian-nynorsk, xrefs: 00448F77
russian, xrefs: 00449003
hungarian, xrefs: 00448E62
slovak, xrefs: 00449026
german-austrian, xrefs: 00448DF9
american, xrefs: 00448C9B
french-canadian, xrefs: 00448DB3
chinese-traditional, xrefs: 00448BA9
french-belgian, xrefs: 00448D6D
australian, xrefs: 00448CBE
portuguese, xrefs: 00448FBD
chinese, xrefs: 00448B65
italian, xrefs: 00448EA8
german, xrefs: 00448DD6
chinese-simplified, xrefs: 00448B86
norwegian-bokmal, xrefs: 00448F54
icelandic, xrefs: 00448E85
japanese, xrefs: 00448EEE
norwegian, xrefs: 00448F34

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_wcslen
String ID: american$australian$canadian$chinese$chinese-simplified$chinese-traditional$czech$danish$dutch$dutch-belgian$english$english-nz$english-uk$finnish$french$french-belgian$french-canadian$french-swiss$german$german-austrian$german-swiss$greek$hungarian$icelandic$italian$italian-swiss$japanese$korean$norwegian$norwegian-bokmal$norwegian-nynorsk$polish$portuguese$portuguese-brazilian$russian$slovak$spanish$spanish-mexican$spanish-modern$swedish$turkish
API String ID: 3746244732-895649913
Opcode ID: ba62329f7b543d128323a8f3c033aac3d402e35942a7d78499b122e702bfd6d9
Instruction ID: 1866924ed5dbc3207be1def115d5a8fa38dc80718f973f1838b889bd294bbc07
Opcode Fuzzy Hash: ba62329f7b543d128323a8f3c033aac3d402e35942a7d78499b122e702bfd6d9
Instruction Fuzzy Hash: 58D1FD60240145A6FB18EE26DC52AEE32149F2038AF50847FFC05AA1D3EF7DDF45A69D

Function 0045D5B9 Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 189libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045D5C0
GetLastError.KERNEL32(0000000C,0045D812,?,00000001), ref: 0045D5D1
GetModuleHandleW.KERNEL32(Kernel32,CreateFileW), ref: 0045D5F2
GetProcAddress.KERNEL32(00000000), ref: 0045D5FB
GetModuleHandleW.KERNEL32(Kernel32,CreateFileA), ref: 0045D64E
GetProcAddress.KERNEL32(00000000), ref: 0045D651
GetLastError.KERNEL32 ref: 0045D69E
GetModuleHandleW.KERNEL32(Kernel32,CreateFileMappingW), ref: 0045D6E0
GetProcAddress.KERNEL32(00000000), ref: 0045D6E3
GetModuleHandleW.KERNEL32(Kernel32,CreateFileMappingA), ref: 0045D6F5
GetProcAddress.KERNEL32(00000000), ref: 0045D6F8
GetModuleHandleW.KERNEL32(Kernel32,MapViewOfFile), ref: 0045D731
GetProcAddress.KERNEL32(00000000), ref: 0045D734
GetModuleHandleW.KERNEL32(Kernel32,GetFileSize), ref: 0045D775
GetProcAddress.KERNEL32(00000000), ref: 0045D778
GetLastError.KERNEL32 ref: 0045D794

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0044886C: __EH_prolog3.LIBCMT ref: 00448873

Strings

Kernel32, xrefs: 0045D5EA, 0045D649, 0045D6DB, 0045D6F0, 0045D72C, 0045D770
CreateFileA, xrefs: 0045D644
GetFileSize, xrefs: 0045D76B
MapViewOfFile, xrefs: 0045D727
CreateFileMappingA, xrefs: 0045D6EB
CreateFileW, xrefs: 0045D5E5
CreateFileMappingW, xrefs: 0045D6D6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc$ErrorH_prolog3Last
String ID: CreateFileA$CreateFileMappingA$CreateFileMappingW$CreateFileW$GetFileSize$Kernel32$MapViewOfFile
API String ID: 1385607800-1000212789
Opcode ID: 607da40f89b05e7ca3dd62d923bfce077fe5418f7236277f7b22032ab27cac29
Instruction ID: 13224e787b4d0666b70ece01f09b96c2a437d94086fcab62325c3e3bdfc23484
Opcode Fuzzy Hash: 607da40f89b05e7ca3dd62d923bfce077fe5418f7236277f7b22032ab27cac29
Instruction Fuzzy Hash: F65114B0A00705AFDB20EF74CC46BAF7BE4AF49705F14852EF81696291DB78D904CB69

Function 0040D22B Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 286threadinjectionprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B2F1: __EH_prolog3.LIBCMT ref: 0040B2F8

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000104,80C21959,00000000,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},00000001), ref: 0040D2A9

Part of subcall function 0040B14B: __EH_prolog3.LIBCMT ref: 0040B152
Part of subcall function 0040B14B: GetLastError.KERNEL32(00000038,0040C732), ref: 0040B159
Part of subcall function 0040B14B: SetLastError.KERNEL32(00000000), ref: 0040B1A3

Part of subcall function 0040A7C0: __EH_prolog3.LIBCMT ref: 0040A7D9

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0044CEF2: __EH_prolog3_GS.LIBCMT ref: 0044CEFC

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040D3AD
SetCurrentDirectoryW.KERNEL32(?), ref: 0040D3DD
_memset.LIBCMT ref: 0040D404
_memset.LIBCMT ref: 0040D416
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000044,00000000,00000000,?,?), ref: 0040D434

Part of subcall function 0044CEF2: GetLastError.KERNEL32 ref: 0044CF8F
Part of subcall function 0044CEF2: GetLastError.KERNEL32(00000000), ref: 0044D040
Part of subcall function 0044CEF2: __CxxThrowException@8.LIBCMT ref: 0044D09D

_memset.LIBCMT ref: 0040D461
_wcsncpy.LIBCMT ref: 0040D4D6
_wcsncpy.LIBCMT ref: 0040D505
GetCurrentProcess.KERNEL32(?,?,00000000,00000000,00000000), ref: 0040D520
GetCurrentProcess.KERNEL32(00000000), ref: 0040D523
DuplicateHandle.KERNEL32(00000000), ref: 0040D526
GetThreadContext.KERNEL32(?,?), ref: 0040D566
VirtualProtectEx.KERNEL32(?,?,00000C35,00000040,?), ref: 0040D5A0
WriteProcessMemory.KERNEL32(?,?,00000000,00000C35,00000000), ref: 0040D5B1
FlushInstructionCache.KERNEL32(?,?,00000C35), ref: 0040D5BC
SetThreadContext.KERNEL32(?,?), ref: 0040D5CC
ResumeThread.KERNEL32(?), ref: 0040D5D5
CloseHandle.KERNEL32(?), ref: 0040D5DE
CloseHandle.KERNEL32(?), ref: 0040D5E3

Strings

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 0040D25C
explorer.exe, xrefs: 0040D3E6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorH_prolog3LastProcess$CurrentHandleThread_memset$CloseContextDirectoryString_wcsncpy$AllocCacheCreateDuplicateException@8FileFlushH_prolog3_InstructionMemoryModuleNameProtectResumeSystemThrowVirtualWrite
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$explorer.exe
API String ID: 2583668668-2813513535
Opcode ID: 1acbe45cfa1036076fcb1c789679d5cd1e10e7a93be4aa7ee2dfde8b331be3c1
Instruction ID: 4c56c347bd4873a22a6657e12a3df56f6fcaf5d021371cf2f13838f2bc0415b9
Opcode Fuzzy Hash: 1acbe45cfa1036076fcb1c789679d5cd1e10e7a93be4aa7ee2dfde8b331be3c1
Instruction Fuzzy Hash: ECB13E71801288AFDB31DF95DD85BEE7BA8EF05304F04817AF909AB191DB385A04DBA5

Function 004431F2 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 248libraryloaderwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00443214
LoadLibraryW.KERNEL32(Shell32.dll,0000011C), ref: 0044323E
GetProcAddress.KERNEL32(00000000,ShellExecuteExW), ref: 00443251
_memset.LIBCMT ref: 00443264
_memset.LIBCMT ref: 00443286
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00443477
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0044348E
GetExitCodeProcess.KERNEL32(?,CCCCCCCC), ref: 0044349B
CloseHandle.KERNEL32(00000008), ref: 004434B7
CloseHandle.KERNEL32(?), ref: 004434BC
FreeLibrary.KERNEL32(?), ref: 004434C6

Strings

"%s" %s, xrefs: 0044338D
ShellExecuteExW, xrefs: 0044324B
Shell32.dll, xrefs: 00443230

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CloseHandleLibrary_memset$AddressCodeExitFreeH_prolog3LoadMessageMultipleObjectsPeekProcProcessWait
String ID: "%s" %s$Shell32.dll$ShellExecuteExW
API String ID: 2412523297-4215436572
Opcode ID: 73dd5e0d98a716b2c8320196b6323da1026d1ad55687d34dd818347a6702c877
Instruction ID: 7c64136931a4ff10361181ee42ab77c070ff40ab6d813f03119c0ddb4aa20653
Opcode Fuzzy Hash: 73dd5e0d98a716b2c8320196b6323da1026d1ad55687d34dd818347a6702c877
Instruction Fuzzy Hash: 09A14771D00219AFEB21DFA4CC85AEEBBB8FB09705F10406AE505A7251D7389F45CF69

Function 0041D6A8 Relevance: 35.4, APIs: 11, Strings: 9, Instructions: 362stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041D6CA

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

lstrcmpiW.KERNEL32(?,auto,?,?,00000001,000003C0), ref: 0041D71F
CharNextW.USER32(?,/auto,00000000,00000000), ref: 0041D832
CharNextW.USER32(?,?,?,00000000,debuglog,?,?,?,00000000,?,?), ref: 0041D8C6
CharNextW.USER32(?,?,00000000,embed{,?,?,004ADF28,00000000), ref: 0041D9B0
lstrcmpW.KERNEL32(00000000,%IS_E%), ref: 0041D9BF
lstrcpyW.KERNEL32(C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},?), ref: 0041D9D1

Strings

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI, xrefs: 0041DA89
/auto, xrefs: 0041D733
Software\Microsoft\Windows\CurrentVersion, xrefs: 0041D9EB
%IS_E%, xrefs: 0041D9B6
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 0041D9CC, 0041DA39, 0041DA63, 0041DA84
embed{, xrefs: 0041D8DC
This setup was created with an EVALUATION VERSION of %s, which does not support extraction of the internal MSI file. The full ver, xrefs: 0041D767
debuglog, xrefs: 0041D87E
auto, xrefs: 0041D717

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CharNext$H_prolog3$lstrcmplstrcmpilstrcpy
String ID: This setup was created with an EVALUATION VERSION of %s, which does not support extraction of the internal MSI file. The full ver$%IS_E%$/auto$C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI$Software\Microsoft\Windows\CurrentVersion$auto$debuglog$embed{
API String ID: 526281456-2767831588
Opcode ID: 49303cc35a20e5c3d4539a849a9e1e2896fa2a52659990b6c3784004cfae46a6
Instruction ID: d1805253bb27c710e2cd3611e0c319a623addd594553c4bdde94483324cf5efa
Opcode Fuzzy Hash: 49303cc35a20e5c3d4539a849a9e1e2896fa2a52659990b6c3784004cfae46a6
Instruction Fuzzy Hash: 79E1CF71D01248EADB11EBA5CD95EEEBBB8AF15304F1040AEF406B71D2DB381B45CB69

Function 004531EE Relevance: 31.8, APIs: 4, Strings: 14, Instructions: 304timeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045320A

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 0044DD8B: __EH_prolog3_GS.LIBCMT ref: 0044DD92
Part of subcall function 0044DD8B: RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,00000000,00000444,00000058,0041CCAF,?,-80000001), ref: 0044DDF9

GetCurrentProcessId.KERNEL32(bin,00000000), ref: 00453346
GetLocalTime.KERNEL32(?), ref: 004533F0
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000104), ref: 00453487

Part of subcall function 00452C44: __EH_prolog3.LIBCMT ref: 00452C66
Part of subcall function 00452C44: _memset.LIBCMT ref: 00452C8F
Part of subcall function 00452C44: SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?,?,?,000003C0), ref: 00452CA7
Part of subcall function 00452C44: SHGetPathFromIDListW.SHELL32(?,?), ref: 00452CBE
Part of subcall function 00452C44: SHGetMalloc.SHELL32(?), ref: 00452CC8

Strings

%s%s%d.%s, xrefs: 00453353
TraceStarted: %.2ld/%.2ld/%.2ld %.2ld:%.2ld:%.2ld, xrefs: 00453424
SetupExeVersion: %ld.%ld.%ld.%ld, xrefs: 00453508
FileNamePath, xrefs: 004532B5
TraceData:, xrefs: 00453534
setuptrace, xrefs: 0045334D
(c) Copyright 2004 InstallShield Software Corporation (All Rights Reserved), xrefs: 004533DA
SetupExe: %ls, xrefs: 004534A9
h7K, xrefs: 00453562
bin, xrefs: 00453341
Category|SubCategory|Details, xrefs: 0045354D
ISlogit, xrefs: 0045321F, 00453224, 0045326F, 004532CF
FormatVersion=00000112, xrefs: 004533C1
TraceStd, xrefs: 00453254

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$CurrentFileFolderFromH_prolog3_ListLocalLocationMallocModuleNamePathProcessQuerySpecialTimeValue_memset
String ID: TraceData:$%s%s%d.%s$(c) Copyright 2004 InstallShield Software Corporation (All Rights Reserved)$Category|SubCategory|Details$FileNamePath$FormatVersion=00000112$ISlogit$SetupExe: %ls$SetupExeVersion: %ld.%ld.%ld.%ld$TraceStarted: %.2ld/%.2ld/%.2ld %.2ld:%.2ld:%.2ld$TraceStd$bin$h7K$setuptrace
API String ID: 2825761932-2788575699
Opcode ID: a7f3f0621658ebd50a69f7fe8c6fd3a1cc272fdc871373fa4a84c78c0efaecb4
Instruction ID: 33f8c400d75ca256b130ddf1dc461937f3604ce6a26f441ca177c4061966415a
Opcode Fuzzy Hash: a7f3f0621658ebd50a69f7fe8c6fd3a1cc272fdc871373fa4a84c78c0efaecb4
Instruction Fuzzy Hash: FCB18BB1900248BBDB04EFE5CC46AEE7BACAF05315F10452FF81597192EB399B05CB69

Function 0041F452 Relevance: 28.7, APIs: 19, Instructions: 235windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041F46E
GetWindowLongW.USER32(?,000000EB), ref: 0041F493
GetDlgItem.USER32(?,00000132), ref: 0041F4AF
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0041F4C8
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 0041F4D5
EndDialog.USER32(?,00000001), ref: 0041F4E1
EndDialog.USER32(?,00000002), ref: 0041F4F1
GetDlgItem.USER32(?,00000132), ref: 0041F4FE
SetWindowLongW.USER32(?,000000EB,?), ref: 0041F50B
SendMessageW.USER32(?,00000143,00000000,?), ref: 0041F580
SendMessageW.USER32(?,00000151,?,?), ref: 0041F59C
SendMessageW.USER32(?,0000014E,?,00000000), ref: 0041F5C0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0041F609

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: MessageSend$DialogItemLongWindow$H_prolog3
String ID:
API String ID: 1412253852-0
Opcode ID: 5868c3ceadad70d0855d5bb733a63fab5194d89ed05061ac5726330d4eb417de
Instruction ID: 50fbe99fa848cdb67074bd7d35958ac12d30966a646508fb96fc412763a994c0
Opcode Fuzzy Hash: 5868c3ceadad70d0855d5bb733a63fab5194d89ed05061ac5726330d4eb417de
Instruction Fuzzy Hash: 79916271500208EFDB14DF65CC96FEE3BA8BF15354F10412AF906A71E1DB78AA86CB58

Function 00452C44 Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 425COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00452C66
_memset.LIBCMT ref: 00452C8F
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?,?,?,000003C0), ref: 00452CA7
SHGetPathFromIDListW.SHELL32(?,?), ref: 00452CBE
SHGetMalloc.SHELL32(?), ref: 00452CC8

Part of subcall function 004526A2: __EH_prolog3.LIBCMT ref: 004526C1
Part of subcall function 004526A2: _memset.LIBCMT ref: 004526DE
Part of subcall function 004526A2: RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,?), ref: 004526FA
Part of subcall function 004526A2: RegQueryValueExW.ADVAPI32(?,CommonFilesDir,00000000,00000000,?,00000104), ref: 0045272C

Part of subcall function 00451E51: GetFileAttributesW.KERNEL32(?,00452D36,?,00000001,00000000,?,?,000003C0), ref: 00451E60

GetVersion.KERNEL32(00000001,00000001,?,00000001,00000000,?,?,000003C0), ref: 00452F54
GetVersion.KERNEL32(00000001,00000001,?,00000001,00000000,?,?,000003C0), ref: 004530BD
GetVersion.KERNEL32(00000000,00000000,?,?,000003C0), ref: 00453194

Part of subcall function 004488C4: __EH_prolog3.LIBCMT ref: 004488E3
Part of subcall function 004488C4: GetModuleHandleW.KERNEL32(KERNEL32.DLL,00000070), ref: 00448902
Part of subcall function 004488C4: GetProcAddress.KERNEL32(00000000,GetSystemWindowsDirectoryW), ref: 00448912

Strings

All Users\, xrefs: 0045302F
Personal\, xrefs: 0045319E
Program Files, xrefs: 00452F4A
Application Data\, xrefs: 00453061
Fonts, xrefs: 0045307C
Common Files\, xrefs: 00452E74
My Documents\, xrefs: 0045310E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3Version$_memset$AddressAttributesFileFolderFromHandleListLocationMallocModuleOpenPathProcQuerySpecialValue
String ID: All Users\$Application Data\$Common Files\$Fonts$My Documents\$Personal\$Program Files
API String ID: 4275033337-157871694
Opcode ID: 00896336829fb4366ac22655d63dfd18bfce0039f7ff7f372ad6aea0db989fa6
Instruction ID: 5fbbb8545e8d394e7aafa1a04bc0b8efcb58a93f24d53aef265e80311f5309b1
Opcode Fuzzy Hash: 00896336829fb4366ac22655d63dfd18bfce0039f7ff7f372ad6aea0db989fa6
Instruction Fuzzy Hash: 82F1813180424CAADB15EFA4CD95BEE7BB8AF15305F14409FF80963193DA789B4CCB69

Function 0043A451 Relevance: 26.6, APIs: 7, Strings: 8, Instructions: 335COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043A4C0
_memset.LIBCMT ref: 0043A4D3
_wcschr.LIBCMT ref: 0043A54B
_wcschr.LIBCMT ref: 0043A559
wsprintfW.USER32 ref: 0043A585

Strings

%s%s, xrefs: 0043A56B
J, xrefs: 0043A740
auto, xrefs: 0043A673
%s, xrefs: 0043A599
%s"%s", xrefs: 0043A579
no_engine, xrefs: 0043A61F
ScriptDriven, xrefs: 0043A5B0
Startup, xrefs: 0043A5C5

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset_wcschr$wsprintf
String ID: %s$ %s"%s"$ %s%s$ScriptDriven$Startup$auto$no_engine$J
API String ID: 2761898990-1125408813
Opcode ID: 1a5d9be8c16aebf1ba3bf77304bf8298adda3fe26d6f3bf7ff8c99d7e72b244e
Instruction ID: afb9486183bbce67a453120d25ea064f7c5582756a718fd9600f9a72450b2d6a
Opcode Fuzzy Hash: 1a5d9be8c16aebf1ba3bf77304bf8298adda3fe26d6f3bf7ff8c99d7e72b244e
Instruction Fuzzy Hash: 9EC19172800248EADB11EBA4CC86BEF7B78AF15314F50416BF545A71D1EB385B48C7AA

Function 004346E4 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 206stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004346EB
lstrlenW.KERNEL32(?,00000064), ref: 00434710
CoTaskMemFree.OLE32(00000000), ref: 0043472E
CoTaskMemFree.OLE32(?), ref: 0043475B

Strings

HKCU{Software{Classes, xrefs: 004347BD
HKCR, xrefs: 00434794, 004347AB
}}, xrefs: 00434839

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: FreeTask$H_prolog3_lstrlen
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 1877075980-1142484189
Opcode ID: 0a5b0343f5017e009697f9818044e974e58c8820b7f9c4918a59b82b6a166275
Instruction ID: 53315cd8edee9d02a883378c3f7f44aa8011e94d0185e5871bcd0024605a728f
Opcode Fuzzy Hash: 0a5b0343f5017e009697f9818044e974e58c8820b7f9c4918a59b82b6a166275
Instruction Fuzzy Hash: 8C7187749003899EDF24EFA5C8447EEBBF4AF99304F20142FD485AB255D778A884CB19

Function 004245F4 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 180COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00424613
_memset.LIBCMT ref: 00424644
wsprintfW.USER32 ref: 004246F0

Part of subcall function 004378CA: __EH_prolog3.LIBCMT ref: 004378D1

wsprintfW.USER32 ref: 00424722
wsprintfW.USER32 ref: 00424737
_memset.LIBCMT ref: 004247E4
SetCurrentDirectoryW.KERNEL32(00000000,?,?,00000001,?,?,?,?,?,?,?,?,00000048), ref: 0042480C

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 00424679
2.0.2600.0, xrefs: 004246C2
InstallerLocation, xrefs: 004247F4
Software\Microsoft\Windows\CurrentVersion\Installer, xrefs: 004247C0
Installing MSI engine %s, xrefs: 00424673
"%s" /q, xrefs: 004246EA
"%s" /c:"msiinst /delayrebootq", xrefs: 00424731
"%s" /quiet /norestart, xrefs: 0042471C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: wsprintf$H_prolog3_memset$CurrentDirectory
String ID: "%s" /c:"msiinst /delayrebootq"$"%s" /q$"%s" /quiet /norestart$2.0.2600.0$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$InstallerLocation$Installing MSI engine %s$Software\Microsoft\Windows\CurrentVersion\Installer
API String ID: 2961981356-471921938
Opcode ID: 8b043cd9e435f894da0f6d65d95a2a2c5bae0b000a11f5a5322038adf058be53
Instruction ID: 40228c3c01e5daf8e7e8a52ed0d35dd21cb4aac886ca19d2f7dd7924245d9a7b
Opcode Fuzzy Hash: 8b043cd9e435f894da0f6d65d95a2a2c5bae0b000a11f5a5322038adf058be53
Instruction Fuzzy Hash: 1161C5B5900208AFDB14EFA4DC85AEE77B8EF55304F50402FE515A7291EB7C5A04CB6D

Function 00417258 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00417271
GetProcAddress.KERNEL32(?,WinVerifyTrust), ref: 004172A6
_memset.LIBCMT ref: 004172B6
_memset.LIBCMT ref: 004172C2
_wcslen.LIBCMT ref: 004172C8
_wcslen.LIBCMT ref: 004172E6
_wcscpy.LIBCMT ref: 00417318
_memset.LIBCMT ref: 0041733B
GetProcAddress.KERNEL32(?,WTHelperProvDataFromStateData), ref: 0041738F
GetProcAddress.KERNEL32(?,WTHelperGetProvSignerFromChain), ref: 004173A4

Strings

WTHelperProvDataFromStateData, xrefs: 00417385
WTHelperGetProvSignerFromChain, xrefs: 0041739D
WTHelperGetProvCertFromChain, xrefs: 004173B9
WinVerifyTrust, xrefs: 0041729A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressProc_memset$_wcslen$H_prolog3_catch_wcscpy
String ID: WTHelperGetProvCertFromChain$WTHelperGetProvSignerFromChain$WTHelperProvDataFromStateData$WinVerifyTrust
API String ID: 172072501-2375090227
Opcode ID: 85565a7cf5afe4b9ff3256a831cf45e2d9677e50fcc5475945c43d18ddf69263
Instruction ID: 8cfd0692c88fbaa5317d29bf1d76a30b4f43e5ade21db00b3914c30905f121a6
Opcode Fuzzy Hash: 85565a7cf5afe4b9ff3256a831cf45e2d9677e50fcc5475945c43d18ddf69263
Instruction Fuzzy Hash: C3517DB190424CAFDF00EFA4CC85ADE7BB4BF08354F10812AF815E6291D7788A44CB58

Function 0041709A Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 159libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004170A5
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 004170CE
_memset.LIBCMT ref: 004170DE
_memset.LIBCMT ref: 004170EA
_wcslen.LIBCMT ref: 004170F2
_wcslen.LIBCMT ref: 00417112
_wcscpy.LIBCMT ref: 00417146
_memset.LIBCMT ref: 00417176
GetProcAddress.KERNEL32(?,WTHelperProvDataFromStateData), ref: 004171C0
GetProcAddress.KERNEL32(?,WTHelperGetProvSignerFromChain), ref: 004171D5

Strings

WTHelperProvDataFromStateData, xrefs: 004171B6
WTHelperGetProvSignerFromChain, xrefs: 004171CE
WTHelperGetProvCertFromChain, xrefs: 004171EA
WinVerifyTrust, xrefs: 004170C2

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressProc_memset$_wcslen$H_prolog3_catch_wcscpy
String ID: WTHelperGetProvCertFromChain$WTHelperGetProvSignerFromChain$WTHelperProvDataFromStateData$WinVerifyTrust
API String ID: 172072501-2375090227
Opcode ID: 5110225fd1b5007df1aa8719529d2b585cd730b085dbedcc44a7ee3519c81a0c
Instruction ID: ecc0735c6fabbbddbe0a67deb02078d3453b5c152d615cdbdb6661eb222a30ac
Opcode Fuzzy Hash: 5110225fd1b5007df1aa8719529d2b585cd730b085dbedcc44a7ee3519c81a0c
Instruction Fuzzy Hash: 29516BB1504288AFDF14EFA5CC81AED7BA8FF08344F14842EF905D72A1D739DA958B58

Function 004409A5 Relevance: 25.8, APIs: 17, Instructions: 301filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004409BE

Part of subcall function 00465987: _malloc.LIBCMT ref: 004659A1

_memset.LIBCMT ref: 00440A33

Part of subcall function 004408E1: __EH_prolog3_GS.LIBCMT ref: 004408E8
Part of subcall function 004408E1: GetTempPathW.KERNEL32(00000104,00000000,?,00000104,0000004C,00440E20,00000068), ref: 00440937
Part of subcall function 004408E1: GetTempFileNameW.KERNELBASE(?,_is,00000000,?,?,00000104), ref: 0044097B

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 00440B6E
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,00000080,00000000), ref: 00440B8C
GetLastError.KERNEL32 ref: 00440B96
CloseHandle.KERNEL32(?), ref: 00440BA5
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000068), ref: 00440BBE
GetLastError.KERNEL32 ref: 00440BCC

Part of subcall function 004408B0: __EH_prolog3.LIBCMT ref: 004408B7

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

lstrcpyA.KERNEL32(?,00000000), ref: 00440BF1
GetFileSize.KERNEL32(?,00000000), ref: 00440BF7
lstrcpyA.KERNEL32(?,?,?,00000000,00000000), ref: 00440C28

Part of subcall function 00440875: __EH_prolog3.LIBCMT ref: 0044087C
Part of subcall function 00440875: DeleteFileW.KERNELBASE(?,00000004,00440E72,?,00000068), ref: 00440899

WriteFile.KERNEL32(?,?,0000002E,?,00000000), ref: 00440C59

Part of subcall function 0043FB00: SetFilePointer.KERNELBASE(?,?,?,?,74DF3140,?,00440EA9,00000000,?,00000000,00000000), ref: 0043FB14
Part of subcall function 0043FB00: GetLastError.KERNEL32(?,00440EA9,00000000,?,00000000,00000000), ref: 0043FB1C

WriteFile.KERNEL32(?,?,00000138,?,00000000,?,00000000,00000000,00000002), ref: 00440C81
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00440CE8
ReadFile.KERNEL32(?,?,00000400,?,00000000), ref: 00440D1C
CloseHandle.KERNEL32(?,?), ref: 00440D3A
CloseHandle.KERNEL32(?), ref: 00440D3F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$H_prolog3$CloseErrorHandleLastWrite$CreateTemplstrcpy$CopyDeleteH_prolog3_NamePathPointerReadSize_malloc_memset
String ID:
API String ID: 215976044-0
Opcode ID: 8289fbb269c47e69f1f13866bbda1d9a249928fcb82032b16139682082fcf9aa
Instruction ID: 807b3a315ec163be032c45e5ad2a81fe8549b91cdd6683268999fd772732d089
Opcode Fuzzy Hash: 8289fbb269c47e69f1f13866bbda1d9a249928fcb82032b16139682082fcf9aa
Instruction Fuzzy Hash: 3CC17F71500248EFEF11DF60CD85AEE7BA9EF18308F04452EFA09A7291D735AD54DB98

Function 0043F616 Relevance: 25.6, APIs: 17, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000018,?), ref: 0043F638
GetDesktopWindow.USER32 ref: 0043F642
GetClientRect.USER32(00000000), ref: 0043F649
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0043F672
GetDC.USER32(?), ref: 0043F68D
GetObjectW.GDI32(00000018,?), ref: 0043F6A4
CreateCompatibleDC.GDI32(00000000), ref: 0043F6AB
UnrealizeObject.GDI32(00000000), ref: 0043F6C5
SelectPalette.GDI32(00000000,00000000), ref: 0043F6D5
RealizePalette.GDI32(00000000), ref: 0043F6DE
UnrealizeObject.GDI32 ref: 0043F6E6
SelectPalette.GDI32(00000014,00000000), ref: 0043F6F3
RealizePalette.GDI32(00000014), ref: 0043F6F8
SelectObject.GDI32(00000014), ref: 0043F706
BitBlt.GDI32(?,00000000,00000000,?,?,00000014,00000000,00000000,00CC0020), ref: 0043F721
ReleaseDC.USER32(?,?), ref: 0043F72D
DeleteDC.GDI32(00000014), ref: 0043F736

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Object$Palette$Select$RealizeUnrealizeWindow$ClientCompatibleCreateDeleteDesktopMoveRectRelease
String ID:
API String ID: 366568439-0
Opcode ID: 7319d5937c7254b565d4c4f0512793d0debdb199be9569343ff63c0134ab64ee
Instruction ID: 7a1558f87c68ee1e77b8739d70035773182a13efa3a225a5542437cdc53e7309
Opcode Fuzzy Hash: 7319d5937c7254b565d4c4f0512793d0debdb199be9569343ff63c0134ab64ee
Instruction Fuzzy Hash: 4A310432900108FFCB519FA5ED88D9E7FBAEB89311F119122F605A6130CB329955EF68

Function 0042A53C Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 335COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042A558

Strings

DotNetOptionalInstallIfSilent, xrefs: 0042A693
J#InstallOptionIfSilent, xrefs: 0042A6CD
2.0.0.0, xrefs: 0042A709
3.0, xrefs: 0042A8AD, 0042A8B2, 0042A8B3
1.0, xrefs: 0042A81B
J#Optional, xrefs: 0042A6D2
2.0, xrefs: 0042A79D, 0042A861, 0042A8A6
1.1, xrefs: 0042A77B, 0042A7B8, 0042A840
3.0.0.0, xrefs: 0042A75D
DotNetOptional, xrefs: 0042A698
Startup, xrefs: 0042A602
DotNetLangPacks, xrefs: 0042A5E9

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: 1.0$1.1$2.0$2.0.0.0$3.0$3.0.0.0$DotNetLangPacks$DotNetOptional$DotNetOptionalInstallIfSilent$J#InstallOptionIfSilent$J#Optional$Startup
API String ID: 431132790-1844836242
Opcode ID: 7c9cbfb5013bbec942608a950d89a8d2b0e10100ce659f22c30776cf1a02599c
Instruction ID: 02439e36c1a9149d1afb36726dcff9fd2542d6b7b3b6d190f28e40c8088454f0
Opcode Fuzzy Hash: 7c9cbfb5013bbec942608a950d89a8d2b0e10100ce659f22c30776cf1a02599c
Instruction Fuzzy Hash: F6D1E071A00258DFDF10EF65D881AEE3BA4AB59308F50426FFD05A3291E738CE55CB5A

Function 004257EE Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 245COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042580D
_memset.LIBCMT ref: 0042582D
_memset.LIBCMT ref: 00425848

Part of subcall function 004412A3: lstrcpyW.KERNEL32(?,004BDF40,?), ref: 004412EA
Part of subcall function 004412A3: lstrcpyW.KERNEL32(?,004BDF40), ref: 004412F0
Part of subcall function 004412A3: GetFileVersionInfoSizeW.VERSION(?,?), ref: 004412F7
Part of subcall function 004412A3: _malloc.LIBCMT ref: 00441307
Part of subcall function 004412A3: _memset.LIBCMT ref: 00441313
Part of subcall function 004412A3: GetFileVersionInfoW.VERSION(?,00000000,00000000,?,?,?), ref: 00441323
Part of subcall function 004412A3: _memset.LIBCMT ref: 0044133A
Part of subcall function 004412A3: VerQueryValueW.VERSION(?,004AE53C,?,?,00000000,00000000,?,?,?), ref: 00441355
Part of subcall function 004412A3: wsprintfW.USER32 ref: 0044137F
Part of subcall function 004412A3: _memset.LIBCMT ref: 00441391
Part of subcall function 004412A3: VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,004AE53C,?,?,00000000,00000000,?,?,?), ref: 004413A9

Part of subcall function 00441C01: lstrcpyW.KERNEL32(?,?,?,?), ref: 00441C4B
Part of subcall function 00441C01: lstrcpyW.KERNEL32(?,?,?,?), ref: 00441C52
Part of subcall function 00441C01: _swscanf.LIBCMT ref: 00441C9E
Part of subcall function 00441C01: _swscanf.LIBCMT ref: 00441CB8

Part of subcall function 004378CA: __EH_prolog3.LIBCMT ref: 004378D1

GetVersionExW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0000006C), ref: 004258CB
_memset.LIBCMT ref: 00425949
GetTempPathW.KERNEL32(00000400,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000006C), ref: 0042595E
GetWindowsDirectoryW.KERNEL32(?,00000400,?,?,?,?,?,?,?,?,?,?,?,?,?,0000006C), ref: 00425989

Part of subcall function 0041FB05: _memset.LIBCMT ref: 0041FB5A
Part of subcall function 0041FB05: __wsplitpath.LIBCMT ref: 0041FB6A
Part of subcall function 0041FB05: lstrcatW.KERNEL32(?,004AE53C), ref: 0041FB7E

Part of subcall function 00439DA7: __EH_prolog3.LIBCMT ref: 00439DB2

Strings

SupportOSMsi30, xrefs: 004258DB
SupportOS, xrefs: 004258F2, 004258F8
SuppressWrongOS, xrefs: 004259D9
Msi.DLL, xrefs: 0042585B
SupportOSMsi12, xrefs: 004258EB
Startup, xrefs: 004259EF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$lstrcpy$H_prolog3Version$FileInfoQueryValue_swscanf$DirectoryPathSizeTempWindows__wsplitpath_malloclstrcatwsprintf
String ID: Msi.DLL$Startup$SupportOS$SupportOSMsi12$SupportOSMsi30$SuppressWrongOS
API String ID: 535040701-4027240730
Opcode ID: 55604e43cfb3dff74e655f8bab9eb00668ae49ab7b8cd90f5a596d43e4fe1522
Instruction ID: 9dac9ad0675b94e176e5fcfb08bc9dd2e6278effb19ea26570ed5b3d6d1e4eb6
Opcode Fuzzy Hash: 55604e43cfb3dff74e655f8bab9eb00668ae49ab7b8cd90f5a596d43e4fe1522
Instruction Fuzzy Hash: 9591F571A00648DADB20EFA5DC45BEF37A8AF05314F50413FE806D7191EB38AB05CB69

Function 0041E101 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 159registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004014E0: RegOpenKeyExW.KERNELBASE(?,?,00000000,00000000,00000000), ref: 0040150A

RegDeleteValueW.ADVAPI32(?,ISSetup), ref: 0041E12E

Part of subcall function 00401490: RegCloseKey.ADVAPI32 ref: 004014AE

__wcsnicmp.LIBCMT ref: 0041E146
CharNextW.USER32(?), ref: 0041E159
lstrcmpW.KERNEL32(00000000,%IS_V%), ref: 0041E168
_memset.LIBCMT ref: 0041E207

Part of subcall function 004015B0: RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 004015EC

RegDeleteValueW.ADVAPI32(?,?), ref: 0041E22F

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

lstrcpyW.KERNEL32(004D7A00,?,/verbose,?), ref: 0041E2AF

Strings

ISSetup, xrefs: 0041E126
Software\Microsoft\Windows\CurrentVersion, xrefs: 0041E1DF
verbose, xrefs: 0041E13E
/verbose, xrefs: 0041E28C
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041E110
%IS_V%, xrefs: 0041E15F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Value$Delete$CharCloseH_prolog3NextOpenQuery__wcsnicmp_memsetlstrcmplstrcpy
String ID: %IS_V%$/verbose$ISSetup$Software\Microsoft\Windows\CurrentVersion$Software\Microsoft\Windows\CurrentVersion\Run$verbose
API String ID: 442299152-2584127249
Opcode ID: e1450038c411b63f753d54435ace6ce7c5c2e92ca283f9a7a2b0ee0cc55780a2
Instruction ID: edbe14f8b004c717239280c9c9ee9458b5e1fa75156770ece352038f3faf9079
Opcode Fuzzy Hash: e1450038c411b63f753d54435ace6ce7c5c2e92ca283f9a7a2b0ee0cc55780a2
Instruction Fuzzy Hash: 15519171D00249EBDF10EBA1DD45AEEBB78AF15304F20406AF506B31E2EB785A45CB69

Function 0044F414 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 116libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044F433
GetModuleHandleW.KERNEL32(kernel32.dll,CreateToolhelp32Snapshot,00000054), ref: 0044F451
GetProcAddress.KERNEL32(00000000), ref: 0044F45A

Part of subcall function 0044DAFD: __EH_prolog3.LIBCMT ref: 0044DB19
Part of subcall function 0044DAFD: LoadLibraryW.KERNEL32(psapi.dll,00000448), ref: 0044DB29
Part of subcall function 0044DAFD: GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0044DB4B
Part of subcall function 0044DAFD: GetModuleHandleW.KERNEL32(Ntdll.dll,NtQueryInformationProcess), ref: 0044DB72
Part of subcall function 0044DAFD: GetProcAddress.KERNEL32(00000000), ref: 0044DB79
Part of subcall function 0044DAFD: OpenProcess.KERNEL32(00000400,00000000,?), ref: 0044DB9A
Part of subcall function 0044DAFD: _memset.LIBCMT ref: 0044DBB2

Strings

CreateToolhelp32Snapshot, xrefs: 0044F444
Process32Next, xrefs: 0044F494
kernel32.dll, xrefs: 0044F449
Kernel32.dll, xrefs: 0044F489, 0044F48E, 0044F499
Process32First, xrefs: 0044F484

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressProc$H_prolog3HandleModule$LibraryLoadOpenProcess_memset
String ID: CreateToolhelp32Snapshot$Kernel32.dll$Process32First$Process32Next$kernel32.dll
API String ID: 2226161560-1872946363
Opcode ID: c292f8ea706ee8ad612e26e0659eafbd94e67791a9ee0e0e5d7fd5f4eba573e2
Instruction ID: 28d413cde08e174114d92f400ed9ab74c867dcb626d3f58c2dc953d2b8fff5af
Opcode Fuzzy Hash: c292f8ea706ee8ad612e26e0659eafbd94e67791a9ee0e0e5d7fd5f4eba573e2
Instruction Fuzzy Hash: 7A41C57190424CABEF10EFA5DC45AEF7BB8AF04304F10412BF515A7282EB389B08CB65

Function 0041E6BF Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?), ref: 0041E6D8
GetWindowRect.USER32(00000000,?), ref: 0041E6E1
GetSystemMetrics.USER32(00000001), ref: 0041E6EB
GetSystemMetrics.USER32(00000000), ref: 0041E6EF
SetRect.USER32(?,00000000,00000000,00000000), ref: 0041E6F8
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0041E72F
IsWindow.USER32(00000000), ref: 0041E738
GetWindowRect.USER32(00000000,?), ref: 0041E74E
IntersectRect.USER32(?,?,?), ref: 0041E75C
SubtractRect.USER32(?,?,?), ref: 0041E778
SetWindowPos.USER32(00000000,?,?,0000001E,00000000,00000000,00000005,0000001E), ref: 0041E7B8

Strings

Shell_TrayWnd, xrefs: 0041E72A
F, xrefs: 0041E747

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: RectWindow$MetricsSystem$FindIntersectSubtract
String ID: F$Shell_TrayWnd
API String ID: 301737298-1447713892
Opcode ID: 2259caf0b08899e30912f04a58e97183d208d53c9d80b41f54af3a2d2bc02adc
Instruction ID: 55e4ca6884f6ca5c77fa069ad0c75e7538a12666d15100065320cf5af5b0f056
Opcode Fuzzy Hash: 2259caf0b08899e30912f04a58e97183d208d53c9d80b41f54af3a2d2bc02adc
Instruction Fuzzy Hash: 8331F8B2D0021DAFDB00DFE8DD88AEFBBBDEB49314F044026E911E7254DA74A905CB64

Function 0045D592 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 70libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,UnmapViewOfFile,?,?,00000000,?,?,00449CB8,?,?,00000001), ref: 0045D50F
GetProcAddress.KERNEL32(00000000), ref: 0045D518
GetModuleHandleW.KERNEL32(Kernel32,CloseHandle,?,?,00000000,?,?,00449CB8,?,?,00000001), ref: 0045D529
GetProcAddress.KERNEL32(00000000), ref: 0045D52C
GetModuleHandleW.KERNEL32(Kernel32,SetFilePointer,?,?,00000000,?,?,00449CB8,?,?,00000001), ref: 0045D547
GetProcAddress.KERNEL32(00000000), ref: 0045D54A
GetModuleHandleW.KERNEL32(Kernel32,SetEndOfFile,?,?,00000000,?,?,00449CB8,?,?,00000001), ref: 0045D562
GetProcAddress.KERNEL32(00000000), ref: 0045D565

Strings

Kernel32, xrefs: 0045D509, 0045D50E, 0045D528, 0045D546, 0045D561
UnmapViewOfFile, xrefs: 0045D504
CloseHandle, xrefs: 0045D523
SetFilePointer, xrefs: 0045D541
SetEndOfFile, xrefs: 0045D55C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CloseHandle$Kernel32$SetEndOfFile$SetFilePointer$UnmapViewOfFile
API String ID: 1646373207-1519668244
Opcode ID: bc9017a8e63c6dd7d92255c2758cf7a4fc68e2637fd0e232cdd92c2a523e540a
Instruction ID: f92dc9e2efea824376ad36f8501fe5f270c1ea650f76567925ee8c1896e6166f
Opcode Fuzzy Hash: bc9017a8e63c6dd7d92255c2758cf7a4fc68e2637fd0e232cdd92c2a523e540a
Instruction Fuzzy Hash: B811E2B0901705BED7306B75DC04F1BBFE8DF45301F208D2AA452D2662EB78E944CB28

Function 00434EE3 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 422stringregistryCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,Delete,80C21959), ref: 00434F96
lstrcmpiW.KERNEL32(?,ForceRemove), ref: 00434FAC
lstrcmpiW.KERNEL32(?,NoRemove), ref: 00435061
lstrcmpiW.KERNEL32(?,Val), ref: 00435087
RegDeleteValueW.ADVAPI32(?,00000000), ref: 00435146
lstrlenW.KERNEL32(?), ref: 00435288

Part of subcall function 00434033: lstrcmpiW.KERNEL32(?,004BDF0C), ref: 0043403F

RegDeleteKeyW.ADVAPI32(?,?), ref: 00435375
lstrlenW.KERNEL32(?), ref: 004353AB

Strings

Delete, xrefs: 00434F89
Val, xrefs: 00435081
ForceRemove, xrefs: 00434FA2
NoRemove, xrefs: 0043505B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: lstrcmpi$Deletelstrlen$Value
String ID: Delete$ForceRemove$NoRemove$Val
API String ID: 3540924913-1781481701
Opcode ID: 33424d4ad702a68b663652a4414758469f5b25e2fe6f21b328e47c2a01be2c68
Instruction ID: 9200e8b44f6eaf71bffe49ae399bf41a99a2bb3a54c3f2de4e8c5b3c672011ea
Opcode Fuzzy Hash: 33424d4ad702a68b663652a4414758469f5b25e2fe6f21b328e47c2a01be2c68
Instruction Fuzzy Hash: 2BF17871C0025AEBCF24EFA5C8C09FEBBB4AB5D344F18246FE915B7251D6381A44CB69

Function 00450EF6 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 259processCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00450F00
_memset.LIBCMT ref: 00450F99
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000044,004DB808,?,00000000), ref: 00451014
GetLastError.KERNEL32 ref: 0045102C

Part of subcall function 0041CABA: __EH_prolog3.LIBCMT ref: 0041CAC1

_memset.LIBCMT ref: 004510A8
ShellExecuteExW.SHELL32(0000003C), ref: 0045115E
WaitForInputIdle.USER32(?,000003E8), ref: 004511FF
GetExitCodeProcess.KERNEL32(?,004DB804), ref: 00451223
GetLastError.KERNEL32(?,?,?,00000000), ref: 0045122D

Part of subcall function 00415E5D: __EH_prolog3.LIBCMT ref: 00415E64

Part of subcall function 0041C97A: __EH_prolog3.LIBCMT ref: 0041C981

Strings

<, xrefs: 004510C4
D, xrefs: 00450FAF
open, xrefs: 004510CB

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ErrorLastProcess_memset$CodeCreateExecuteExitIdleInputShellWait
String ID: <$D$open
API String ID: 2881500700-2836273618
Opcode ID: 1399c69a0ac665a73dfff250f5e15fade8dc172b05e3b1d7f8f3fd22cfcbdf15
Instruction ID: a7783daa80de504285cc2a4f48b81baea5031cfdb90ef9080a6633e1b62946bd
Opcode Fuzzy Hash: 1399c69a0ac665a73dfff250f5e15fade8dc172b05e3b1d7f8f3fd22cfcbdf15
Instruction Fuzzy Hash: 5CA1A471900248EFDB10EFA4CC85BDE7BB8AF15304F54816FF905671A2DB785A48CBA9

Function 00416D5E Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 158libraryloaderfileCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00416D65
LoadLibraryW.KERNEL32(crypt32.dll,00000074), ref: 00416D80
GetProcAddress.KERNEL32(00000000,CertCompareCertificate), ref: 00416DB4
GetProcAddress.KERNEL32(00000000,CertAddSerializedElementToStore), ref: 00416DBF
GetProcAddress.KERNEL32(00000000,CertFreeCertificateContext), ref: 00416DCA
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 00416E16
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00416E48
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00416E76

Strings

CertFreeCertificateContext, xrefs: 00416DC4
CertAddSerializedElementToStore, xrefs: 00416DB9
crypt32.dll, xrefs: 00416D7B
CertCompareCertificate, xrefs: 00416DA8

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressFileProc$CreateH_prolog3_catch_LibraryLoadReadSize
String ID: CertAddSerializedElementToStore$CertCompareCertificate$CertFreeCertificateContext$crypt32.dll
API String ID: 2126423863-2082943641
Opcode ID: 008fcebc70b5fe65e6b1767f716010e28d13f12fc3ec8cc8599985dd4053e5fb
Instruction ID: 1b6f4c97f6cba77bbd38314915217b45f450426fa6499ce373685692bb398fbf
Opcode Fuzzy Hash: 008fcebc70b5fe65e6b1767f716010e28d13f12fc3ec8cc8599985dd4053e5fb
Instruction Fuzzy Hash: 9B517B71D05288EEDF11DBE4C984BEEBFB8AF15304F25806FE005AB281DA785E45CB19

Function 0043F79E Relevance: 21.1, APIs: 14, Instructions: 106windowmemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043F7A8
GetObjectW.GDI32(?,00000018,?), ref: 0043F7B6
CreateCompatibleDC.GDI32(00000000), ref: 0043F7D2
SelectObject.GDI32(00000000,?), ref: 0043F7DF
GetDIBColorTable.GDI32(?,00000000,00000100,?), ref: 0043F7F7
GlobalAlloc.KERNEL32(00000042,00000408), ref: 0043F807
GlobalLock.KERNEL32(00000000), ref: 0043F815
GetSystemPaletteEntries.GDI32(?,00000000,0000000A,00000004), ref: 0043F8AF
GetSystemPaletteEntries.GDI32(?,000000F6,0000000A,000003DC), ref: 0043F8C2
CreatePalette.GDI32(00000000), ref: 0043F8C5
DeleteDC.GDI32(?), ref: 0043F8D3
GetDC.USER32(00000000), ref: 0043F8E7
CreateHalftonePalette.GDI32(00000000), ref: 0043F8F0
ReleaseDC.USER32(00000000,00000000), ref: 0043F8FE

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Palette$Create$EntriesGlobalObjectSystem$AllocColorCompatibleDeleteH_prolog3HalftoneLockReleaseSelectTable
String ID:
API String ID: 847475549-0
Opcode ID: d4e82bd4d4383b65ab1a7454b157bc7180f81f9f9df8892f231b274063c44e34
Instruction ID: 2127b6c08c4b50ac7c23de11570212b842b2e9df15b5be45074d17e3c1a496fa
Opcode Fuzzy Hash: d4e82bd4d4383b65ab1a7454b157bc7180f81f9f9df8892f231b274063c44e34
Instruction Fuzzy Hash: 7741C271904256EFDB099FA0DC89BEE7FB4EF1A304F158076F945972A0D7348908CB59

Function 00446B93 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 92registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll), ref: 00446BA8
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 00446BB8
RegOpenKeyExW.ADVAPI32(80000003,.Default\Control Panel\desktop\ResourceLocale,00000000,000F003F,00000000), ref: 00446BF4
RegQueryValueExW.ADVAPI32(00000000,004BDF40,00000000,00000000,?,0000000A), ref: 00446C0E
RegOpenKeyExW.ADVAPI32(80000003,.DEFAULT\Control Panel\International,00000000,000F003F,00000000), ref: 00446C29
RegQueryValueExW.ADVAPI32(00000000,Locale,00000000,00000000,?,0000000A), ref: 00446C43
__wcstoi64.LIBCMT ref: 00446C6E

Strings

Locale, xrefs: 00446C3B
.DEFAULT\Control Panel\International, xrefs: 00446C23
GetSystemDefaultUILanguage, xrefs: 00446BB2
Kernel32.dll, xrefs: 00446BA3
.Default\Control Panel\desktop\ResourceLocale, xrefs: 00446BE2

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: OpenQueryValue$AddressHandleModuleProc__wcstoi64
String ID: .DEFAULT\Control Panel\International$.Default\Control Panel\desktop\ResourceLocale$GetSystemDefaultUILanguage$Kernel32.dll$Locale
API String ID: 2065448255-3798069133
Opcode ID: 6f3fbfaaa998abe9c24dcc06b753e828e764ef7e5176eb89f602d1348ef79c28
Instruction ID: 12638b4f6c19d1e8cf4835ce1b2639a4cd67601cc572879166d402c38b42e7ca
Opcode Fuzzy Hash: 6f3fbfaaa998abe9c24dcc06b753e828e764ef7e5176eb89f602d1348ef79c28
Instruction Fuzzy Hash: 882158B1E00219ABEB10DB95CC86FFF77BCDF05745F11002BB501F6181D6689A058ABE

Function 00440042 Relevance: 19.7, APIs: 13, Instructions: 172filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00440071
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?), ref: 004400A1
GetLastError.KERNEL32 ref: 004400B1
lstrcpyA.KERNEL32(?,00000000,?,00000000,00000001), ref: 00440109
WriteFile.KERNEL32(00000000,?,0000002E,?,00000000), ref: 0044012B
GetFileSize.KERNEL32(?,00000000,00000000,?,00000000,00000000), ref: 0044015C
SetEndOfFile.KERNEL32(?), ref: 00440198
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 004401C1
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004401FE
ReadFile.KERNEL32(?,?,00000400,?,00000000,00000000,?,00000000,00000001), ref: 0044021A
SetEndOfFile.KERNEL32(?), ref: 00440223
CloseHandle.KERNEL32(?), ref: 0044022C
CloseHandle.KERNEL32(?), ref: 00440235

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$CloseCreateHandleWrite$ErrorLastReadSize_memsetlstrcpy
String ID:
API String ID: 4101932239-0
Opcode ID: e47cfea081293aa03568f87192f7e1d5b68723afc657311bb240b7eeb433d4af
Instruction ID: ffe292ab518ae7b26dd278d12a4053737d807de65af41f25eb669ed8d81d48d5
Opcode Fuzzy Hash: e47cfea081293aa03568f87192f7e1d5b68723afc657311bb240b7eeb433d4af
Instruction Fuzzy Hash: 10516271900108ABEF219BA5DC88EEEBB7DEF49310F14013AFA05E71A2DB359915CB64

Function 004293AA Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 283fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004293CC

Part of subcall function 00422343: __EH_prolog3.LIBCMT ref: 00422351

GetTempPathW.KERNEL32(00000104,00000000,?,00000104,?,00000000,ISSetup.dll,?,00000001,?,00000001,?,00000000,?,00000000,?), ref: 0042962B
GetTempFileNameW.KERNEL32(?,iss,00000000,?,?,00000104), ref: 00429670
DeleteFileW.KERNEL32(?,?), ref: 004296C0

Strings

ISSetup.dll, xrefs: 004295A6
E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 0042941A, 00429431, 0042947D, 00429494, 004294D1
SELECT * FROM `Binary`, xrefs: 0042946E
iss, xrefs: 0042966A
Error opening MSI database: %d, xrefs: 00429429
Failed to execute query on Binary table, error: %d, xrefs: 004294E0
Failed to query Binary table, error: %d, xrefs: 0042948C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: FileTemp$DeleteH_prolog3H_prolog3_catchNamePath
String ID: E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$Error opening MSI database: %d$Failed to execute query on Binary table, error: %d$Failed to query Binary table, error: %d$ISSetup.dll$SELECT * FROM `Binary`$iss
API String ID: 2369248198-1416288846
Opcode ID: 54a1bbaf692eee229894a63584646f01ab562409554e7ad50aba1326d49581d2
Instruction ID: 817b42199489eef3aca93b082b120413386db2fb043becac6be7d536d82277f1
Opcode Fuzzy Hash: 54a1bbaf692eee229894a63584646f01ab562409554e7ad50aba1326d49581d2
Instruction Fuzzy Hash: C0B19C71D04188EEDF10EFA1D995AEEBBB4AF11308F54406EF401B7192DB785E09CB69

Function 00424310 Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 201COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00424332
_memset.LIBCMT ref: 00424593
SetCurrentDirectoryW.KERNEL32(00000000,?,?,000001F2,?,?,00000000,00000084), ref: 004245BB

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 0042442E, 00424477, 004244F2
InstallerLocation, xrefs: 004245A3
Software\Microsoft\Windows\CurrentVersion\Installer, xrefs: 0042456F
Reboot will be deferred, xrefs: 0042448C
System is Win9x or reboot is not being suppressed, reboot will be immediate, xrefs: 00424507
Redist return value (%d) indicates a reboot is required, DotNetDelayReboot is %x, xrefs: 00424429
Startup, xrefs: 004243D6
DotNetDelayReboot, xrefs: 004243BD

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CurrentDirectoryH_prolog3_memset
String ID: DotNetDelayReboot$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$InstallerLocation$Reboot will be deferred$Redist return value (%d) indicates a reboot is required, DotNetDelayReboot is %x$Software\Microsoft\Windows\CurrentVersion\Installer$Startup$System is Win9x or reboot is not being suppressed, reboot will be immediate
API String ID: 2232225567-3197750624
Opcode ID: bb2c6bb6fdeef5fb5624df5e22f6f375d7fade4cbbc702308e230e4ad9070954
Instruction ID: 591c065ee09782d461a66211bf5a4441b6bc40e5fc9f418a681917d0c2cc02f2
Opcode Fuzzy Hash: bb2c6bb6fdeef5fb5624df5e22f6f375d7fade4cbbc702308e230e4ad9070954
Instruction Fuzzy Hash: 12819171D00258AFEB20DFE4D885BEEB7B8EF54304F50416BE515A7291D7385B44CB68

Function 0046D14D Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,004D1F58,0000000C,0046D288,00000000,00000000), ref: 0046D15F
__crt_waiting_on_module_handle.LIBCMT ref: 0046D16A

Part of subcall function 0046ECE1: Sleep.KERNEL32(000003E8,00000000,?,0046D073,KERNEL32.DLL,?,0046D0DF), ref: 0046ECED
Part of subcall function 0046ECE1: GetModuleHandleW.KERNEL32(?,?,0046D073,KERNEL32.DLL,?,0046D0DF), ref: 0046ECF6

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0046D193
GetProcAddress.KERNEL32(?,DecodePointer), ref: 0046D1A3
__lock.LIBCMT ref: 0046D1C5
InterlockedIncrement.KERNEL32(004D6388), ref: 0046D1D2
__lock.LIBCMT ref: 0046D1E6
___addlocaleref.LIBCMT ref: 0046D204

Strings

KERNEL32.DLL, xrefs: 0046D159, 0046D15E, 0046D169
EncodePointer, xrefs: 0046D187
DecodePointer, xrefs: 0046D19B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 34d9f02e6080d9e4127d08b0167de8463a80820e961743f2aaf6c566abd23478
Instruction ID: 1d46fddd42f2f01026c210b371c405473de6c3a0c51b251e8cb4937c2382b9f6
Opcode Fuzzy Hash: 34d9f02e6080d9e4127d08b0167de8463a80820e961743f2aaf6c566abd23478
Instruction Fuzzy Hash: 9111A270940B00DFD720AF7AD845B8ABBE0AF05318F20855FE4A996391D778A9418F6D

Function 0045E107 Relevance: 18.1, APIs: 8, Strings: 4, Instructions: 147stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,00000000,00000001,?,?,?), ref: 0045E1AB
lstrcmpA.KERNEL32(?,NoRemove,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E1BD
lstrcmpA.KERNEL32(?,ForceRemove,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E1D0
lstrcmpA.KERNEL32(?,val,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E1E3
lstrcmpA.KERNEL32(?,HKCR,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045E1F6
lstrcmpA.KERNEL32(?,004B52E0), ref: 0045E20B
lstrcmpA.KERNEL32(?,004B52DC), ref: 0045E21B

Strings

val, xrefs: 0045E1DD
HKCR, xrefs: 0045E1F0
ForceRemove, xrefs: 0045E1CA
NoRemove, xrefs: 0045E1B7

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: lstrcmp$lstrcpyn
String ID: ForceRemove$HKCR$NoRemove$val
API String ID: 3250216649-3921688442
Opcode ID: 20bbe9ec4dadc565df8f6282c4a88311c0aa77448d3e6dd847cc2c87cff64c45
Instruction ID: a14a7d3b31ae7d7dadf17c93d596fe0d8c46167f73877073d781cb468989b100
Opcode Fuzzy Hash: 20bbe9ec4dadc565df8f6282c4a88311c0aa77448d3e6dd847cc2c87cff64c45
Instruction Fuzzy Hash: B0411871604B819AD73C4A3B8C44B737BDC9B41747F20459BFC83D529BC2BCDA4A8A19

Function 00426203 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 466windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041FBB4: _wcslen.LIBCMT ref: 0041FBCF
Part of subcall function 0041FBB4: _memset.LIBCMT ref: 0041FBED

SendMessageW.USER32(00010470,00000401,00000000,00000001), ref: 00426284
_memset.LIBCMT ref: 004262AB
_memset.LIBCMT ref: 004262C2
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00426833

Part of subcall function 00442DE8: __EH_prolog3_GS.LIBCMT ref: 00442DF2
Part of subcall function 00442DE8: wsprintfW.USER32 ref: 00442E35
Part of subcall function 00442DE8: wvsprintfW.USER32(?,?,?), ref: 00442E50

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 00416366: __EH_prolog3.LIBCMT ref: 00416388

_memset.LIBCMT ref: 0042674B
lstrcmpW.KERNEL32(?,004BDF40,-0000003C,?,?,?,?,?,?,?,?,?,0000064D,00000409,?,00000409), ref: 0042678D

Part of subcall function 004210B7: __EH_prolog3.LIBCMT ref: 004210BE

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 0042635C, 00426670
DownloadFiles: %s, xrefs: 0042666A
DownloadFiles: downloading %s, xrefs: 00426356
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 004263AB

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$H_prolog3$MessageSend$H_prolog3__wcslenlstrcmpwsprintfwvsprintf
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$DownloadFiles: %s$DownloadFiles: downloading %s$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp
API String ID: 1320460202-3428171715
Opcode ID: a4388c43c30bddfa29a63a1949cab02fbc3bbf739109bdfd2f2b414032535266
Instruction ID: 523c50836a94abce8c70471041d0a59d03be7a40dc52a84d526ae5a035ded5fa
Opcode Fuzzy Hash: a4388c43c30bddfa29a63a1949cab02fbc3bbf739109bdfd2f2b414032535266
Instruction Fuzzy Hash: D412A271A00288DFDB20EF65DD45FEE77B4AF11304F50416EE409AB192EB386B49CB69

Function 0040D5F9 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 223sleepfileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040D600
DeleteFileW.KERNEL32(-00000008), ref: 0040D6FA
Sleep.KERNEL32(00000064), ref: 0040D70E
RemoveDirectoryW.KERNEL32(-00000008), ref: 0040D82D
Sleep.KERNEL32(00000064), ref: 0040D841

Strings

File=%s, xrefs: 0040D648
Folder=%s, xrefs: 0040D770
DeleterDeleteFolder, xrefs: 0040D79D
DeleterDeleteFile, xrefs: 0040D675
ISSetupDLLOp, xrefs: 0040D690, 0040D7B8

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Sleep$DeleteDirectoryFileH_prolog3Remove
String ID: DeleterDeleteFile$DeleterDeleteFolder$File=%s$Folder=%s$ISSetupDLLOp
API String ID: 3336508396-1636184637
Opcode ID: f940b35878523d1197f39e6f0df70c4a0cc2905d1dea01d5d11a4e085d1fffa7
Instruction ID: c131b9185ce15af74ec14de7b6b4e76a4c0f03e1eedd0ba55aaa12361a5fcc18
Opcode Fuzzy Hash: f940b35878523d1197f39e6f0df70c4a0cc2905d1dea01d5d11a4e085d1fffa7
Instruction Fuzzy Hash: 7381C571D00244DBDF04EBE9C986AEE7BB9AF11308F14407EE406771D2DA399E09CB66

Function 0044D557 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 153libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044D570
GetModuleHandleW.KERNEL32(Shell32.dll,SHBrowseForFolderW,00000040), ref: 0044D59D
GetProcAddress.KERNEL32(00000000), ref: 0044D5A6
GetModuleHandleW.KERNEL32(Shell32.dll,SHGetPathFromIDListW), ref: 0044D5B1
GetProcAddress.KERNEL32(00000000), ref: 0044D5B4
GetCurrentDirectoryW.KERNEL32(00000104,00000000,?,00000104), ref: 0044D5FB

Part of subcall function 0040B14B: __EH_prolog3.LIBCMT ref: 0040B152
Part of subcall function 0040B14B: GetLastError.KERNEL32(00000038,0040C732), ref: 0040B159
Part of subcall function 0040B14B: SetLastError.KERNEL32(00000000), ref: 0040B1A3

_memset.LIBCMT ref: 0044D614

Part of subcall function 0040B2F1: __EH_prolog3.LIBCMT ref: 0040B2F8

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

Strings

SHBrowseForFolderW, xrefs: 0044D58B
SHGetPathFromIDListW, xrefs: 0044D5A8
Shell32.dll, xrefs: 0044D590, 0044D595, 0044D5AD

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$AddressErrorHandleLastModuleProcString$AllocCurrentDirectory_memset
String ID: SHBrowseForFolderW$SHGetPathFromIDListW$Shell32.dll
API String ID: 312269345-2729166318
Opcode ID: 5447a448b5b2d485682a2916245fe859b5f74ad5d3a04b0587d4bd0ea25381a8
Instruction ID: 1746e3deb7a337f4c4504b29b34385dd288b77d1ce1ea25e09a1cb271e6c8946
Opcode Fuzzy Hash: 5447a448b5b2d485682a2916245fe859b5f74ad5d3a04b0587d4bd0ea25381a8
Instruction Fuzzy Hash: 1A513E71D00249AFDF10EFA5C895BDEBBB8EF09304F50406EF505A7292DB785A04CBA9

Function 00482D74 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getBasicDataType.LIBCMT ref: 00482DB0
DName::operator=.LIBCMT ref: 00482DC4
DName::operator+=.LIBCMT ref: 00482DD2
UnDecorator::getReferenceType.LIBCMT ref: 00482DF9
DName::DName.LIBCMT ref: 00482E17
UnDecorator::getDataIndirectType.LIBCMT ref: 00482E55
UnDecorator::getBasicDataType.LIBCMT ref: 00482E5E
operator+.LIBCMT ref: 00482E9D

Strings

volatile, xrefs: 00482DBC

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Decorator::getType$Data$Basic$IndirectNameName::Name::operator+=Name::operator=Referenceoperator+
String ID: volatile
API String ID: 2092030914-4266433718
Opcode ID: d9ff6908b747e8ccf04bb0eaa8666ac90e48a41fbb5d6c3160f844975a0f8d14
Instruction ID: 5bd21137f5f0e8183186c757f70df5bca4a85acb28bc045fbfb1c878174a4f95
Opcode Fuzzy Hash: d9ff6908b747e8ccf04bb0eaa8666ac90e48a41fbb5d6c3160f844975a0f8d14
Instruction Fuzzy Hash: 4731D071800149BFCB01AF55CE858FE7FA9EB04300F50886BF8456A211DBB89A82DB9C

Function 0046E292 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0046E2F5
__getptd.LIBCMT ref: 0046E307
___TypeMatch.LIBCMT ref: 0046E338
__getptd.LIBCMT ref: 0046E34E
___BuildCatchObject.LIBCMT ref: 0046E36B
__getptd.LIBCMT ref: 0046E3A0
__getptd.LIBCMT ref: 0046E3B2

Strings

csm, xrefs: 0046E375
csm, xrefs: 0046E2BD
MOC, xrefs: 0046E2A9

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: __getptd$BuildCatchMatchObjectType
String ID: MOC$csm$csm
API String ID: 1559916381-2232927589
Opcode ID: 6540a545efeeec66299f86559e09552ae03139d0d8e742e04e6f1428b67a1a3c
Instruction ID: 71c5c77e7157897fb8e0838c7863e5c569a06a5b3492d4d453cf87f5094f3c0a
Opcode Fuzzy Hash: 6540a545efeeec66299f86559e09552ae03139d0d8e742e04e6f1428b67a1a3c
Instruction Fuzzy Hash: 3E318A39900204DFDB309E5BC44076A73E8AF61315F68499BEC468B751F738D9C49B9B

Function 0044751E Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91libraryloadercomCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00447525
GetModuleHandleW.KERNEL32(Kernel32.dll,LocaleNameToLCID,00000010), ref: 00447538
GetProcAddress.KERNEL32(00000000), ref: 00447545
LoadLibraryW.KERNEL32(mlang.dll), ref: 00447577
CoCreateInstance.OLE32(004B9280,00000000,00000017,004B9220,00000000), ref: 004475CE
GetProcAddress.KERNEL32(00000000,Rfc1766ToLcidW), ref: 0044758E

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

Strings

mlang.dll, xrefs: 00447572
LocaleNameToLCID, xrefs: 0044752E
Rfc1766ToLcidW, xrefs: 00447588
Kernel32.dll, xrefs: 00447533

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressProcString$AllocCreateH_prolog3HandleInstanceLibraryLoadModule
String ID: Kernel32.dll$LocaleNameToLCID$Rfc1766ToLcidW$mlang.dll
API String ID: 2054398157-342692273
Opcode ID: ff658681cd15a23fad6394eaeee6c926c3635bd754db9be4e14405dde6309220
Instruction ID: 5f5ffd87b09fae7bc838c9814859b6eff09538b16027742aca0140d70989a328
Opcode Fuzzy Hash: ff658681cd15a23fad6394eaeee6c926c3635bd754db9be4e14405dde6309220
Instruction Fuzzy Hash: E7316771D04219AFDB10EFA5CC45BEE7774AF15705F10445AF401E7291DB78DA02CBA9

Function 0044C679 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00444C8F: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00444CA2
Part of subcall function 00444C8F: GetProcAddress.KERNEL32(00000000), ref: 00444CA9
Part of subcall function 00444C8F: GetCurrentProcess.KERNEL32(00000000), ref: 00444CB9

GetModuleHandleW.KERNEL32(kernel32,Wow64DisableWow64FsRedirection), ref: 0044C69D
GetProcAddress.KERNEL32(00000000), ref: 0044C6A6
GetModuleHandleW.KERNEL32(kernel32,Wow64RevertWow64FsRedirection), ref: 0044C6B1
GetProcAddress.KERNEL32(00000000), ref: 0044C6B4

Strings

Wow64RevertWow64FsRedirection, xrefs: 0044C6A8
kernel32, xrefs: 0044C697, 0044C69C, 0044C6AD, 0044C722
Wow64EnableWow64FsRedirection, xrefs: 0044C71D
Wow64DisableWow64FsRedirection, xrefs: 0044C692

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc$CurrentProcess
String ID: Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32
API String ID: 565683799-3439747844
Opcode ID: 8b8e4c1966a1effb10e058f3f4383d0c8ac397a28654eb387aa832ef65e72f4f
Instruction ID: 4025cb206db80fb65d498cac95b8e6b5f1deae950d865935464b9887b0858fb1
Opcode Fuzzy Hash: 8b8e4c1966a1effb10e058f3f4383d0c8ac397a28654eb387aa832ef65e72f4f
Instruction Fuzzy Hash: 5F117871902205F7EF546BB29C859AF3BACDF51356B19843BF401D2251DB3CC9449EA8

Function 0044D840 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044D847

Part of subcall function 0044D740: GetVersionExW.KERNEL32(?), ref: 0044D779

Strings

Windows Server 2003, xrefs: 0044D8FD
Windows NT 4.0, xrefs: 0044D8A5
Windows 2000, xrefs: 0044D8C1
Windows 95, xrefs: 0044D8BA
Windows 98, xrefs: 0044D8B3
Windows XP, xrefs: 0044D904
Windows Vista / Server 2008, xrefs: 0044D8F6
Windows 7 / Server 2008 R2, xrefs: 0044D8EF
Windows Me, xrefs: 0044D8AC

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_Version
String ID: Windows 2000$Windows 7 / Server 2008 R2$Windows 95$Windows 98$Windows Me$Windows NT 4.0$Windows Server 2003$Windows Vista / Server 2008$Windows XP
API String ID: 3152847492-529169932
Opcode ID: 87b58dd89e939a6b7e2e632fac82da11cdb7a6943201506118e0672100e975d5
Instruction ID: 943b04db5681fd673ff1fc0ce209aec7b0827cb8761cebed7c31c7c0d9cdce35
Opcode Fuzzy Hash: 87b58dd89e939a6b7e2e632fac82da11cdb7a6943201506118e0672100e975d5
Instruction Fuzzy Hash: E2212676D40318AAFF26FA58D846BFE2320AB41740F25003FFA11B61C2D67C5D45969E

Function 0043D5E2 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 314COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043D5FB

Part of subcall function 0040A7C0: __EH_prolog3.LIBCMT ref: 0040A7D9

Part of subcall function 0040F6F7: __EH_prolog3.LIBCMT ref: 0040F6FE

Part of subcall function 0040F3F1: __EH_prolog3.LIBCMT ref: 0040F3FB
Part of subcall function 0040F3F1: _wcslen.LIBCMT ref: 0040F40D
Part of subcall function 0040F3F1: _wcslen.LIBCMT ref: 0040F444
Part of subcall function 0040F3F1: SysStringLen.OLEAUT32(004ACAA4), ref: 0040F4F0
Part of subcall function 0040F3F1: SysFreeString.OLEAUT32(004ACAA4), ref: 0040F501

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Strings

runfromtemp, xrefs: 0043D7C3
no_engine, xrefs: 0043D80B
extract_all:, xrefs: 0043D76E
delayedstart:, xrefs: 0043D697
installfromweb:, xrefs: 0043D8D5
media_path:, xrefs: 0043D849
tempdisk1folder:, xrefs: 0043D6F3
auto, xrefs: 0043D7F3

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$String_wcslen$Free
String ID: auto$delayedstart:$extract_all:$installfromweb:$media_path:$no_engine$runfromtemp$tempdisk1folder:
API String ID: 3546151662-1942570774
Opcode ID: d962a1264cc89049653c7473b437981101b1f6dbd0bba1b2108e6da7e77bc90b
Instruction ID: 500fda87d6d1ede7fa4bd5349653642efef0b0659c74f7fd6376db584f205894
Opcode Fuzzy Hash: d962a1264cc89049653c7473b437981101b1f6dbd0bba1b2108e6da7e77bc90b
Instruction Fuzzy Hash: D6C1C070805288AEDB21EBA5C992AEE7B78AF11308F14447EF446371D2DB786F0CC765

Function 004396FA Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 229COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00439719
LoadCursorW.USER32(00000000,00007F02), ref: 00439777
SetCursor.USER32(00000000), ref: 0043977E
_wcscpy.LIBCMT ref: 004397C0

Part of subcall function 004115DC: __EH_prolog3_GS.LIBCMT ref: 004115E3

SetCursor.USER32(00000008,?,?,?,?,?,?,?,?,00000000,00000001), ref: 004399A3

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\session.cpp, xrefs: 0043989F
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 004397AB
Extraction of '%s' failed, xrefs: 00439958
Extracting '%s' to %s, xrefs: 0043989A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Cursor$H_prolog3H_prolog3_Load_wcscpy
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\session.cpp$Extracting '%s' to %s$Extraction of '%s' failed
API String ID: 2478543443-1900645141
Opcode ID: 2a082972f21b6eb175640345b3ed2496b1eea720d2e148de0607cc6b66ccfe63
Instruction ID: b8814948f11d8f6f36852a1868062dfa650382055b4f76687ec282b597843551
Opcode Fuzzy Hash: 2a082972f21b6eb175640345b3ed2496b1eea720d2e148de0607cc6b66ccfe63
Instruction Fuzzy Hash: BE918071800248EBDB14EFA5CD55BEE77B8AF14304F50806EF445A71D1EB789E48CBA9

Function 0042D364 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 194COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042D383

Part of subcall function 004387DA: _memset.LIBCMT ref: 00438806

Part of subcall function 0042A945: __EH_prolog3_catch.LIBCMT ref: 0042A967

Part of subcall function 00439D2C: __EH_prolog3_GS.LIBCMT ref: 00439D33

_memset.LIBCMT ref: 0042D456
_memset.LIBCMT ref: 0042D46B

Part of subcall function 004412A3: lstrcpyW.KERNEL32(?,004BDF40,?), ref: 004412EA
Part of subcall function 004412A3: lstrcpyW.KERNEL32(?,004BDF40), ref: 004412F0
Part of subcall function 004412A3: GetFileVersionInfoSizeW.VERSION(?,?), ref: 004412F7
Part of subcall function 004412A3: _malloc.LIBCMT ref: 00441307
Part of subcall function 004412A3: _memset.LIBCMT ref: 00441313
Part of subcall function 004412A3: GetFileVersionInfoW.VERSION(?,00000000,00000000,?,?,?), ref: 00441323
Part of subcall function 004412A3: _memset.LIBCMT ref: 0044133A
Part of subcall function 004412A3: VerQueryValueW.VERSION(?,004AE53C,?,?,00000000,00000000,?,?,?), ref: 00441355
Part of subcall function 004412A3: wsprintfW.USER32 ref: 0044137F
Part of subcall function 004412A3: _memset.LIBCMT ref: 00441391
Part of subcall function 004412A3: VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,004AE53C,?,?,00000000,00000000,?,?,?), ref: 004413A9

Part of subcall function 00441C01: lstrcpyW.KERNEL32(?,?,?,?), ref: 00441C4B
Part of subcall function 00441C01: lstrcpyW.KERNEL32(?,?,?,?), ref: 00441C52
Part of subcall function 00441C01: _swscanf.LIBCMT ref: 00441C9E
Part of subcall function 00441C01: _swscanf.LIBCMT ref: 00441CB8

Part of subcall function 00442DE8: __EH_prolog3_GS.LIBCMT ref: 00442DF2
Part of subcall function 00442DE8: wsprintfW.USER32 ref: 00442E35
Part of subcall function 00442DE8: wvsprintfW.USER32(?,?,?), ref: 00442E50

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 0042D4C9
Windows Installer 4.5 or newer is required to run this installation but is not present on the machine. Setup will now exit., xrefs: 0042D4E2
Msi.DLL, xrefs: 0042D47B
4.05.0.0, xrefs: 0042D48C
ScriptDriven, xrefs: 0042D3D9
Startup, xrefs: 0042D3EE

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$lstrcpy$FileH_prolog3_InfoQueryValueVersion_swscanfwsprintf$H_prolog3H_prolog3_catchSize_mallocwvsprintf
String ID: 4.05.0.0$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$Msi.DLL$ScriptDriven$Startup$Windows Installer 4.5 or newer is required to run this installation but is not present on the machine. Setup will now exit.
API String ID: 2840455257-941712454
Opcode ID: 1f25c0d81285040c0d906a8d37be4555ee0ccf10334c8f0da5aa2c47bf2a287e
Instruction ID: bb05d2a7a5a979a31399ad10fbf080d89ddbc030bb37b02586ce90868a20a915
Opcode Fuzzy Hash: 1f25c0d81285040c0d906a8d37be4555ee0ccf10334c8f0da5aa2c47bf2a287e
Instruction Fuzzy Hash: AD61AE71A00258ABDB11EBA5CD82BEE77ACAF14308F44016FB505E71D1EB785B08C769

Function 00428751 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 180stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00428773

Part of subcall function 004229A9: __EH_prolog3.LIBCMT ref: 004229B0

Part of subcall function 00427DB2: __EH_prolog3.LIBCMT ref: 00427DB9

lstrcpyW.KERNEL32(?,-00000008,?,0000002C,00000000,?,00000001,0000008C), ref: 004287F7
lstrcatW.KERNEL32(?,langpack20.exe), ref: 0042881A
lstrcpyW.KERNEL32(?,-00000008,?,?,00000000,00000001,00000000,?,00000000,00000001), ref: 00428898
lstrcatW.KERNEL32(?,vjredist20-LP.exe), ref: 004288BB

Strings

vjredist-LP.exe, xrefs: 004288A2
vjredist20-LP.exe, xrefs: 004288B2
langpack20.exe, xrefs: 00428811
langpack.exe, xrefs: 00428801

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$lstrcatlstrcpy
String ID: langpack.exe$langpack20.exe$vjredist-LP.exe$vjredist20-LP.exe
API String ID: 2072409900-1679877701
Opcode ID: dc3067e6584eb98dfc7bfbd8494eea16aa54ed496e17b61b75ad3ba5103d0f4a
Instruction ID: 597b3c754ef39dbd90df4166f3d74f81e6b39c6854507e39e7ec3e913964a3f8
Opcode Fuzzy Hash: dc3067e6584eb98dfc7bfbd8494eea16aa54ed496e17b61b75ad3ba5103d0f4a
Instruction Fuzzy Hash: A561B271A01218EBDB20EFA5DD85BEEB7B8AF55304F90002FF505A7191DB386B48CB59

Function 0045A797 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045A79E
SetLastError.KERNEL32(00002EE6,?,00000000,00000048), ref: 0045A7DE

Part of subcall function 00459786: SetEvent.KERNEL32(?), ref: 00459815

lstrcmpiW.KERNEL32(?,?,?,?,?,00000000,00000048), ref: 0045A865
lstrlenW.KERNEL32(?), ref: 0045A8AD
lstrcpyW.KERNEL32(00000000,?), ref: 0045A8CF
lstrlenW.KERNEL32(?,?,?,?,00000000,00000048), ref: 0045A8D4
lstrcpyW.KERNEL32(00000000,?,?,?,?,00000000,00000048), ref: 0045A8F8
lstrcatW.KERNEL32(00000000,?,?,?,?,00000000,00000048), ref: 0045A905

Strings

GET, xrefs: 0045A91E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: lstrcpylstrlen$ErrorEventH_prolog3Lastlstrcatlstrcmpi
String ID: GET
API String ID: 4259213423-1805413626
Opcode ID: 0f1d59229eabfab3647ee0349c70ed662a6bc0da043095c971797155dd3d3248
Instruction ID: bb7a44ae467052a9bf62357408c0263d829738d5cb0e56b271beb40939e8104d
Opcode Fuzzy Hash: 0f1d59229eabfab3647ee0349c70ed662a6bc0da043095c971797155dd3d3248
Instruction Fuzzy Hash: 7F518031900109EFDF11AFA1CC45EAE7F75FF88305F14412AFD01AA262DB398966DB5A

Function 00443042 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 104processstringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00443064
_memset.LIBCMT ref: 00443078
_memset.LIBCMT ref: 00443086
lstrcpyW.KERNEL32(00000000,?,?,?,?,?,?,00000094), ref: 004430B0
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?), ref: 0044311F
WaitForInputIdle.USER32(?,000003E8), ref: 0044314F

Strings

Attempting to launch (no wait): %s, xrefs: 004430DF
Launch result %d, xrefs: 0044312B
E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\utils.cpp, xrefs: 004430E4

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$CreateH_prolog3IdleInputProcessWaitlstrcpy
String ID: Attempting to launch (no wait): %s$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\utils.cpp$Launch result %d
API String ID: 987716831-2556316994
Opcode ID: a69a4b829d20b48e7d70c28966308579d4c1aae6a47be3dc6cd2d7e549452b6c
Instruction ID: 44762665f77f74d72271f8d5ea0b436cfd6babb3feac40f0cf84bedc6f5f2d38
Opcode Fuzzy Hash: a69a4b829d20b48e7d70c28966308579d4c1aae6a47be3dc6cd2d7e549452b6c
Instruction Fuzzy Hash: B53130B6900248ABDB20DF95DC85EEEB7BCFB45710F00412BE505A7250EB745A48CBA5

Function 00480D32 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 00480D3C
DName::DName.LIBCMT ref: 00480D48

Part of subcall function 0047EC67: DName::doPchar.LIBCMT ref: 0047EC94

DName::DName.LIBCMT ref: 00480D75

Part of subcall function 0047E89B: DNameStatusNode::make.LIBCMT ref: 0047E8C9

UnDecorator::getScopedName.LIBCMT ref: 00480D83
DName::operator+=.LIBCMT ref: 00480D8D
DName::operator+=.LIBCMT ref: 00480D9C
DName::operator+=.LIBCMT ref: 00480DA8
DName::operator+=.LIBCMT ref: 00480DB5

Strings

void, xrefs: 00480D94

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: NameName::operator+=$Name::$Decorator::Decorator::getName::doNode::makePcharScopedScoreStatus
String ID: void
API String ID: 2229739886-3531332078
Opcode ID: e0849df73db0b044de68c5df5478584c8e5bfa4126e11b89a8f7477b38e27895
Instruction ID: 324bc84c17f66e1e22f98b52e2bb58f0591cf77ca5a8032f6f519b76d0940a45
Opcode Fuzzy Hash: e0849df73db0b044de68c5df5478584c8e5bfa4126e11b89a8f7477b38e27895
Instruction Fuzzy Hash: A711C670910108AAC748FBA5C856EED7BA49B44304F00459BA40A972D2CF78AA89C759

Function 00444748 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044474F

Part of subcall function 00408D26: __EH_prolog3.LIBCMT ref: 00408D2D

__CxxThrowException@8.LIBCMT ref: 0044477A

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

__EH_prolog3.LIBCMT ref: 00444787
std::bad_exception::bad_exception.LIBCMT ref: 004447A4
__CxxThrowException@8.LIBCMT ref: 004447B2

Part of subcall function 00409D66: __EH_prolog3.LIBCMT ref: 00409D6D
Part of subcall function 00409D66: std::exception::exception.LIBCMT ref: 00409D7B

Strings

DD@, xrefs: 004447BA
invalid string position, xrefs: 00444754
invalid string argument, xrefs: 0044478C
)GD, xrefs: 00444759, 00444765, 00444791, 0044479D, 00444768, 004447A0

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw$ExceptionRaisestd::bad_exception::bad_exceptionstd::exception::exception
String ID: )GD$DD@$invalid string argument$invalid string position
API String ID: 1471069988-933222057
Opcode ID: d366f5ac89ca0c70deec8040acadc2b0630193d499f9e647886bd33968055b7b
Instruction ID: 2de295a128252be52c5e8bad4a9785a17574dc2ec88d3f6a9a8bf0105c647408
Opcode Fuzzy Hash: d366f5ac89ca0c70deec8040acadc2b0630193d499f9e647886bd33968055b7b
Instruction Fuzzy Hash: 9B01407590021867CB10EED2DC02FDDB7789F25756F10402BB200A6081EFBC9A04866C

Function 0043269F Relevance: 15.3, APIs: 10, Instructions: 263windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004326A6
GetDlgItem.USER32(?,00000000), ref: 00432711
SendMessageW.USER32(00000000), ref: 0043271A
GetDlgItem.USER32(?,00000000), ref: 0043273E
SendMessageW.USER32(00000000), ref: 00432741
GetDlgItem.USER32(?,00000000), ref: 004327CF
SendMessageW.USER32(00000000), ref: 004327D6
EndDialog.USER32(?,00000002), ref: 004327EE
SetWindowTextW.USER32(?,-00000008), ref: 00432847
DeleteObject.GDI32(00000034), ref: 004329D5

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ItemMessageSend$DeleteDialogH_prolog3ObjectTextWindow
String ID:
API String ID: 3586765192-0
Opcode ID: 850e929d40a8421def0dd71ba59c85a06a3c9497b1fd2034125ec3e3dd49142e
Instruction ID: a6b1dcdc494631c1b5a9e5a06ae6f34e562efba303018625ec05ad8685aa4990
Opcode Fuzzy Hash: 850e929d40a8421def0dd71ba59c85a06a3c9497b1fd2034125ec3e3dd49142e
Instruction Fuzzy Hash: 2BA15671641501AFC704AF65ED88DAA3BA9FF4D310B02406BF916CB271CB36ED81DB69

Function 0043B0A5 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 441COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0043B0C4

Part of subcall function 0043791D: __EH_prolog3_GS.LIBCMT ref: 00437924

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\session.cpp, xrefs: 0043B10D, 0043B124, 0043B229, 0043B241, 0043B385
InstalledProductName, xrefs: 0043B44D
PackageCode, xrefs: 0043B1A5
Upgrade check: obtained package code %s from machine, current package code is %s, xrefs: 0043B239
Upgrade check: checking product code %s, xrefs: 0043B11C
VersionString, xrefs: 0043B2F2
Upgrade check: later product version already installed, xrefs: 0043B39C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_H_prolog3_catch
String ID: E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\session.cpp$InstalledProductName$PackageCode$Upgrade check: checking product code %s$Upgrade check: later product version already installed$Upgrade check: obtained package code %s from machine, current package code is %s$VersionString
API String ID: 3862090230-2870485337
Opcode ID: e780c583c50bddea81da7d694038352e7f552ae93aa08ba2778b69b76723f1f6
Instruction ID: 335d6801b77f914ccf9a605dea3258d01c938d64c8d14b3bf0e5d5d42bf4a621
Opcode Fuzzy Hash: e780c583c50bddea81da7d694038352e7f552ae93aa08ba2778b69b76723f1f6
Instruction Fuzzy Hash: DB02F370804248EFDB04DFA5CD55BEE7BB4EF15308F14406EE505AB192DB78AB09CBA9

Function 0044F701 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 267COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044F70B
GetErrorInfo.OLEAUT32(00000000,?,00000294), ref: 0044F740
CreateErrorInfo.OLEAUT32(?), ref: 0044F79C
ProgIDFromCLSID.OLE32(?,?), ref: 0044F7CE
CoTaskMemFree.OLE32(?), ref: 0044F7F4

Part of subcall function 0040F6C8: __EH_prolog3.LIBCMT ref: 0040F6CF

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

SetErrorInfo.OLEAUT32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0044FA38
SetErrorInfo.OLEAUT32(00000000,?), ref: 0044FA76

Strings

), xrefs: 0044F8D2

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorInfo$String$AllocCreateFreeFromH_prolog3H_prolog3_ProgTask
String ID: )
API String ID: 3187288648-2644914990
Opcode ID: f0e16a718f11fdf470a8bc24af3c4121922c3e541a8574826e7c7fc7447c8284
Instruction ID: eec3d79ca9bc6f49b170e56e7832739d4014fbf75241926e48dc76769d1b44d7
Opcode Fuzzy Hash: f0e16a718f11fdf470a8bc24af3c4121922c3e541a8574826e7c7fc7447c8284
Instruction Fuzzy Hash: 19B13A71900258EFDB11EBA0CC85BDEB7B9AF15304F1440EEB509A3192DB395F89CB66

Function 0041AD76 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 215libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041AD8F
GetProcAddress.KERNEL32(?,RunISMSISetup), ref: 0041ADE8
GetModuleFileNameW.KERNEL32(?,00000400,00000000,00000400), ref: 0041AEC4

Part of subcall function 0043791D: __EH_prolog3_GS.LIBCMT ref: 00437924

Strings

Could not find entry point in ISSetup.dll, xrefs: 0041AE23
E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\IsMsiHelper.cpp, xrefs: 0041AE0E, 0041AF1E, 0041AF2F
setup.exe, xrefs: 0041AF67
Launching InstallScript engine: %s, %s, %d, xrefs: 0041AF2A
RunISMSISetup, xrefs: 0041ADE2

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressFileH_prolog3H_prolog3_ModuleNameProc
String ID: Could not find entry point in ISSetup.dll$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\IsMsiHelper.cpp$Launching InstallScript engine: %s, %s, %d$RunISMSISetup$setup.exe
API String ID: 622830108-3890618035
Opcode ID: 69bc2a0aa165eb72b384f5decf7fc154e69e8fe00ac9bbe89d22914b4a1dca84
Instruction ID: 4cc7ff86eb0f47e9b0a0cf0d547e1ee939df6a7f3a5bc12b089eccb9bcb5e054
Opcode Fuzzy Hash: 69bc2a0aa165eb72b384f5decf7fc154e69e8fe00ac9bbe89d22914b4a1dca84
Instruction Fuzzy Hash: 3791F4B1801248DFCB04DF65C949BDE7BB8BF15308F14422FF446A7291DB38AA59CB5A

Function 00422343 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 181COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00422351

Part of subcall function 00439D2C: __EH_prolog3_GS.LIBCMT ref: 00439D33

Strings

Install is script driven (ISMSI), xrefs: 004224EF
E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 004223F3, 00422462, 004224D6, 0042254E
Install does not use script, xrefs: 0042256A
Install is script driven MSI 4.5 style embedded UI (ISMSI), xrefs: 0042240C
Install is basic with InstallScript custom actions, xrefs: 0042247E
ScriptDriven, xrefs: 00422368
Startup, xrefs: 0042237E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID: E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$Install does not use script$Install is basic with InstallScript custom actions$Install is script driven (ISMSI)$Install is script driven MSI 4.5 style embedded UI (ISMSI)$ScriptDriven$Startup
API String ID: 3355343447-1468726305
Opcode ID: bd5ababb2ec25e5b1a0b454951d33d3be1a078c688175c2328240eb5973c2aad
Instruction ID: 440ce8b6252fa542541aa911a7053a9b6a158493908ef890d6d0a9777db320bf
Opcode Fuzzy Hash: bd5ababb2ec25e5b1a0b454951d33d3be1a078c688175c2328240eb5973c2aad
Instruction Fuzzy Hash: 6C71A071901248BEEB11EFA0DD81FDE7B78AB11304F5045ABB505A31E1EBB85B48CB68

Function 00421259 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 164stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004212D6

Part of subcall function 0043777C: __EH_prolog3.LIBCMT ref: 00437783

lstrcpyW.KERNEL32(?,-00000008,?,00000001,?,00000001), ref: 00421309
_memset.LIBCMT ref: 0042132D
wsprintfW.USER32 ref: 00421379
_memset.LIBCMT ref: 004213EE
_memset.LIBCMT ref: 00421405

Strings

%s /g %s /g %s, xrefs: 0042136D
%s /g %s /g %s /s, xrefs: 00421359

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$H_prolog3lstrcpywsprintf
String ID: %s /g %s /g %s$%s /g %s /g %s /s
API String ID: 103519269-3131057161
Opcode ID: 0622a804dd64e6cbf076ab28ea45667b304cd25ddee498b4e55b266405f69883
Instruction ID: 9892113911d1253f3d3d3d3b7ef62566ec30c05dd8c26bd2938672311a98154c
Opcode Fuzzy Hash: 0622a804dd64e6cbf076ab28ea45667b304cd25ddee498b4e55b266405f69883
Instruction Fuzzy Hash: EB51B1B5A00188AFDB21EFA4DC45EEE77F9FF18304F44412BE809D7261E7389A148B59

Function 0043D0A1 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 120stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043D0C0
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,004B241C,?,00000000,00000000,?,00000038), ref: 0043D150
lstrcpyW.KERNEL32(C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI,?,?,004B241C,?,00000000,00000000,?,00000038), ref: 0043D18D
_memset.LIBCMT ref: 0043D1B6
lstrcmpiW.KERNEL32(?,004B1470,?,004B241C,?,00000000,00000000,?,00000038), ref: 0043D1E1

Strings

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI, xrefs: 0043D177, 0043D187, 0043D18C, 0043D199, 0043D19A
CloneSetupExe, xrefs: 0043D1C3
Startup, xrefs: 0043D1C8

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: FileH_prolog3ModuleName_memsetlstrcmpilstrcpy
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI$CloneSetupExe$Startup
API String ID: 2455001894-4005424923
Opcode ID: 224fffb58eb4da360a410cf5396aa4157e8ddd8f1c2287faec1a0e97633561c2
Instruction ID: 955c0ddd2f269a47689a2622bd46f681bb6ed88499f0791b45732010767f882f
Opcode Fuzzy Hash: 224fffb58eb4da360a410cf5396aa4157e8ddd8f1c2287faec1a0e97633561c2
Instruction Fuzzy Hash: FF41D47290010CABDB24EFA1DC95EEF77B8EF09304F54402BF505A7191EB785A45CBA9

Function 0044E2F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044E2F7
GetModuleHandleW.KERNEL32(shell32.dll,SHFileOperationW,00000060), ref: 0044E313
GetProcAddress.KERNEL32(00000000), ref: 0044E31C
GetModuleHandleW.KERNEL32(shell32.dll,SHFileOperationA), ref: 0044E3C5
GetProcAddress.KERNEL32(00000000), ref: 0044E3C8

Part of subcall function 0040B2F1: __EH_prolog3.LIBCMT ref: 0040B2F8

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

Part of subcall function 004455D7: _memset.LIBCMT ref: 004455E5

Part of subcall function 0040B14B: __EH_prolog3.LIBCMT ref: 0040B152
Part of subcall function 0040B14B: GetLastError.KERNEL32(00000038,0040C732), ref: 0040B159
Part of subcall function 0040B14B: SetLastError.KERNEL32(00000000), ref: 0040B1A3

Strings

shell32.dll, xrefs: 0044E307, 0044E3C0
SHFileOperationA, xrefs: 0044E3BB
SHFileOperationW, xrefs: 0044E302

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$AddressErrorHandleLastModuleProcString$Alloc_memset
String ID: SHFileOperationA$SHFileOperationW$shell32.dll
API String ID: 4171465910-1880307489
Opcode ID: 38970ccfa9eefd147c1af46ee3a9a04b22e5695620f5c55d76cb22e1dc3a6d6d
Instruction ID: a58631d0837736559cb1ee18dde76c3da8a46278f81a9fc0c55579ea2a8b9cf6
Opcode Fuzzy Hash: 38970ccfa9eefd147c1af46ee3a9a04b22e5695620f5c55d76cb22e1dc3a6d6d
Instruction Fuzzy Hash: F3417171C00148AFDB01EFE5C855ADEBBB8EF18304F14846EF515B3292DB789A04CBA5

Function 00416BBB Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416BC2
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 00416BE2
_memset.LIBCMT ref: 00416BF5
_memset.LIBCMT ref: 00416C01
_wcslen.LIBCMT ref: 00416C09
_wcscpy.LIBCMT ref: 00416C2A

Strings

XSM, xrefs: 00416C38
WinVerifyTrust, xrefs: 00416BDC

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$AddressH_prolog3_catchProc_wcscpy_wcslen
String ID: WinVerifyTrust$XSM
API String ID: 1600741561-1250150901
Opcode ID: b3270aaae9337fd868a268308a5365f1cc9d470b5464e6cde2f2d1790e9a5f02
Instruction ID: 0a568ac1d70125b92152f9c45d64798a3f332b77639d91e36a277a5b6a3b7abd
Opcode Fuzzy Hash: b3270aaae9337fd868a268308a5365f1cc9d470b5464e6cde2f2d1790e9a5f02
Instruction Fuzzy Hash: 1E11B971940218ABDF10EFB4CC469EE76B9EB44710F21412BF501E7290EB799E414B99

Function 0044C7AD Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044C7B7
GetModuleHandleW.KERNEL32(kernel32.dll,FindFirstFileW,00000398,0044CFE6,?,00000001), ref: 0044C7DA
GetProcAddress.KERNEL32(00000000), ref: 0044C7E3
GetModuleHandleW.KERNEL32(kernel32.dll,FindFirstFileA), ref: 0044C82E
GetProcAddress.KERNEL32(00000000), ref: 0044C831

Strings

FindFirstFileA, xrefs: 0044C828
kernel32.dll, xrefs: 0044C7D4, 0044C7D9, 0044C82D
FindFirstFileW, xrefs: 0044C7CF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc$H_prolog3_
String ID: FindFirstFileA$FindFirstFileW$kernel32.dll
API String ID: 762132516-163559883
Opcode ID: 19663ac2719b171c8499b2a06ebd5f1e6f4b55d0dc824f5258952b8e98fac334
Instruction ID: 31ad9d2bc17268c6f8f1185e622fedb9d29bf918d3238920a948132192ca2a34
Opcode Fuzzy Hash: 19663ac2719b171c8499b2a06ebd5f1e6f4b55d0dc824f5258952b8e98fac334
Instruction Fuzzy Hash: D1113671E012299FDF50EF75CC809AE73B8AF45316F09469BB814672C1DB389E018F98

Function 0045EA19 Relevance: 13.8, APIs: 9, Instructions: 302COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 0045EA67
char_traits.LIBCPMT ref: 0045EAC7
char_traits.LIBCPMT ref: 0045EAFF
char_traits.LIBCPMT ref: 0045EB43
char_traits.LIBCPMT ref: 0045EBB1
char_traits.LIBCPMT ref: 0045EC1B
char_traits.LIBCPMT ref: 0045EC6F
char_traits.LIBCPMT ref: 0045ECAC
char_traits.LIBCPMT ref: 0045ECE5

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: char_traits$String_base::_Xlenstd::_
String ID:
API String ID: 1810552321-0
Opcode ID: 9080ace89d0140f5e429d88e2d7af9182a591860666894d679b36fe894cef14a
Instruction ID: e639d7604c381120734135386725b8b40ad2f6f83da707e8efc2321c57763c5c
Opcode Fuzzy Hash: 9080ace89d0140f5e429d88e2d7af9182a591860666894d679b36fe894cef14a
Instruction Fuzzy Hash: 0FB15C7020011A9FDF0CCF2AC9D59AE3B62FF45305754891AF9168B386C734EAA5CBD9

Function 0045A5AC Relevance: 13.7, APIs: 9, Instructions: 188stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0044CF36,?,00000000,?,00000001,00000001,?,004384ED,?,00000000,80400100,?,00000034,0044B6C3,?,80000000), ref: 0045A625
lstrcpyW.KERNEL32(00000000,0044CF36,?,00000001,00000001,?,004384ED,?,00000000,80400100,?,00000034,0044B6C3,?,80000000,00000001), ref: 0045A642
lstrlenW.KERNEL32(0044CF36,?,00000000,?,00000001,00000001,?,004384ED,?,00000000,80400100,?,00000034,0044B6C3,?,80000000), ref: 0045A649
lstrlenW.KERNEL32(?,?,00000001,00000001,?,004384ED,?,00000000,80400100,?,00000034,0044B6C3,?,80000000,00000001,00000080), ref: 0045A66A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: lstrlen$lstrcpy
String ID:
API String ID: 805584807-0
Opcode ID: ea65c59f9ee0c1986cbb8abce9f1d1aa2c3e5adba0ae9aedbb9f6ee2297b1d94
Instruction ID: a4fb5e496a51a40d709fd03fae35dc070d26f10453852a238ac7a1e7f6c90b9c
Opcode Fuzzy Hash: ea65c59f9ee0c1986cbb8abce9f1d1aa2c3e5adba0ae9aedbb9f6ee2297b1d94
Instruction Fuzzy Hash: 4551B371510304AFDB249F29CC86A6BB7F8FF84311F14462FF946862A2EB79D851CB19

Function 00432EF9 Relevance: 13.6, APIs: 9, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00432F03
GetDlgItemTextW.USER32(?,000003E8,?,00000064), ref: 00432F53
GetDlgItem.USER32(?,00000001), ref: 00432F60

Part of subcall function 00432E98: wsprintfW.USER32 ref: 00432EC7
Part of subcall function 00432E98: lstrcmpW.KERNEL32(?), ref: 00432EDB

EnableWindow.USER32(00000000,?), ref: 00432F83
EndDialog.USER32(?,00000002), ref: 00432F8E
EndDialog.USER32(?,00000002), ref: 00432FA2
GetDlgItem.USER32(?,00000001), ref: 00432FB7
SetWindowTextW.USER32(?,-00000008), ref: 00433036
EnableWindow.USER32(00000000,00000000), ref: 00433052

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ItemWindow$DialogEnableText$H_prolog3_lstrcmpwsprintf
String ID:
API String ID: 2161687695-0
Opcode ID: e70452df4b10d4932d15956233e4ac79104ed717233691d232a69f0771773654
Instruction ID: 86e0bab14626b3e99bcec0ffa4a3e34b959bca3bed39e2dfe65e6cc910dbf41c
Opcode Fuzzy Hash: e70452df4b10d4932d15956233e4ac79104ed717233691d232a69f0771773654
Instruction Fuzzy Hash: C931B731551214ABDB109B20DD8AFAA37B8AB1EB12F404017F501E72E1DBFC8E40DB6D

Function 00415268 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 286COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415310
wsprintfW.USER32 ref: 0041533D
GetLastError.KERNEL32(?,00000000,80400100), ref: 004153D1

Strings

dwplayer, xrefs: 00415375, 004153A2
Referer: %s, xrefs: 00415337

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorLast_memsetwsprintf
String ID: Referer: %s$dwplayer
API String ID: 1359275013-1303060843
Opcode ID: 24891f63ef7b0f7bb39673d2f45ef700578afdba85aafb49e1109f7f45501830
Instruction ID: 45e2769665db56ea6530e6e4f9b005508bbd4e120471d6d70edd15ee8bfe7e65
Opcode Fuzzy Hash: 24891f63ef7b0f7bb39673d2f45ef700578afdba85aafb49e1109f7f45501830
Instruction Fuzzy Hash: 2AB1D270D00689EFCF10DFE4C981AEEBBB5AF85304F24816EE445A7291D7385E88CB59

Function 00435858 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 153stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00435877

Part of subcall function 00435441: __EH_prolog3.LIBCMT ref: 00435448

Part of subcall function 00433742: InitializeCriticalSection.KERNEL32(?,004CA220,0000000C), ref: 00433753

GetModuleFileNameW.KERNEL32(00400000,?,00000104), ref: 00435929
GetModuleHandleW.KERNEL32(00000000), ref: 00435980

Part of subcall function 00433A1E: lstrlenW.KERNEL32(?), ref: 00433A22
Part of subcall function 00433A1E: _memcpy_s.LIBCMT ref: 00433A3C

lstrlenW.KERNEL32(?), ref: 004359D1

Strings

REGISTRY, xrefs: 00435A29
Module, xrefs: 004359F5
Module_Raw, xrefs: 00435A11

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3Modulelstrlen$CriticalFileHandleInitializeNameSection_memcpy_s
String ID: Module$Module_Raw$REGISTRY
API String ID: 2716299866-549000027
Opcode ID: dc87610dacc7bf357034bfc54c8afda9e37e20773505b53b504b87fe1b4dbc59
Instruction ID: da19b3c9291342c6cb29b9a3d9a8b73588240f942f83819dfd307280b2c0b875
Opcode Fuzzy Hash: dc87610dacc7bf357034bfc54c8afda9e37e20773505b53b504b87fe1b4dbc59
Instruction Fuzzy Hash: C6519572900248DBDF24EFA5CC85AED73B8BF48314F14542FE905E7241D778AA448B5A

Function 00416F35 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122libraryfileloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00416F3C
LoadLibraryW.KERNEL32(crypt32.dll,00000058), ref: 00416F54
GetProcAddress.KERNEL32(00000000,CertSerializeCertificateStoreElement), ref: 00416F80
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00417022
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0041704B

Strings

crypt32.dll, xrefs: 00416F4F
CertSerializeCertificateStoreElement, xrefs: 00416F7A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$AddressCreateH_prolog3_catch_LibraryLoadProcWrite
String ID: CertSerializeCertificateStoreElement$crypt32.dll
API String ID: 171865248-96554558
Opcode ID: df166c11b4a91df068456f571d44e579ec1b6e58496f3a329dbb86224ebd9f00
Instruction ID: 802b6ab37bf1e70015525b57395ca76203646d4abd8fff4a0ae970e5ad8581ca
Opcode Fuzzy Hash: df166c11b4a91df068456f571d44e579ec1b6e58496f3a329dbb86224ebd9f00
Instruction Fuzzy Hash: 3C415271D05248AEDF01DBE4CD45ADEBF78AF15344F14446AE001BB181E7788E45CB69

Function 0043AB30 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043AB49

Part of subcall function 0040F5AC: __EH_prolog3.LIBCMT ref: 0040F5B3

Part of subcall function 00421D14: __EH_prolog3.LIBCMT ref: 00421D1B

Part of subcall function 004208A5: _wcslen.LIBCMT ref: 004208AC

Part of subcall function 00415B3A: _wcslen.LIBCMT ref: 00415B41

Strings

REINSTALL=ALL, xrefs: 0043AB9E
REINSTALLMODE=vomus, xrefs: 0043ABBE
REINSTALLMODE, xrefs: 0043ABAC
IS_MINOR_UPGRADE, xrefs: 0043ABCC
REINSTALL, xrefs: 0043AB8C
IS_MINOR_UPGRADE=1, xrefs: 0043ABDE

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$_wcslen
String ID: IS_MINOR_UPGRADE=1$ REINSTALL=ALL$ REINSTALLMODE=vomus$IS_MINOR_UPGRADE$REINSTALL$REINSTALLMODE
API String ID: 821321042-3166201577
Opcode ID: 112cd9b6a0c12171e4a8078000743b539161ba43a198a0b6a6bb14ea3a93665b
Instruction ID: 3de91bcd3f079dcccb25f17e65714324483a9aec9cfe03c99524dc5cdc047323
Opcode Fuzzy Hash: 112cd9b6a0c12171e4a8078000743b539161ba43a198a0b6a6bb14ea3a93665b
Instruction Fuzzy Hash: C3319F30A40108EFDB04EF65C9A2AED77A8AF14318FA0052FF512A71D1DBB86E49C759

Function 004526A2 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 94registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004526C1
_memset.LIBCMT ref: 004526DE
RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,?), ref: 004526FA
RegQueryValueExW.ADVAPI32(?,CommonFilesDir,00000000,00000000,?,00000104), ref: 0045272C

Strings

CommonFilesDir, xrefs: 00452712, 00452728
ProgramFilesDir, xrefs: 00452719
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 004526ED

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3OpenQueryValue_memset
String ID: CommonFilesDir$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 2705696002-3256072622
Opcode ID: 35d20d1e2c9aa7d7ca5909c77e856f5df8dfd7dc838e3bd9fbc9ec56d029f0dd
Instruction ID: 0520d459b99ffb51bbb2d481d9dae42d3d6ac9ff6cf427facbe2dd9cc5dffb6b
Opcode Fuzzy Hash: 35d20d1e2c9aa7d7ca5909c77e856f5df8dfd7dc838e3bd9fbc9ec56d029f0dd
Instruction Fuzzy Hash: 9831747150024CBFDB14EF94DD91AEE77A8EF19304F50812FF905A6181EBB85B48CB69

Function 004488C4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004488E3
GetModuleHandleW.KERNEL32(KERNEL32.DLL,00000070), ref: 00448902
GetProcAddress.KERNEL32(00000000,GetSystemWindowsDirectoryW), ref: 00448912

Part of subcall function 00409238: __EH_prolog3.LIBCMT ref: 0040923F
Part of subcall function 00409238: SetLastError.KERNEL32(?,00000001,?,00000004,004096F5,00000001,?,00000000,00000004,0040A854,-00000008,?,00000001,?,00000000), ref: 0040929B

Part of subcall function 00437208: __EH_prolog3.LIBCMT ref: 0043720F

GetWindowsDirectoryW.KERNEL32(00000000,00000104,00000070), ref: 00448978
__CxxThrowException@8.LIBCMT ref: 00448993

Strings

KERNEL32.DLL, xrefs: 004488FD
GetSystemWindowsDirectoryW, xrefs: 0044890C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$AddressDirectoryErrorException@8HandleLastModuleProcThrowWindows
String ID: GetSystemWindowsDirectoryW$KERNEL32.DLL
API String ID: 2871909246-1259663462
Opcode ID: 6cbaf583a3f732a5eabb051ae517e4d3dfea4bab804a56a8cf953d31486e88b0
Instruction ID: 099c0f68c9e9e3f6484c584732b539fa5c5c8c0d8765214117de1da8a608e86b
Opcode Fuzzy Hash: 6cbaf583a3f732a5eabb051ae517e4d3dfea4bab804a56a8cf953d31486e88b0
Instruction Fuzzy Hash: 8131C4B1A00208ABEB20EFA1DC55BEE77B8AF18304F50412FF511F6191EF789605CB69

Function 0042111D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00421127
_memset.LIBCMT ref: 0042114A

Part of subcall function 004015B0: RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 004015EC

Part of subcall function 0043777C: __EH_prolog3.LIBCMT ref: 00437783

lstrcpyW.KERNEL32(?,-00000008,?,004216AB,00000000,00000000,?,?,00000020), ref: 004211B3
lstrcatW.KERNEL32(?," /%,?,?,00000020), ref: 004211DA
_wcschr.LIBCMT ref: 004211E5
lstrcatW.KERNEL32(?,00000000,?,?,00000020), ref: 004211F8

Strings

" /%, xrefs: 004211CE

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: lstrcat$H_prolog3H_prolog3_QueryValue_memset_wcschrlstrcpy
String ID: " /%
API String ID: 2854241388-1244271203
Opcode ID: 9d867d54db14d288cca03f9af6ff0bcc2810e3220eaeb212bf65788714ca1031
Instruction ID: b564a5714b05312da5853c13bf82e40db881a4dd879372d1c4a664420f531ac1
Opcode Fuzzy Hash: 9d867d54db14d288cca03f9af6ff0bcc2810e3220eaeb212bf65788714ca1031
Instruction Fuzzy Hash: AC21B7B1A00218AADB10E7A5CC45FEA73FCBF58314F4041ABB509E7191EB389A44CF98

Function 0044C86B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,FindNextFileW), ref: 0044C8AC
GetProcAddress.KERNEL32(00000000), ref: 0044C8B5
GetModuleHandleW.KERNEL32(kernel32.dll,FindNextFileA), ref: 0044C8E0
GetProcAddress.KERNEL32(00000000), ref: 0044C8E3

Strings

FindNextFileA, xrefs: 0044C8DA
FindNextFileW, xrefs: 0044C89E
kernel32.dll, xrefs: 0044C8A3, 0044C8A8, 0044C8DF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: FindNextFileA$FindNextFileW$kernel32.dll
API String ID: 1646373207-719559652
Opcode ID: 18a688fce695e74e2f3b74c8582011a288a959cca860c3badc7bc2c6dd79010e
Instruction ID: 8177981628aaddd1a140d6aebafc79da4d9e19634cfbc6745a3554e0797e98f7
Opcode Fuzzy Hash: 18a688fce695e74e2f3b74c8582011a288a959cca860c3badc7bc2c6dd79010e
Instruction Fuzzy Hash: 41118472E4111D9BEB70EFB9DC80ADE77A8AF48304F14042BE819E7241EE7899048F54

Function 00444DA1 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51libraryloadertimeCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetProcessId), ref: 00444DC0
GetProcAddress.KERNEL32(00000000), ref: 00444DC7
OpenProcess.KERNEL32(001FFFFF,00000001,00000000), ref: 00444DEA
GetProcessTimes.KERNEL32(?,?,?,?,?), ref: 00444E04
CloseHandle.KERNEL32(?), ref: 00444E11

Strings

kernel32.dll, xrefs: 00444DBB
GetProcessId, xrefs: 00444DB6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: HandleProcess$AddressCloseModuleOpenProcTimes
String ID: GetProcessId$kernel32.dll
API String ID: 4254294609-399901964
Opcode ID: 79c7035dcaf21e4c4ac9cfafddd4e4276b194293a0ca7834e518bd9b0e667bbb
Instruction ID: 49d74620964204369317ed0a66ea62580606273cf6d5030aa1f632ed10445fe7
Opcode Fuzzy Hash: 79c7035dcaf21e4c4ac9cfafddd4e4276b194293a0ca7834e518bd9b0e667bbb
Instruction Fuzzy Hash: E60188B2A81515BBDB224F649C44BAB3B58EF8A752B154026FD0096250CB38CD119BE8

Function 004414DE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(COMCTL32), ref: 004414E9
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004414FB
#17.COMCTL32 ref: 0044151B
FreeLibrary.KERNEL32(00000000), ref: 00441522

Strings

, xrefs: 00441510
InitCommonControlsEx, xrefs: 004414F5
COMCTL32, xrefs: 004414E4

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: $COMCTL32$InitCommonControlsEx
API String ID: 145871493-1772614818
Opcode ID: a6c74de01bfb8196ce41abb21694f4d5ca86af6baba07081d23c027349f492cc
Instruction ID: 83d739135f71cca06b937b6301bdd3cbb4c09241d946159eba56854045dad2ba
Opcode Fuzzy Hash: a6c74de01bfb8196ce41abb21694f4d5ca86af6baba07081d23c027349f492cc
Instruction Fuzzy Hash: AEE09B71941211BBD7406BD4DC4DADF7EB8DF45781F040219F402A1152DBB886408FBD

Function 004598E0 Relevance: 12.2, APIs: 8, Instructions: 170COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,000F4240,00000000,?,?,000003E8,00000000), ref: 00459946
GetTickCount.KERNEL32 ref: 0045994E
ResetEvent.KERNEL32(0000000D,?,00000000,?,00437E04), ref: 0045995F
QueryPerformanceCounter.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,?,00437E04), ref: 004599B9
GetTickCount.KERNEL32 ref: 004599C7
__alldvrm.LIBCMT ref: 00459A34
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00459A47
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00459A6F

Part of subcall function 00459033: GetTickCount.KERNEL32 ref: 0045903D
Part of subcall function 00459033: GetTickCount.KERNEL32 ref: 00459066

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CountTick$CounterPerformanceQueryUnothrow_t@std@@@__ehfuncinfo$??2@$EventReset__alldvrm
String ID:
API String ID: 3317835756-0
Opcode ID: ad41cb9d7f313c64ed5e8a75e738b420250061cac3dd6620d8a00d4dd1c20b05
Instruction ID: d8109a09d202199bbc66e980a0f70e205f0fd77b442751ed2538c295f80e57bd
Opcode Fuzzy Hash: ad41cb9d7f313c64ed5e8a75e738b420250061cac3dd6620d8a00d4dd1c20b05
Instruction Fuzzy Hash: 35616F70A00708DFDB14CFA5C884AAEB7F5FF48315F14842EE95696351E738AD45CB28

Function 004169F3 Relevance: 12.1, APIs: 8, Instructions: 109COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004169FA
EndDialog.USER32(?,00000001), ref: 00416A40
SetWindowTextW.USER32(?,-00000008), ref: 00416A9C
GetDlgItem.USER32(?,00000001), ref: 00416ADB
GetDlgItem.USER32(?,00000066), ref: 00416AE3
ShowWindow.USER32(?,00000000), ref: 00416AF7
ShowWindow.USER32(00000000,00000000), ref: 00416B0D
DeleteObject.GDI32(00000074), ref: 00416B43

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Window$ItemShow$DeleteDialogH_prolog3_ObjectText
String ID:
API String ID: 1206914079-0
Opcode ID: bf8af5b3b1e582e784cd2fed12fe245073c013d1687a4fc67d6b500ef05f8aff
Instruction ID: 50a7799845d9936220bdf4de927f0f08f0a1e7b482d2f51d7b5f34209ef9368a
Opcode Fuzzy Hash: bf8af5b3b1e582e784cd2fed12fe245073c013d1687a4fc67d6b500ef05f8aff
Instruction Fuzzy Hash: DB31C031944204EBCB00EFA5CC89AEE3FB4EF16355F14402BF101A72A1EB79A985DB1D

Function 00462370 Relevance: 12.1, APIs: 8, Instructions: 97fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 004623B8
CreateFileMappingW.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 004623D8
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 004623F1
GetFileSize.KERNEL32(00000000,00000000,?), ref: 00462409
CloseHandle.KERNEL32(00000000,00000000,00000000), ref: 0046242F
CloseHandle.KERNEL32(00000000), ref: 00462432
CloseHandle.KERNEL32(00000000), ref: 00462467
CloseHandle.KERNEL32(00000000), ref: 0046246A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CloseFileHandle$Create$MappingSizeView
String ID:
API String ID: 2603261034-0
Opcode ID: 59a75b032a93507f2c379f9c838d3e32afab8d55f9393e2e92a891bc256454b4
Instruction ID: 68138258e3afa3438d319e72719679dc5a5a17c87cc404761aeb390ac7c05051
Opcode Fuzzy Hash: 59a75b032a93507f2c379f9c838d3e32afab8d55f9393e2e92a891bc256454b4
Instruction Fuzzy Hash: 5521D8713447007BD620AF198D85F2B77DCEB86B10F14412EFA15A72C0DFB9A805876E

Function 0041F0F8 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 262COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041F11A

Part of subcall function 00415E5D: __EH_prolog3.LIBCMT ref: 00415E64

Part of subcall function 00415D7E: __EH_prolog3.LIBCMT ref: 00415D85

Part of subcall function 0040A7C0: __EH_prolog3.LIBCMT ref: 0040A7D9

Part of subcall function 00415EC8: __EH_prolog3_GS.LIBCMT ref: 00415ECF

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0044911E: __EH_prolog3.LIBCMT ref: 0044913D

Part of subcall function 0040B2F1: __EH_prolog3.LIBCMT ref: 0040B2F8

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

VerLanguageNameW.KERNEL32(?,?,00000104,?,00000104,00000000), ref: 0041F3D4

Part of subcall function 0040B14B: __EH_prolog3.LIBCMT ref: 0040B152
Part of subcall function 0040B14B: GetLastError.KERNEL32(00000038,0040C732), ref: 0040B159
Part of subcall function 0040B14B: SetLastError.KERNEL32(00000000), ref: 0040B1A3

Strings

.ini, xrefs: 0041F17B
Languages, xrefs: 0041F233
0x%04x, xrefs: 0041F146, 0041F14E, 0041F174
0x0409, xrefs: 0041F34B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ErrorLastString$AllocH_prolog3_LanguageName
String ID: .ini$0x%04x$0x0409$Languages
API String ID: 2824296297-1197885428
Opcode ID: 4185394e7fc07591c64cc12c9345b503230a1577ea526653d81ad67f19f09569
Instruction ID: d86314fbb0d291125d4427948e22db6777431a1b3655005ad5ddf27c0c956667
Opcode Fuzzy Hash: 4185394e7fc07591c64cc12c9345b503230a1577ea526653d81ad67f19f09569
Instruction Fuzzy Hash: CBA17271D0528CEBDB11EBE9C946BDE7BB89F15304F0444AEF40567282EB785B08C7A6

Function 00434BD3 Relevance: 10.8, APIs: 7, Instructions: 252stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00433DA3: __EH_prolog3.LIBCMT ref: 00433DAA
Part of subcall function 00433DA3: lstrcmpiW.KERNEL32(?,00000000), ref: 00433E20

lstrlenW.KERNEL32(?,80C21959), ref: 00434CB9
CharNextW.USER32(?), ref: 00434D03
CharNextW.USER32(00000000), ref: 00434D1C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CharNext$H_prolog3lstrcmpilstrlen
String ID:
API String ID: 1371170689-0
Opcode ID: 1f66796b01ecec76355d5d8dfe448a32de1f1e90e19a80b9bafa5827c957a06f
Instruction ID: 8679bf5118b0a017f165653793a2058352d7fd5a22d81c235e6617b491009214
Opcode Fuzzy Hash: 1f66796b01ecec76355d5d8dfe448a32de1f1e90e19a80b9bafa5827c957a06f
Instruction Fuzzy Hash: B191C471900149DBCF20DFA9CC85AEEB7B9FF98310F10512BE955E7290E778AA41CB58

Function 004427AF Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 230COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004427BD

Part of subcall function 00439D2C: __EH_prolog3_GS.LIBCMT ref: 00439D33

Strings

BuildNo, xrefs: 00442896
MinorVer, xrefs: 00442836
MinorVerMax, xrefs: 00442952
MajorVer, xrefs: 004427D8
PlatformId, xrefs: 004428F6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID: BuildNo$MajorVer$MinorVer$MinorVerMax$PlatformId
API String ID: 3355343447-1900021638
Opcode ID: 54b72b1bced011bff765430e9359db33fa61ef46f5938da93321a1690859fa37
Instruction ID: 154e705caaf0dd0aa9cea5804722333ed6406126e3023fed4ea3bc1ead93e281
Opcode Fuzzy Hash: 54b72b1bced011bff765430e9359db33fa61ef46f5938da93321a1690859fa37
Instruction Fuzzy Hash: 8FA1507180034DEFFB21DF64C985BDE7BB8AF04354F60416EB919621E1DBB89A48CB94

Function 00462DA7 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 219stringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(00000000,GIF87a,?,00000000), ref: 00462DFC
lstrcmpA.KERNEL32(00000000,GIF89a), ref: 00462E13
_memset.LIBCMT ref: 00462F0B

Part of subcall function 004628E3: __EH_prolog3.LIBCMT ref: 004628EA

Strings

GIF89a, xrefs: 00462E0A
GIF87a, xrefs: 00462DF3
;, xrefs: 00462FC6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: lstrcmp$H_prolog3_memset
String ID: ;$GIF87a$GIF89a
API String ID: 3340527980-3016656665
Opcode ID: 941d8fc2a6e64133f06fdb5e480383508609388c18f844837b1e72c2e9bb0116
Instruction ID: 27a52044d09745d92cf9ec1f3b2cc67c009bc39efc2e29ac8b03b4be0a0bfd28
Opcode Fuzzy Hash: 941d8fc2a6e64133f06fdb5e480383508609388c18f844837b1e72c2e9bb0116
Instruction Fuzzy Hash: 2071E271A0060AFFCB248F64C981BAAB7F9FF15304F14445FE48197241F3B9A885DB5A

Function 0049B430 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 212timeCOMMON

Download Yara Rule

APIs

GetDateFormatW.KERNEL32(00000800,00000000,00000000,M-d-yyyy,00000000,00000080,80C21959), ref: 0049B4C4

Part of subcall function 00402060: GetLastError.KERNEL32(80C21959,?,?,?,?,?,?,?,?,?,?,?,00000000,004AB698,000000FF), ref: 00402088
Part of subcall function 00402060: _DebugHeapAllocator.LIBCPMTD ref: 004020E2
Part of subcall function 00402060: SetLastError.KERNEL32(004AB698,?,?,?,?,?,?,?,?,?,?,?,00000000,004AB698,000000FF), ref: 004020FA

GetTimeFormatW.KERNEL32(00000800,00000000,00000000,hh':'mm':'ss tt,00000000,00000080), ref: 0049B545

Part of subcall function 00401A40: _DebugHeapAllocator.LIBCPMTD ref: 00401B8F

Part of subcall function 00401C10: _DebugHeapAllocator.LIBCPMTD ref: 00401D73

Strings

%s[%s]: %s, xrefs: 0049B723
hh':'mm':'ss tt, xrefs: 0049B537
M-d-yyyy, xrefs: 0049B4B6
%s[%s]: %s -- File: %s, Line: %d, xrefs: 0049B6F7

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AllocatorDebugHeap$ErrorFormatLast$DateTime
String ID: %s[%s]: %s$%s[%s]: %s -- File: %s, Line: %d$M-d-yyyy$hh':'mm':'ss tt
API String ID: 294268510-1641453432
Opcode ID: cf9e6a386a8639589bc716c3bd5fd7ccb7836ed04a0aede53d3d7ddecf7df3de
Instruction ID: 5bf664a9dfdecadb4550f6b009b7ec8ffd71f9e49dc32de59fafd9978372061d
Opcode Fuzzy Hash: cf9e6a386a8639589bc716c3bd5fd7ccb7836ed04a0aede53d3d7ddecf7df3de
Instruction Fuzzy Hash: EFA16E70901258AADB24EB64CD95FDDBBB4AF15304F1081EEA409B71E2DB742F84CF65

Function 00404610 Relevance: 10.7, APIs: 7, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00404658
__swab.LIBCMT ref: 004046D0
_DebugHeapAllocator.LIBCPMTD ref: 0040471A
_DebugHeapAllocator.LIBCPMTD ref: 00404791
_strlen.LIBCMT ref: 004047BA
MultiByteToWideChar.KERNEL32(000004B1,00000000,00000000,000000FE,00000000,00000000,80C21959), ref: 004047DA
MultiByteToWideChar.KERNEL32(000004B1,00000000,00000000,000000FF,00000000,?,?,?,?), ref: 00404867

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AllocatorByteCharDebugHeapMultiWide$__swab_strlen_wcslen
String ID:
API String ID: 2263647541-0
Opcode ID: 231d65941a9e2a4c140b4f64e608a09d2ed806129d227e51a58164eab78cd275
Instruction ID: 0ba89208c09de79e9c5ef9db8ecdff8af05d79a8519db6b75dcbf588b55cf216
Opcode Fuzzy Hash: 231d65941a9e2a4c140b4f64e608a09d2ed806129d227e51a58164eab78cd275
Instruction Fuzzy Hash: 99815BB19002089BDB14DFA4DC41BEFB7B5BF84314F10826EF61AA72D1DB789A44CB95

Function 0049B050 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 0049B0D4
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,80C21959), ref: 0049B1F0
_DebugHeapAllocator.LIBCPMTD ref: 0049B23B

Strings

SOFTWARE\InstallShield\17.0\Professional, xrefs: 0049B0E5
InstallShield.log, xrefs: 0049B26F
VerboseLogPath, xrefs: 0049B15E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AllocatorDebugFileHeapIterator_baseIterator_base::_ModuleNamestd::_
String ID: InstallShield.log$SOFTWARE\InstallShield\17.0\Professional$VerboseLogPath
API String ID: 3098495897-786954510
Opcode ID: 9bbca348240f2ec75542e58f2bb835131926d99452464ded1066debcdaae2da6
Instruction ID: 85d17170af963c436557dd30cb3fe5e1a2dd7c31dbcf0680a9dee703f8d4801f
Opcode Fuzzy Hash: 9bbca348240f2ec75542e58f2bb835131926d99452464ded1066debcdaae2da6
Instruction Fuzzy Hash: 19714A709002589EDB15EB65CC92BDDBBB4AB15344F1080EEE149B72D1DBB42F88CF99

Function 00420300 Relevance: 10.6, APIs: 7, Instructions: 149fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,80C21959,00000001,00000104,00000001,?,00000000,004A1167,000000FF,?), ref: 00420367
GetLastError.KERNEL32(?,00000000,004A1167,000000FF,?,0042969D,?,?,00000002,00000001), ref: 00420375
__CxxThrowException@8.LIBCMT ref: 004203B2
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000,?,?,00000000,004A1167,000000FF,?,0042969D,?), ref: 0042042F
GetLastError.KERNEL32(?,00000000,004A1167,000000FF,?,0042969D,?,?,00000002,00000001), ref: 00420439
GetLastError.KERNEL32(?,00000000,004A1167,000000FF,?,0042969D,?,?,00000002,00000001), ref: 00420469
CloseHandle.KERNEL32(?,?,00000000,00000000,?,?,00000000,004A1167,000000FF,?,0042969D,?,?,00000002,00000001), ref: 004204B6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorLast$File$CloseCreateException@8HandleThrowWrite
String ID:
API String ID: 845933566-0
Opcode ID: 294d5d2656763f733b56a4af8d9d53e3647362ff30ab78c7320b4160468a3901
Instruction ID: f26f2de997f9e8b6b5e2cc7c1431ebf6f0379f7ec002c31d361a211c6f2617d1
Opcode Fuzzy Hash: 294d5d2656763f733b56a4af8d9d53e3647362ff30ab78c7320b4160468a3901
Instruction Fuzzy Hash: BE51B371E00259AFDB20DFA4EC85AEE7BF8EB04314F60853BE505E2291D3788E448B59

Function 004425C5 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004425CC

Part of subcall function 00439D2C: __EH_prolog3_GS.LIBCMT ref: 00439D33

Part of subcall function 0040F5AC: __EH_prolog3.LIBCMT ref: 0040F5B3

Strings

MajorVer, xrefs: 004425D9
CSDVersion, xrefs: 00442776
1.20.1827.0, xrefs: 00442666
ServicePack, xrefs: 0044269C, 004426E9
System\CurrentControlSet\Control\Windows, xrefs: 0044275C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID: 1.20.1827.0$CSDVersion$MajorVer$ServicePack$System\CurrentControlSet\Control\Windows
API String ID: 4240126716-3305444093
Opcode ID: 9b3b1907305291da286dee91e64302e6c27d3e7fecdf7226b3ff63cd0a6fd271
Instruction ID: 64565b80128dae4949dda964742192726c528fa5a87344308e1bbc1373aff46f
Opcode Fuzzy Hash: 9b3b1907305291da286dee91e64302e6c27d3e7fecdf7226b3ff63cd0a6fd271
Instruction Fuzzy Hash: 27517E71D00109AAEF14DBA4CE82FEEB778AF11354F1041AAF106B71E1DB785B05CB69

Function 00438983 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004389A5
_memset.LIBCMT ref: 004389BE

Part of subcall function 00409EC2: __EH_prolog3_GS.LIBCMT ref: 00409EC9

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00438AF0

Strings

ClickOncePackage, xrefs: 004389D4
open, xrefs: 00438AEA
Startup, xrefs: 004389D9

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ExecuteH_prolog3H_prolog3_Shell_memset
String ID: ClickOncePackage$Startup$open
API String ID: 1322529132-1966403724
Opcode ID: 9ca980f8fc5b84eee7ae5fe957442ed0586b6fb5dca671284e12ba4b7e30c1c9
Instruction ID: c7bcc0bc323ab1a8aae42321f2131b09ffbf1ae5ab55ff6d0a1fdb44fb618bbf
Opcode Fuzzy Hash: 9ca980f8fc5b84eee7ae5fe957442ed0586b6fb5dca671284e12ba4b7e30c1c9
Instruction Fuzzy Hash: 7451C671901248ABDB14EFA4CC55AEE7778AF15344F00416FF506A71D1EB38AF08CB99

Function 0041603F Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00416061

Part of subcall function 00415E5D: __EH_prolog3.LIBCMT ref: 00415E64

Part of subcall function 00415D7E: __EH_prolog3.LIBCMT ref: 00415D85

Part of subcall function 0040A7C0: __EH_prolog3.LIBCMT ref: 0040A7D9

Part of subcall function 00415EC8: __EH_prolog3_GS.LIBCMT ref: 00415ECF

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0044911E: __EH_prolog3.LIBCMT ref: 0044913D

Strings

.ini, xrefs: 0041609F
Properties, xrefs: 00416159
FontName, xrefs: 0041613E
MS Sans Serif, xrefs: 00416123
0x%04x, xrefs: 00416094

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID: .ini$0x%04x$FontName$MS Sans Serif$Properties
API String ID: 4240126716-3774877647
Opcode ID: d3ffe3afe68f8beab6bf5dd8b0c8bddbe5e66b8bc6576b3678a3bce02e16a41a
Instruction ID: aabbdec58d3c893ce17b4c70d3bf2ac632875182b66ddaf51012ecaff910bf4b
Opcode Fuzzy Hash: d3ffe3afe68f8beab6bf5dd8b0c8bddbe5e66b8bc6576b3678a3bce02e16a41a
Instruction Fuzzy Hash: E7418471D0024CEBDF01EFA5C946BDE7BA8AF15304F10846EF80157281EB789B08CB96

Function 0042159E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 118registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004215BD

Part of subcall function 004014E0: RegOpenKeyExW.KERNELBASE(?,?,00000000,00000000,00000000), ref: 0040150A

_memset.LIBCMT ref: 00421633
RegEnumValueW.ADVAPI32(00000003,00000000,?,?,00000000,?,00000000,00000000,?,?,00000020), ref: 004216CF

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnceEx, xrefs: 00421689
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00421662
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries, xrefs: 004215D6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: EnumH_prolog3OpenValue_memset
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries$Software\Microsoft\Windows\CurrentVersion\RunOnce$Software\Microsoft\Windows\CurrentVersion\RunOnceEx
API String ID: 3998954831-2087105512
Opcode ID: f21d568e72ee511c35141d296de880e345be3482d9e04d7a181b2f4f4dbd7f1f
Instruction ID: cee7b08dadbb325c0bdc7288a6fa8b71db00bcb31183aeb1104f84b1d84b53ba
Opcode Fuzzy Hash: f21d568e72ee511c35141d296de880e345be3482d9e04d7a181b2f4f4dbd7f1f
Instruction Fuzzy Hash: 9F414FB1A0020DABDB10DFD5DD819EFB7BCAF58348F54403BE516B71A1E6389A04CB68

Function 0043559F Relevance: 10.6, APIs: 7, Instructions: 111libraryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004355BE
LoadLibraryExW.KERNEL32(?,00000000,00000002,0000001C), ref: 004355EE
FindResourceW.KERNEL32(00000000,?,?), ref: 0043560A
FreeLibrary.KERNEL32(?), ref: 004356FE

Part of subcall function 00433ACE: GetLastError.KERNEL32 ref: 00433ACE

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Library$ErrorFindFreeH_prolog3_catchLastLoadResource
String ID:
API String ID: 1376058422-0
Opcode ID: 7901e3e3d6c04c4ce88d8a63c0ca893503649c66d693124e7844a36f45e5c076
Instruction ID: 02d30439c994274ac04c602a9ab689e15e3897b01cc4c41997056982ec58f21d
Opcode Fuzzy Hash: 7901e3e3d6c04c4ce88d8a63c0ca893503649c66d693124e7844a36f45e5c076
Instruction Fuzzy Hash: 8A4190B1904149EBCF20EF61CC85AEEBBB4FF48350F50846AE909A7251D7385E44CBA9

Function 00449824 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044982B

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0044886C: __EH_prolog3.LIBCMT ref: 00448873

LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004498AF
GetLastError.KERNEL32 ref: 004498C0

Part of subcall function 00444E32: GetVersionExW.KERNEL32(?), ref: 00444E58

GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 004498E6

Strings

DllRegisterServer, xrefs: 004498D5, 004498E4
DllUnregisterServer, xrefs: 004498DF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$AddressErrorLastLibraryLoadProcVersion
String ID: DllRegisterServer$DllUnregisterServer
API String ID: 4211132615-2931954178
Opcode ID: 54ae641ba96cd6a1c914a02548c2fd8ac9a905af958b21d26ef71f1266456319
Instruction ID: 47938cba06f411bb558e5cd219f6777ad31317787db14d2ad7499173c528b296
Opcode Fuzzy Hash: 54ae641ba96cd6a1c914a02548c2fd8ac9a905af958b21d26ef71f1266456319
Instruction Fuzzy Hash: 6B31B2B0911288EEEF14FF6988516EE3B68AF22344F44406FE40567252DB398E48E75A

Function 0045D1F7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0045D207
GetFileVersionInfoW.VERSION(?,?,?,00000000,?,?), ref: 0045D22E
VerQueryValueW.VERSION(?,004AE53C,?,?,?,?,?,00000000,?,?), ref: 0045D247
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,004AE53C,?,?,?,?,?,00000000,?,?), ref: 0045D26D

Strings

<J, xrefs: 0045D2A6
\VarFileInfo\Translation, xrefs: 0045D263

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: FileInfoQueryValueVersion$Size
String ID: <J$\VarFileInfo\Translation
API String ID: 2099394744-1119798351
Opcode ID: 48126db6c1b74533d998a3282129eed0eeb6f84e813409c2c611ea2308a9535a
Instruction ID: e19d11c0c5b86f454bc45fc92749b0ce4ca3f0ef9047674795a5bd02b30f6703
Opcode Fuzzy Hash: 48126db6c1b74533d998a3282129eed0eeb6f84e813409c2c611ea2308a9535a
Instruction Fuzzy Hash: DF216DB6900204ABEF14DFA5C8819AB7BBDAF04301F1080A7ED01AB246E675DA45DBA4

Function 0045A0F7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings,?), ref: 0045A148
RegQueryValueExW.ADVAPI32(?,ProxyEnable,00000000,00000000,?,?,?,00000000), ref: 0045A16D
RegQueryValueExW.ADVAPI32(?,AutoConfigURL,00000000,00000000,?,?,?,00000000), ref: 0045A196

Strings

Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 0045A13E
ProxyEnable, xrefs: 0045A15E
AutoConfigURL, xrefs: 0045A187

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: QueryValue$Open
String ID: AutoConfigURL$ProxyEnable$Software\Microsoft\Windows\CurrentVersion\Internet Settings
API String ID: 1606891134-3224623278
Opcode ID: fd16d70ecac5b6967eed1149ef9595194297c9dc2aa82505912bb6f2b0e8880b
Instruction ID: fa926bd8386753ed9d2e9bc8b190c3e6f947e4be5cbc76751cd5a9512c283bc1
Opcode Fuzzy Hash: fd16d70ecac5b6967eed1149ef9595194297c9dc2aa82505912bb6f2b0e8880b
Instruction Fuzzy Hash: E72130719042089BEB70DFA5CD45BDE7BB8EF09705F20012EE909E3182DB796518CF65

Function 0045D2BB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

VerQueryValueW.VERSION(?,?,?,?,?,?), ref: 0045D2F4
wsprintfW.USER32 ref: 0045D31F
lstrlenW.KERNEL32(?), ref: 0045D32C
_wcsncat.LIBCMT ref: 0045D33F
VerQueryValueW.VERSION(?,?,?,?), ref: 0045D356

Strings

\StringFileInfo\%04hX%04hX\, xrefs: 0045D319

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: QueryValue$_wcsncatlstrlenwsprintf
String ID: \StringFileInfo\%04hX%04hX\
API String ID: 3254294802-1885460495
Opcode ID: c6e466f4a07b598fbc8bb6472c5a2c9fbb06087c67541b8adb31d4ab9c2f963b
Instruction ID: 6cbb5cf75284b2fdf1993f8f8ff07c28ec48734561720b29e41c594786fa0241
Opcode Fuzzy Hash: c6e466f4a07b598fbc8bb6472c5a2c9fbb06087c67541b8adb31d4ab9c2f963b
Instruction Fuzzy Hash: 4E213AB29005089FEB24DBA5CC95DFF77BCFB08305F50042AEA56D3142EA39A908CB25

Function 0047F685 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getArgumentTypes.LIBCMT ref: 0047F6C0
operator+.LIBCMT ref: 0047F6CF
DName::DName.LIBCMT ref: 0047F6EC
DName::operator+.LIBCMT ref: 0047F6F3
DName::operator+.LIBCMT ref: 0047F6FA

Strings

throw(, xrefs: 0047F6C9, 0047F6E4

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Name::operator+$ArgumentDecorator::getNameName::Typesoperator+
String ID: throw(
API String ID: 4203687869-3159766648
Opcode ID: 1cb735fb3751698a192f292e94304b690d47ea00fffbde5d0b5815d90b84ce25
Instruction ID: 2972dc6ce9e069c8d0d8a77687454c255a5447b726e751926f654da7e8415bc9
Opcode Fuzzy Hash: 1cb735fb3751698a192f292e94304b690d47ea00fffbde5d0b5815d90b84ce25
Instruction Fuzzy Hash: C301FC70640209AFCF00DF68CC46DED3BA5EF44708F048466F4059B391DA78D90A8798

Function 00456886 Relevance: 9.2, APIs: 6, Instructions: 197COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004568A5
std::_String_base::_Xlen.LIBCPMT ref: 004568E6

Part of subcall function 00454B08: __EH_prolog3.LIBCMT ref: 00454B0F
Part of subcall function 00454B08: __CxxThrowException@8.LIBCMT ref: 00454B41

ctype.LIBCPMT ref: 00456959
ctype.LIBCPMT ref: 0045697C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: 5c64ee388549659881aed7d8e35deed0fa3f42aabc03e9d1f194225d9c2977e7
Instruction ID: 423537608b31556eac75a09621fcc25018d60c29220c93eff7005deadf77b6c2
Opcode Fuzzy Hash: 5c64ee388549659881aed7d8e35deed0fa3f42aabc03e9d1f194225d9c2977e7
Instruction Fuzzy Hash: 3271E571A003099FCB34DF65C942BAEBBF5EB44314F11452EE81A97292EB74AA08CB54

Function 00456E34 Relevance: 9.2, APIs: 6, Instructions: 197COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00456E53
std::_String_base::_Xlen.LIBCPMT ref: 00456E94

Part of subcall function 00454B9A: __EH_prolog3.LIBCMT ref: 00454BA1
Part of subcall function 00454B9A: __CxxThrowException@8.LIBCMT ref: 00454BD3

ctype.LIBCPMT ref: 00456F07
ctype.LIBCPMT ref: 00456F2A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: 83702dcbcf7ffef917d74b3cb37ae71e7486e402d853c539d35ac49a62ea5fe3
Instruction ID: 2c0ad4e5225f026965dde35e7b03c3820af501cf2f3d1ad86e1b3d63f9ce4516
Opcode Fuzzy Hash: 83702dcbcf7ffef917d74b3cb37ae71e7486e402d853c539d35ac49a62ea5fe3
Instruction Fuzzy Hash: A471C672A007089FCF24DFA5CD46BAEBBF6FB44315F50491EE81697281DB74AA08CB54

Function 00410CC9 Relevance: 9.2, APIs: 6, Instructions: 181COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00410CD0
std::_String_base::_Xlen.LIBCPMT ref: 00410D0B

Part of subcall function 0040F277: __EH_prolog3.LIBCMT ref: 0040F27E
Part of subcall function 0040F277: __CxxThrowException@8.LIBCMT ref: 0040F2A9

ctype.LIBCPMT ref: 00410D78
ctype.LIBCPMT ref: 00410D98

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catch_String_base::_ThrowXlenstd::_
String ID:
API String ID: 1119708605-0
Opcode ID: c5ef73bfedcc6b98f4675cb6968de9c3a825edfa641300dc7a1dad8a05de358f
Instruction ID: cd00086fd3dc46a99a4c290db192f2c4a9c0a50f094d542621ddc74606b51095
Opcode Fuzzy Hash: c5ef73bfedcc6b98f4675cb6968de9c3a825edfa641300dc7a1dad8a05de358f
Instruction Fuzzy Hash: E651C871A00708AFDF24EFA9D981E9EB7B6FF44314F14452EF11597291DBB4AA44CB08

Function 00425583 Relevance: 9.2, APIs: 6, Instructions: 180COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0042558A
std::_String_base::_Xlen.LIBCPMT ref: 004255C5

Part of subcall function 00421955: __EH_prolog3.LIBCMT ref: 0042195C
Part of subcall function 00421955: __CxxThrowException@8.LIBCMT ref: 00421987

ctype.LIBCPMT ref: 00425632
ctype.LIBCPMT ref: 00425652

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catch_String_base::_ThrowXlenstd::_
String ID:
API String ID: 1119708605-0
Opcode ID: 5c84390630c49a30911bbe549ef35b8b20233853c2c46df8ac0eca9998d60c98
Instruction ID: 3f8d41af10dad9ec7cd247e76324ca4749d9207975de183554968c4d334e9382
Opcode Fuzzy Hash: 5c84390630c49a30911bbe549ef35b8b20233853c2c46df8ac0eca9998d60c98
Instruction Fuzzy Hash: 4151D672B007149FCB24DFA9D981A9EBBB6BF44314F14851EF5169B281D778AA05CB08

Function 0041356E Relevance: 9.2, APIs: 6, Instructions: 169COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041358D
GlobalLock.KERNEL32 ref: 004135B5
_wcsncpy.LIBCMT ref: 0041369D
_wcslen.LIBCMT ref: 004136A6
_wcslen.LIBCMT ref: 004136C0
GlobalUnlock.KERNEL32 ref: 00413746

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Global_wcslen$H_prolog3LockUnlock_wcsncpy
String ID:
API String ID: 3863842361-0
Opcode ID: 8430e3fd76a7ac461a29c2284e39ac061450f457e251c22e5feca0b8861880b2
Instruction ID: ec7cf9065d6ae8259d9d7c8fa884bcef587fd189d2880e143e889a656ea5dfe7
Opcode Fuzzy Hash: 8430e3fd76a7ac461a29c2284e39ac061450f457e251c22e5feca0b8861880b2
Instruction Fuzzy Hash: A1617F71900209DFDF14DFA4C845BEEBBB4EF04315F14812BE805A7291EB789B84CBA9

Function 0044A69D Relevance: 9.2, APIs: 6, Instructions: 154COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0044A6A4
std::_String_base::_Xlen.LIBCPMT ref: 0044A6D6

Part of subcall function 004486F8: __EH_prolog3.LIBCMT ref: 004486FF
Part of subcall function 004486F8: __CxxThrowException@8.LIBCMT ref: 00448731

ctype.LIBCPMT ref: 0044A738
ctype.LIBCPMT ref: 0044A74F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: 1d9a56be8002c2fe4745f32e0730fde2a13d5d58e5705cef55493479f1df33d6
Instruction ID: 1f40dcfba01eb561081325469460aad54d4681eae92fce862af32b04a044b51e
Opcode Fuzzy Hash: 1d9a56be8002c2fe4745f32e0730fde2a13d5d58e5705cef55493479f1df33d6
Instruction Fuzzy Hash: B151B071A0060A9FDF14DFA4C9859AE77F5FF44304B10862EF816A7240DB74EE25CB96

Function 0045C8AD Relevance: 9.2, APIs: 6, Instructions: 154COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0045C8B4
std::_String_base::_Xlen.LIBCPMT ref: 0045C8E6

Part of subcall function 0045C86E: __EH_prolog3.LIBCMT ref: 0045C875
Part of subcall function 0045C86E: __CxxThrowException@8.LIBCMT ref: 0045C8A7

ctype.LIBCPMT ref: 0045C948
ctype.LIBCPMT ref: 0045C95F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: 384bbcbf0704d90da6bce1eda54facc1f5541fdb2a80e48e4cda56baa5615baa
Instruction ID: 3842e732508762df1c86947fa50aa748fe49c6b4c830e9a3b49deba2ab2ad095
Opcode Fuzzy Hash: 384bbcbf0704d90da6bce1eda54facc1f5541fdb2a80e48e4cda56baa5615baa
Instruction Fuzzy Hash: 6A517F71A0070A9FCF14DF68C981AAE7BB5FF44315B10452EFC16A7241D774AE18CB95

Function 00436F6E Relevance: 9.2, APIs: 6, Instructions: 150COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00436F75
std::_String_base::_Xlen.LIBCPMT ref: 00436FA7

Part of subcall function 00436F36: __EH_prolog3.LIBCMT ref: 00436F3D
Part of subcall function 00436F36: __CxxThrowException@8.LIBCMT ref: 00436F68

ctype.LIBCPMT ref: 00437010
ctype.LIBCPMT ref: 0043702E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: 57dde59a320756f7135f7999cdad6855fd03b35f9f1a9b030c369d70cf975a7b
Instruction ID: ccab551ead371fb77de69fdd0089dd3a1234174881eafbee845009f6d8fdf671
Opcode Fuzzy Hash: 57dde59a320756f7135f7999cdad6855fd03b35f9f1a9b030c369d70cf975a7b
Instruction Fuzzy Hash: AA5180B1A0020A9FDF24DF68D98196E77F2FB48314F119A1EF85697284D734AE10CB69

Function 0040F3F1 Relevance: 9.1, APIs: 6, Instructions: 111COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040F3FB
_wcslen.LIBCMT ref: 0040F40D
_wcslen.LIBCMT ref: 0040F444
SysStringLen.OLEAUT32(004ACAA4), ref: 0040F4F0
SysFreeString.OLEAUT32(004ACAA4), ref: 0040F501
SysFreeString.OLEAUT32(004ACAA4), ref: 0040F544

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: String$Free_wcslen$H_prolog3
String ID:
API String ID: 423635067-0
Opcode ID: 993c5d3e3f3c7cc8b01f3fe5c2d4e63a37204ac74bc32ef4a0e6a4fc74a8136d
Instruction ID: bf2177901cbd5ab3060e1111da63f3622566e00df932f43a37e6b77c61a67e26
Opcode Fuzzy Hash: 993c5d3e3f3c7cc8b01f3fe5c2d4e63a37204ac74bc32ef4a0e6a4fc74a8136d
Instruction Fuzzy Hash: FE418071C0021AABCF25DFA5D845AEEBBB0FF05314F10817AE851B72D1D7385A05CBA5

Function 004415C9 Relevance: 9.1, APIs: 6, Instructions: 60stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,?,?,?,?), ref: 004415FC
_wcsrchr.LIBCMT ref: 00441607
_wcsrchr.LIBCMT ref: 0044161D
CharNextW.USER32(00000000,?,?), ref: 0044162B
lstrcpyW.KERNEL32(?,?,?,?), ref: 00441644
lstrcpyW.KERNEL32(?,?,?,?), ref: 00441652

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: lstrcpy$_wcsrchr$CharNext
String ID:
API String ID: 3722002711-0
Opcode ID: f034abf750212aabd9056e34606fcc29dbb856dd331fd7202ff624052bfa789f
Instruction ID: 6bc514183bab8d6cfbf38d28c3946d86fe2ef406776b627f3286d5312fcdd7bc
Opcode Fuzzy Hash: f034abf750212aabd9056e34606fcc29dbb856dd331fd7202ff624052bfa789f
Instruction Fuzzy Hash: EC112176900218EBDB50DF74DC41A9A7BFCFB49310F1584ABE549D3240EE3499888F94

Function 0044166C Relevance: 9.1, APIs: 6, Instructions: 55stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004416A1
CharNextW.USER32(?), ref: 004416B0
lstrcpyW.KERNEL32(?,00000000), ref: 004416C0
CharNextW.USER32(00000000), ref: 004416D3
CharPrevW.USER32(00000000,00000000), ref: 004416E3
lstrcpyW.KERNEL32(?,00000000), ref: 004416FC

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Char$Nextlstrcpy$Prev_memset
String ID:
API String ID: 3355883774-0
Opcode ID: c70cb66edf3ef1bbbaf24336d4dafbe1e3a98b229ae0a2f2139e1cd4c694e90b
Instruction ID: f3b1eafa65efc81eb71ac0c7350803353f7ee2fefab14e0a7fba1a6171fa9138
Opcode Fuzzy Hash: c70cb66edf3ef1bbbaf24336d4dafbe1e3a98b229ae0a2f2139e1cd4c694e90b
Instruction Fuzzy Hash: CB1186A1D00218ABDB51EB64DD8499B77FCFF05300F0590A7E105D3151DE749D888BE8

Function 004277F6 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042780F
wsprintfW.USER32 ref: 00427951

Strings

1033, xrefs: 00427B18
UseDotNetUI, xrefs: 0042788D
Startup, xrefs: 004278A7

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3wsprintf
String ID: 1033$Startup$UseDotNetUI
API String ID: 3269967010-2843573423
Opcode ID: 32fd7b7ca4c742483a7d258a83306428a92cf4dfb2536d8412fdc4b917365150
Instruction ID: 630996f1124fba69f8f01d9eb7cb0de1d6fd52ca75068b6bb5c49c6aceb1da4d
Opcode Fuzzy Hash: 32fd7b7ca4c742483a7d258a83306428a92cf4dfb2536d8412fdc4b917365150
Instruction Fuzzy Hash: 7AC1E570A04219DFDF04DFA4D945BEEBBB0BF04314F50416FE505A72A2DB789A49CB98

Function 004132D1 Relevance: 9.0, APIs: 6, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?), ref: 004132E7
__CxxThrowException@8.LIBCMT ref: 004132F5

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

LoadResource.KERNEL32(?,00000000), ref: 004132FE
SizeofResource.KERNEL32(?,00000000), ref: 0041330F
GlobalAlloc.KERNEL32(00000040,00000000), ref: 0041331F
LockResource.KERNEL32(?,?), ref: 00413331

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Resource$AllocExceptionException@8FindGlobalLoadLockRaiseSizeofThrow
String ID:
API String ID: 3153923799-0
Opcode ID: 272ea4acbf23c297ae38208ffec754ab28793baa05ced03de5631b603b4f7248
Instruction ID: 0ed5b5edd0c0fc0b42cf220da79b5bdb01503d8e4e8db87b4882bcdd6703ea07
Opcode Fuzzy Hash: 272ea4acbf23c297ae38208ffec754ab28793baa05ced03de5631b603b4f7248
Instruction Fuzzy Hash: 83014476500246BFDB112FA1EC89C9BBFBDFB55751B00483AFA4682220DA358D50DB54

Function 0041C30A Relevance: 9.0, APIs: 6, Instructions: 47filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(004D7A00,40000000,00000000,00000000,00000004,00000080,00000000), ref: 0041C326
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041C339
lstrlenW.KERNEL32(?,?,00000000), ref: 0041C347
WriteFile.KERNEL32(00000000,?,00000000), ref: 0041C358
WriteFile.KERNEL32(00000000,004AC934,00000002,?,00000000), ref: 0041C367
CloseHandle.KERNEL32(00000000), ref: 0041C36A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$Write$CloseCreateHandlePointerlstrlen
String ID:
API String ID: 4224374842-0
Opcode ID: ac30b1a70019b0817a44f1906bd6708543dd7709d1d62f4ae56188e4e8a73a35
Instruction ID: 8cd78bdcd4b13e17cf7b86aaea5bb2daca0054e6161823ebdbf6a28fe0ac3c64
Opcode Fuzzy Hash: ac30b1a70019b0817a44f1906bd6708543dd7709d1d62f4ae56188e4e8a73a35
Instruction Fuzzy Hash: 4BF096B62402087BDB6017B6ACCDF9B3E7CD7C7B65F104125FA0691191D6745900C774

Function 0046B3CD Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0046B3D9

Part of subcall function 0046D2AD: __getptd_noexit.LIBCMT ref: 0046D2B0
Part of subcall function 0046D2AD: __amsg_exit.LIBCMT ref: 0046D2BD

__calloc_crt.LIBCMT ref: 0046B3E4

Part of subcall function 0046EB52: __calloc_impl.LIBCMT ref: 0046EB63
Part of subcall function 0046EB52: Sleep.KERNEL32(00000000,0046D25F,00000001,00000214), ref: 0046EB7A

__lock.LIBCMT ref: 0046B41A
___addlocaleref.LIBCMT ref: 0046B426
__lock.LIBCMT ref: 0046B43A
InterlockedIncrement.KERNEL32(?), ref: 0046B44A

Part of subcall function 00466E11: __getptd_noexit.LIBCMT ref: 00466E11

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: __getptd_noexit__lock$IncrementInterlockedSleep___addlocaleref__amsg_exit__calloc_crt__calloc_impl__getptd
String ID:
API String ID: 3538106438-0
Opcode ID: a3c5b5fff44a7441e4c99782dbc07bf6b846d944cf081a765201a762b7f27b83
Instruction ID: 77e618f4977d4f9e34796b56d115742974d775e155bdefbd714f6fbbe9d8fa6e
Opcode Fuzzy Hash: a3c5b5fff44a7441e4c99782dbc07bf6b846d944cf081a765201a762b7f27b83
Instruction Fuzzy Hash: 3B019271544701EAE720BBB59842B4C76A0EF00728F20811FF8549B2D2EF7D59818BAB

Function 004320E2 Relevance: 9.0, APIs: 6, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000000,00000000), ref: 0043210A
EnableWindow.USER32(00000000), ref: 0043210D
GetDlgItem.USER32(00000000,00000001), ref: 00432120
EnableWindow.USER32(00000000), ref: 00432123
GetDlgItem.USER32(00000000), ref: 0043212E
SetFocus.USER32(00000000), ref: 00432131

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Item$EnableWindow$Focus
String ID:
API String ID: 864471436-0
Opcode ID: 616e149772942099aaf5b978765039b8e7755b3250a333f91e83f8572820eaf0
Instruction ID: 5b91329d27e7dfafa93ea349f88484c72db508d0e2c742102fbf6788633d1c68
Opcode Fuzzy Hash: 616e149772942099aaf5b978765039b8e7755b3250a333f91e83f8572820eaf0
Instruction Fuzzy Hash: F3F03A32401219EBCF21AF55EE58BAB3F69FB48350F010427F6449217087B6A860DFA8

Function 00462100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00462D24: __EH_prolog3.LIBCMT ref: 00462D2B

GetWindowDC.USER32(00000000), ref: 0046228C
CreateDIBitmap.GDI32(00000000,?,00000004,00000001,?,00000000), ref: 004622A7
ReleaseDC.USER32(00000000,00000000), ref: 004622D4
_memset.LIBCMT ref: 00462301

Strings

(, xrefs: 00462248

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: BitmapCreateH_prolog3ReleaseWindow_memset
String ID: (
API String ID: 1341828148-3887548279
Opcode ID: ca93b15047a5a47cb3c4da510c1f6a80a0de1d61e3ec881a807f5d2eefdb6f42
Instruction ID: c5293c1a0edc45b7c61131fffccf3ca16f079f81e77546c4e11b89be65ad6775
Opcode Fuzzy Hash: ca93b15047a5a47cb3c4da510c1f6a80a0de1d61e3ec881a807f5d2eefdb6f42
Instruction Fuzzy Hash: D37127B1608341AFD754DF25D980BABBBE4EB89714F00492EF98987381E778D904CB67

Function 0045359B Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004535B4

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0045298B: __EH_prolog3_catch_GS.LIBCMT ref: 00452995
Part of subcall function 0045298B: EnterCriticalSection.KERNEL32(00000098,00453811,?,00000001), ref: 004529A5
Part of subcall function 0045298B: _strncpy.LIBCMT ref: 004529CF
Part of subcall function 0045298B: lstrlenA.KERNEL32(00000000), ref: 004529D8
Part of subcall function 0045298B: LeaveCriticalSection.KERNEL32(004DB884,00000001,00000000,00000000,00000021), ref: 00452A7C

Part of subcall function 0040B2F1: __EH_prolog3.LIBCMT ref: 0040B2F8

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

_vswprintf_s.LIBCMT ref: 00453643

Part of subcall function 0046C5C8: __vsnwprintf_l.LIBCMT ref: 0046C5DB

Part of subcall function 0040B14B: __EH_prolog3.LIBCMT ref: 0040B152
Part of subcall function 0040B14B: GetLastError.KERNEL32(00000038,0040C732), ref: 0040B159
Part of subcall function 0040B14B: SetLastError.KERNEL32(00000000), ref: 0040B1A3

Part of subcall function 00409558: __EH_prolog3.LIBCMT ref: 0040955F

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 00415B3A: _wcslen.LIBCMT ref: 00415B41

Strings

PHK, xrefs: 00453687
Comment, xrefs: 004535DF
%ls|%ls|, xrefs: 004535E7

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$CriticalErrorLastSectionString$AllocEnterH_prolog3_catchH_prolog3_catch_Leave__vsnwprintf_l_strncpy_vswprintf_s_wcslenlstrlen
String ID: %ls|%ls|$Comment$PHK
API String ID: 2131482305-1419408609
Opcode ID: 9b209a29d723cdfb2fb8efab18a87881584b4b35a7e88d7ec010946ff5cca749
Instruction ID: c1cb8503bd3cbbf1f336b62fc5489711f59c0abd17919c99a6c7b8f0b4be0155
Opcode Fuzzy Hash: 9b209a29d723cdfb2fb8efab18a87881584b4b35a7e88d7ec010946ff5cca749
Instruction Fuzzy Hash: B45173B1400188BBDB05FF95CC52ADD376CAF15304F44442FF91667192EB78AB08C769

Function 00416201 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041621D

Part of subcall function 00415E5D: __EH_prolog3.LIBCMT ref: 00415E64

Part of subcall function 00415D7E: __EH_prolog3.LIBCMT ref: 00415D85

Part of subcall function 0040A7C0: __EH_prolog3.LIBCMT ref: 0040A7D9

Part of subcall function 00415EC8: __EH_prolog3_GS.LIBCMT ref: 00415ECF

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 00449266: __EH_prolog3.LIBCMT ref: 00449285

Strings

.ini, xrefs: 0041624B
Properties, xrefs: 004162EB
0x%04x, xrefs: 00416240
FontSize, xrefs: 004162D0

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID: .ini$0x%04x$FontSize$Properties
API String ID: 4240126716-3572762767
Opcode ID: 4a334f3cfccfe73b930af3d7bd68523fe88bd50965ff6dc85607bf95818f9f86
Instruction ID: f0c376b5dae1d8e29179ab847cbf2ccaf7cb8a4c65ef3ccecbb4eee7b36fea70
Opcode Fuzzy Hash: 4a334f3cfccfe73b930af3d7bd68523fe88bd50965ff6dc85607bf95818f9f86
Instruction Fuzzy Hash: 5D419671D00248EBDB04EFA5CC16BDE7BA8AF55308F50806EF415A71D2EB799B08C796

Function 004514ED Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004514F4

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0044886C: __EH_prolog3.LIBCMT ref: 00448873

Strings

.TLB, xrefs: 00451581
.EXE, xrefs: 0045153F
.OCX, xrefs: 004515C2
.DLL, xrefs: 004515B1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID: .DLL$.EXE$.OCX$.TLB
API String ID: 4240126716-324785130
Opcode ID: 98b7fe47048d617a2d17da58af5919958b4f4f6cb3c084129c859ad16c8b5b48
Instruction ID: 93bae3269bb2d22c7c523ff76430b05e8f238c91fc2d4dbaf944fadb8e2f355d
Opcode Fuzzy Hash: 98b7fe47048d617a2d17da58af5919958b4f4f6cb3c084129c859ad16c8b5b48
Instruction Fuzzy Hash: E43154B090020CABDF14FFA5C842AED3768AF51345F54042FFC02661A3EB3D9A09D65A

Function 004380A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004380BF
__itow.LIBCMT ref: 00438136

Part of subcall function 00415B3A: _wcslen.LIBCMT ref: 00415B41

Part of subcall function 0043777C: __EH_prolog3.LIBCMT ref: 00437783

Strings

/p", xrefs: 0043816F
/l, xrefs: 00438112
/Q, xrefs: 004380D5

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$__itow_wcslen
String ID: /Q$ /l$/p"
API String ID: 1213461412-3368241770
Opcode ID: 2f10c7679b90adcf24e1a37bac30c276649d4b70b4d509642451ed5b6e7f3d69
Instruction ID: 4c302d15c05b0520f57f0f6232f7e0e7d36795d965fd69e30ae3c22806e0e1b0
Opcode Fuzzy Hash: 2f10c7679b90adcf24e1a37bac30c276649d4b70b4d509642451ed5b6e7f3d69
Instruction Fuzzy Hash: D831B471A00604AFDB18EB95C956BEDB3A4AB54314F50416EF015A71D2EB7C6F0AC748

Function 0045A951 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045A95B

Part of subcall function 00414E5E: __EH_prolog3.LIBCMT ref: 00414E65
Part of subcall function 00414E5E: InterlockedIncrement.KERNEL32(004DB924), ref: 00414EFB

Part of subcall function 004590E9: _memset.LIBCMT ref: 004590F9

lstrlenW.KERNEL32(?,?,?,?,?,00000000,80400100,rrs,00007530,00000000,00000000,00000000,00000000,000000BC), ref: 0045A9DC
__alloca_probe_16.LIBCMT ref: 0045A9F3
lstrcmpA.KERNEL32(?,00000000,?,?,?,?,00000000,80400100,rrs,00007530,00000000,00000000,00000000,00000000,000000BC), ref: 0045AA0A

Strings

rrs, xrefs: 0045A96B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_IncrementInterlocked__alloca_probe_16_memsetlstrcmplstrlen
String ID: rrs
API String ID: 2395233418-2083610334
Opcode ID: d1e99f432551d004421cebfff9528d9847d3f21fb704141f7a5fbd65c7b83e53
Instruction ID: 92c031be50f6da0aca3e2c3a5f1455d12a5a874215aded5485a737ab20ecadf5
Opcode Fuzzy Hash: d1e99f432551d004421cebfff9528d9847d3f21fb704141f7a5fbd65c7b83e53
Instruction Fuzzy Hash: E121503080112AABCF21EB61CD05EDE7B35AF01319F10425AF81977192DB395F59CB9A

Function 0043948C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74timeCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00439493

Part of subcall function 00402290: SysStringLen.OLEAUT32(?), ref: 004022AC
Part of subcall function 00402290: SysReAllocStringLen.OLEAUT32(?,00000000,00000000), ref: 004022D5

Part of subcall function 004434F4: __EH_prolog3.LIBCMT ref: 00443513
Part of subcall function 004434F4: _memset.LIBCMT ref: 0044354C
Part of subcall function 004434F4: GetModuleFileNameW.KERNEL32(?,00000104,?,?,00000010), ref: 00443567
Part of subcall function 004434F4: _memset.LIBCMT ref: 00443591
Part of subcall function 004434F4: _memset.LIBCMT ref: 004435CD
Part of subcall function 004434F4: GetTempPathW.KERNEL32(00000104,?,?,?,?,?,?,?,?,?,00000010), ref: 004435DD
Part of subcall function 004434F4: GetTempFileNameW.KERNELBASE(?,004B2AE0,00000000,?,?,?,?,?,?,?,?,?,00000010), ref: 004435F7

Part of subcall function 00402060: GetLastError.KERNEL32(80C21959,?,?,?,?,?,?,?,?,?,?,?,00000000,004AB698,000000FF), ref: 00402088
Part of subcall function 00402060: _DebugHeapAllocator.LIBCPMTD ref: 004020E2
Part of subcall function 00402060: SetLastError.KERNEL32(004AB698,?,?,?,?,?,?,?,?,?,?,?,00000000,004AB698,000000FF), ref: 004020FA

GetLocalTime.KERNEL32(?,?,0000044F,?,000000A0), ref: 0043952C
SystemTimeToVariantTime.OLEAUT32(?,?), ref: 0043954C

Strings

ExpireDate, xrefs: 004394D2
Startup, xrefs: 004394D7

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Time_memset$ErrorFileLastNameStringTemp$AllocAllocatorDebugH_prolog3H_prolog3_HeapLocalModulePathSystemVariant
String ID: ExpireDate$Startup
API String ID: 479639557-3358940881
Opcode ID: e9479834d338a1a8620649ed10e6955de855764d877761a44ef7ed86178c9333
Instruction ID: 497ff27a9fc1b54bb78afb7a78dcf8627ca914eedb6b8c31b0e207f34889d631
Opcode Fuzzy Hash: e9479834d338a1a8620649ed10e6955de855764d877761a44ef7ed86178c9333
Instruction Fuzzy Hash: 8621A172900248EFDB01EBE0C949BDEB778AF19344F10456AE105F71A1EB785A45CBAA

Function 004651D2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004651E0

Part of subcall function 00464974: __getptd.LIBCMT ref: 00464987

_strlen.LIBCMT ref: 004651F4
MultiByteToWideChar.KERNEL32(?,00000009,00402645,000000FF,00000000,00000000), ref: 0046521A

Strings

E&@, xrefs: 004651D4

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Locale$ByteCharMultiUpdateUpdate::_Wide__getptd_strlen
String ID: E&@
API String ID: 2700329309-1007834253
Opcode ID: 807bd49ddbd3da4a2d08912cd8d9ac30db4cf9dfe0bb6eb518d5f0cec7ac376a
Instruction ID: b3ad87b4a115bad5a7421b8543e8affaa99be088a3205605d3891180e59646c7
Opcode Fuzzy Hash: 807bd49ddbd3da4a2d08912cd8d9ac30db4cf9dfe0bb6eb518d5f0cec7ac376a
Instruction Fuzzy Hash: C2112430A00645AFDF10DB64C811ABA7BA4AF42374F2402DAE0B05B2E2F7348D429B5A

Function 0041A3DC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69libraryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041A3E3

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000001,0000006C), ref: 0041A40B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,0000006C), ref: 0041A422

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\IsMsiHelper.cpp, xrefs: 0041A443
Failed to load ISSetup.dll, xrefs: 0041A45A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ErrorLastLibraryLoad
String ID: E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\IsMsiHelper.cpp$Failed to load ISSetup.dll
API String ID: 1196625228-635099348
Opcode ID: 2a448dbd6abe126dcd4e9a7cf095db21e7b6a961d6fc3b2fe2da4f1d098afc08
Instruction ID: 2be0dc8bdb7df7746b26e9254a5d4e01da9b60864c66d6d9734e1e33ab8ad54a
Opcode Fuzzy Hash: 2a448dbd6abe126dcd4e9a7cf095db21e7b6a961d6fc3b2fe2da4f1d098afc08
Instruction Fuzzy Hash: 6F21A871802244EFDB11DFA0C949BDE7BB4AF11304F14842FF00597191D7B86B94CB9A

Function 0041E94F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041E956
GetTickCount.KERNEL32 ref: 0041E9EE

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 0041E9F6
SplashTime, xrefs: 0041E9A1
Startup, xrefs: 0041E9B7

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CountH_prolog3Tick
String ID: E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$SplashTime$Startup
API String ID: 3287309161-421793083
Opcode ID: c41dccc56baa84de5a6ebb80967246668d5ea87c4e9b0f647810a1b9e01007e0
Instruction ID: 559477a345b3a7f27468c2dc1bf2f93e7503f46d718fe30ef85dcedfaa6b3866
Opcode Fuzzy Hash: c41dccc56baa84de5a6ebb80967246668d5ea87c4e9b0f647810a1b9e01007e0
Instruction Fuzzy Hash: 2221D371D402489EDB10EFA5C841FEEBBB49F05304F14416AE511AB2E2DB794F4ACB99

Function 0044252E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000), ref: 0044255B
_memset.LIBCMT ref: 0044257B
wsprintfW.USER32 ref: 00442593

Part of subcall function 00442400: __EH_prolog3.LIBCMT ref: 00442422

LocalFree.KERNEL32(?), ref: 004425AE

Strings

%s %s, xrefs: 0044258D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: FormatFreeH_prolog3LocalMessage_memsetwsprintf
String ID: %s %s
API String ID: 2147703820-2939940506
Opcode ID: 81533621fe0edfa54857990f336992cdb65e868ecc85a1c9f15eaeed0d6f92b6
Instruction ID: 6236a0566d9326e1ab550534b15e248a34b18506ae2f82adf9b43ecbbb1f6e80
Opcode Fuzzy Hash: 81533621fe0edfa54857990f336992cdb65e868ecc85a1c9f15eaeed0d6f92b6
Instruction Fuzzy Hash: A9019275A00118BADB619BA1CD49EDB7FFCFF09754F0040A6B549D2150DE749A88CFD4

Function 0044145B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00441469
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 0044147C
_memset.LIBCMT ref: 00441490
FreeLibrary.KERNEL32(00000000), ref: 004414D1

Strings

DllGetVersion, xrefs: 00441476

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc_memset
String ID: DllGetVersion
API String ID: 278593715-2861820592
Opcode ID: 669a242446d662a5a76d7760751f688a677253304e2136abd30b6c3a03003d4d
Instruction ID: d0c70328f32337ac8f6ffdf4266044cce54eabd18dce35b1b8a17af07691b850
Opcode Fuzzy Hash: 669a242446d662a5a76d7760751f688a677253304e2136abd30b6c3a03003d4d
Instruction Fuzzy Hash: 68111BB5A0020AAFDB00DF99E885A9EBBB8EF48344F100069F901A7361D774D940CB74

Function 0044643B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00446442
LoadLibraryW.KERNEL32(advapi32.dll,00000004), ref: 0044644C
GetProcAddress.KERNEL32(00000000,RegOverridePredefKey), ref: 0044647A

Strings

RegOverridePredefKey, xrefs: 00446474
advapi32.dll, xrefs: 00446447

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressH_prolog3LibraryLoadProc
String ID: RegOverridePredefKey$advapi32.dll
API String ID: 1637174950-237637011
Opcode ID: 9be8ac1f0239567d24f02a5d232a19c9ffb34f9e635a110144413a14bf3ff2f0
Instruction ID: 6edce9b46ff49b880f909255d629e9293a6e25d643495ae2d504fde6f4f4f2d0
Opcode Fuzzy Hash: 9be8ac1f0239567d24f02a5d232a19c9ffb34f9e635a110144413a14bf3ff2f0
Instruction Fuzzy Hash: 96F0EC75A40111ABDF00BFA18C4679D35E0AF12385F02802AF80196151E73C8E009B9F

Function 00444C8F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00444CA2
GetProcAddress.KERNEL32(00000000), ref: 00444CA9
GetCurrentProcess.KERNEL32(00000000), ref: 00444CB9

Strings

kernel32, xrefs: 00444C9D
IsWow64Process, xrefs: 00444C98

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: e9c60e54205bdc9146227eacae031985517b643a908df4d0bbe8fe278e33b50c
Instruction ID: e8b1edb23ed0c88e43fd80ffd22ff218cfd89d5985aea1c7e949cda51ef3bb9d
Opcode Fuzzy Hash: e9c60e54205bdc9146227eacae031985517b643a908df4d0bbe8fe278e33b50c
Instruction Fuzzy Hash: A4E04FB1E42218BBDB109BF19C4EB8E7AACAB05752B158965A501E3140DA789A008AA8

Function 0046D83A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0046D854

Part of subcall function 0046D2AD: __getptd_noexit.LIBCMT ref: 0046D2B0
Part of subcall function 0046D2AD: __amsg_exit.LIBCMT ref: 0046D2BD

__getptd.LIBCMT ref: 0046D865
__getptd.LIBCMT ref: 0046D873

Strings

csm, xrefs: 0046D84D
MOC, xrefs: 0046D846

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: bbabc7c7ee7e417aa41bc1db97c15765d27c38c27526e068efd924adf0ff137e
Instruction ID: ca037ed670409c272861261c66b6b5d4550422885beb3110f053f72a5695b8fc
Opcode Fuzzy Hash: bbabc7c7ee7e417aa41bc1db97c15765d27c38c27526e068efd924adf0ff137e
Instruction Fuzzy Hash: 9AE01A31E102048FD710BA6AC44AB6933A4EB99328F1900E7E858C7322F72CE840954B

Function 00444C66 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,GetNativeSystemInfo,00445B86,?), ref: 00444C70
GetProcAddress.KERNEL32(00000000), ref: 00444C77
GetSystemInfo.KERNEL32(?), ref: 00444C85

Strings

GetNativeSystemInfo, xrefs: 00444C66
kernel32, xrefs: 00444C6B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleInfoModuleProcSystem
String ID: GetNativeSystemInfo$kernel32
API String ID: 1167836806-3846845290
Opcode ID: 0f5809c7d46939e046f059d69a4c4134754a6091dfce05ff836efd1f4dcf1af9
Instruction ID: e06a1bbac0db8c36f8f83bd7e731efe2f90f03c98c678aaec13f5c5e0726b4e3
Opcode Fuzzy Hash: 0f5809c7d46939e046f059d69a4c4134754a6091dfce05ff836efd1f4dcf1af9
Instruction Fuzzy Hash: 6FC08CF0381300BBAE802FF29C8DA4A7E68AE8BB07710C429F006C0122DF3C81019F2D

Function 0046028B Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004602AA
ctype.LIBCPMT ref: 0046035E
ctype.LIBCPMT ref: 00460381

Part of subcall function 004483F5: __EH_prolog3.LIBCMT ref: 004483FC
Part of subcall function 004483F5: __CxxThrowException@8.LIBCMT ref: 0044842E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchThrow
String ID:
API String ID: 1721466683-0
Opcode ID: e98af4d2a32439acd3cd1eb07e8b4198528ddeceddd0d5a6b6b3bcafdce866bf
Instruction ID: 04624336e6b22f54d2c9c3aea61e6c4acf3bedda317a9f47e3666983ea9e8eec
Opcode Fuzzy Hash: e98af4d2a32439acd3cd1eb07e8b4198528ddeceddd0d5a6b6b3bcafdce866bf
Instruction Fuzzy Hash: 3171B371A007089FDB24DFA5CC86BAEB7F6FB44314F10451EE40A97290EB74AA08CB56

Function 00425293 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004252B2
ctype.LIBCPMT ref: 0042536D
ctype.LIBCPMT ref: 00425393

Part of subcall function 0042198D: __EH_prolog3.LIBCMT ref: 00421994
Part of subcall function 0042198D: __CxxThrowException@8.LIBCMT ref: 004219BF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchThrow
String ID:
API String ID: 1721466683-0
Opcode ID: a98fb7fdb34b69b7f0f406aa1769b844ba9fa2de3ab17438a00fe6afb253cd46
Instruction ID: 51d6bcc5b3458c8f87e75babdda667e1457dbb873bd90ab628a1e61e1cff0dbc
Opcode Fuzzy Hash: a98fb7fdb34b69b7f0f406aa1769b844ba9fa2de3ab17438a00fe6afb253cd46
Instruction Fuzzy Hash: 2161E371B00618DFEB24DFB9D981BAEB7F2FF44304F50452EE44697291DB78AA048B19

Function 0042604B Relevance: 7.6, APIs: 5, Instructions: 144windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00426064

Part of subcall function 00415F36: __EH_prolog3_GS.LIBCMT ref: 00415F3D

Part of subcall function 00416366: __EH_prolog3.LIBCMT ref: 00416388

SendMessageW.USER32(?,00000401,00000000,00000001), ref: 00426167
GetDlgItem.USER32(?,0000012D), ref: 004261B5
SendMessageW.USER32(00000000,0000000F,00000000,00000000), ref: 004261C0
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004261C8

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: MessageSend$H_prolog3$H_prolog3_Item
String ID:
API String ID: 3151754311-0
Opcode ID: d4708df0bcef1e03731553ddd8c456e57ad7d9b99efd88bec77560b7190ccaf7
Instruction ID: 2f4378beaedf341ccc13b26e376c887bc3362d4e7aa22172f767567606de9184
Opcode Fuzzy Hash: d4708df0bcef1e03731553ddd8c456e57ad7d9b99efd88bec77560b7190ccaf7
Instruction Fuzzy Hash: B6515A71900158EBDB04EFA5CD85AEE7BB8EF05344F50406EF805AB292DB78AE04DB65

Function 00415833 Relevance: 7.6, APIs: 5, Instructions: 97stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00415852
GetTempPathW.KERNEL32(00000104,?,0000004C), ref: 00415873

Part of subcall function 0041571A: __EH_prolog3.LIBCMT ref: 00415721
Part of subcall function 0041571A: SysStringLen.OLEAUT32(?), ref: 0041573E

GetTempFileNameW.KERNEL32(?,?,00000000), ref: 0041589E

Part of subcall function 004143F9: __EH_prolog3.LIBCMT ref: 00414400

Part of subcall function 00413C71: __EH_prolog3.LIBCMT ref: 00413C78

lstrcatW.KERNEL32(?,?), ref: 004158E9

Part of subcall function 0041579F: __EH_prolog3.LIBCMT ref: 004157A6
Part of subcall function 0041579F: SysStringLen.OLEAUT32(?), ref: 004157C9

lstrcatW.KERNEL32(?,?), ref: 00415911

Part of subcall function 00414351: SysFreeString.OLEAUT32(00000000), ref: 00414360
Part of subcall function 00414351: SysAllocString.OLEAUT32(?), ref: 0041436B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$String$Templstrcat$AllocFileFreeNamePath
String ID:
API String ID: 2772691643-0
Opcode ID: bbb69704d83e7cbf73bb25c434e75c3d91b8e2d3731f2195292f34879f6685ca
Instruction ID: 361d0b930b2932b60003d9c482fffeb8ab9f514e1ae3e5ce6c2e1b7c695c1bae
Opcode Fuzzy Hash: bbb69704d83e7cbf73bb25c434e75c3d91b8e2d3731f2195292f34879f6685ca
Instruction Fuzzy Hash: AA41517590024CDFDB14EF94CC85ADEBBB8FF44304F00446AE515AB152DB786B49CB55

Function 004176C1 Relevance: 7.6, APIs: 5, Instructions: 80fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004176C8
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,0000000C), ref: 004176F9
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000,?,?,?,?,0000000C), ref: 00417744
MapViewOfFile.KERNEL32(?,00000004,00000000,00000000,00000000,?,?,?,?,0000000C), ref: 00417760

Part of subcall function 00402DA0: CloseHandle.KERNELBASE(?,?,?,0040203F), ref: 00402DC5

Part of subcall function 00405700: CloseHandle.KERNELBASE(?,?,?,004056AF), ref: 00405725

GetFileSize.KERNEL32(000000FF,00000000,?,?,?,?,0000000C), ref: 004177A3

Part of subcall function 00417587: __EH_prolog3.LIBCMT ref: 00417591
Part of subcall function 00417587: GetWindowDC.USER32(00000000), ref: 0041766B
Part of subcall function 00417587: CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 00417684
Part of subcall function 00417587: ReleaseDC.USER32(00000000,00000000), ref: 00417695

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$Create$CloseH_prolog3Handle$BitmapMappingReleaseSizeViewWindow
String ID:
API String ID: 443554126-0
Opcode ID: 0950284efe3ef39c758bcbe41e7c9509bffc0024a37f29a51d4f9d01377f70c1
Instruction ID: d6a501d08fbc8584f845db54427adfb23f23d50c0d7ffacdafd32a1feefcce9b
Opcode Fuzzy Hash: 0950284efe3ef39c758bcbe41e7c9509bffc0024a37f29a51d4f9d01377f70c1
Instruction Fuzzy Hash: 68314C70805249EEDF11EBA4CD86AFEBF78AF11328F50416EE121761E1CA741F44DB69

Function 0045298B Relevance: 7.6, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00452995
EnterCriticalSection.KERNEL32(00000098,00453811,?,00000001), ref: 004529A5
_strncpy.LIBCMT ref: 004529CF
lstrlenA.KERNEL32(00000000), ref: 004529D8

Part of subcall function 00436D7B: __EH_prolog3.LIBCMT ref: 00436D82

Part of subcall function 00437244: __EH_prolog3.LIBCMT ref: 0043724B

LeaveCriticalSection.KERNEL32(004DB884,00000001,00000000,00000000,00000021), ref: 00452A7C

Part of subcall function 004523E9: WriteFile.KERNEL32(?,?,000000FF,000000FF,00000000), ref: 0045240E
Part of subcall function 004523E9: __CxxThrowException@8.LIBCMT ref: 0045242F

Part of subcall function 0045243C: WriteFile.KERNEL32(?,?,000000FF,000000FF,00000000), ref: 00452461
Part of subcall function 0045243C: __CxxThrowException@8.LIBCMT ref: 00452482

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CriticalException@8FileH_prolog3SectionThrowWrite$EnterH_prolog3_catch_Leave_strncpylstrlen
String ID:
API String ID: 2755541044-0
Opcode ID: 61a4c5fde1c8acbf96c8192c290b86eb41b3dbe8d1d2f48184cb423fcc476992
Instruction ID: e9bc57a9c06e6fcbc150cc448df632638eb6f589361ba9ca0d71e9b8e2c1bd7a
Opcode Fuzzy Hash: 61a4c5fde1c8acbf96c8192c290b86eb41b3dbe8d1d2f48184cb423fcc476992
Instruction Fuzzy Hash: 9721A771900348AEEB11EBA1DD81BDD7B789F16708F10405FF50567182DFB81B48DB5A

Function 004330BE Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004330E2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004330F2
GetTickCount.KERNEL32 ref: 004330F9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433118
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00433141

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CountTick
String ID:
API String ID: 404621862-0
Opcode ID: c832c5f1fd67f2eab1b8ddca8eed585c9592e88daf580b65873d9432f7a5f797
Instruction ID: 4ec1a4d300c7fc4630de0d0ba11e8a8226eca6445dc7b553e873fd9ea9bc397f
Opcode Fuzzy Hash: c832c5f1fd67f2eab1b8ddca8eed585c9592e88daf580b65873d9432f7a5f797
Instruction Fuzzy Hash: A3218C71200705AFDB248F29CC85B2B77B9EF48715F108A1EF5428B250D774E820CBA4

Function 0046B3C2 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0046B319

Part of subcall function 00475751: __mtinitlocknum.LIBCMT ref: 00475767
Part of subcall function 00475751: __amsg_exit.LIBCMT ref: 00475773
Part of subcall function 00475751: EnterCriticalSection.KERNEL32(0046D250,0046D250,?,00484094,00000004,004D2328,0000000C,0046EB68,00000001,0046D25F,00000000,00000000,00000000,?,0046D25F,00000001), ref: 0047577B

InterlockedDecrement.KERNEL32(00000000), ref: 0046B32B

Part of subcall function 00467AD0: __lock.LIBCMT ref: 00467AEE
Part of subcall function 00467AD0: ___sbh_find_block.LIBCMT ref: 00467AF9
Part of subcall function 00467AD0: ___sbh_free_block.LIBCMT ref: 00467B08
Part of subcall function 00467AD0: RtlFreeHeap.NTDLL(00000000,00000001,004D1D68,0000000C,00475732,00000000,004D2228,0000000C,0047576C,00000001,0046D250,?,00484094,00000004,004D2328,0000000C), ref: 00467B38
Part of subcall function 00467AD0: GetLastError.KERNEL32(?,00484094,00000004,004D2328,0000000C,0046EB68,00000001,0046D25F,00000000,00000000,00000000,?,0046D25F,00000001,00000214), ref: 00467B49

__lock.LIBCMT ref: 0046B359
___removelocaleref.LIBCMT ref: 0046B368
___freetlocinfo.LIBCMT ref: 0046B381

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: __lock$CriticalDecrementEnterErrorFreeHeapInterlockedLastSection___freetlocinfo___removelocaleref___sbh_find_block___sbh_free_block__amsg_exit__mtinitlocknum
String ID:
API String ID: 1907232653-0
Opcode ID: 638e23bb99914ab5bc783a68a4ecdf9bfb110a9d05790ed9b47d23fdf868dd0d
Instruction ID: 3a5be15a392bdfad7f6458927bd48d261d710d08b53d395ef95e1da5ae22cc49
Opcode Fuzzy Hash: 638e23bb99914ab5bc783a68a4ecdf9bfb110a9d05790ed9b47d23fdf868dd0d
Instruction Fuzzy Hash: 1C116A31601704DADB20AFA9948575E7394DF00768F20451FF898DA781EB7CD9C0969F

Function 0044152B Relevance: 7.6, APIs: 5, Instructions: 59stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,?,?,?), ref: 0044156F
_wcsrchr.LIBCMT ref: 0044157A
CharNextW.USER32(00000000,?,?), ref: 00441588
lstrcpyW.KERNEL32(?,?,?,?), ref: 004415A6
lstrcpyW.KERNEL32(?,00000000,?,?), ref: 004415AF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: lstrcpy$CharNext_wcsrchr
String ID:
API String ID: 2742890867-0
Opcode ID: 8fe15fa72f18a215b65bf28b6c109182350715e5726ef3b8fbbb6f853e002c72
Instruction ID: dc5d21f1ba701bc312db232bbbe993ed615656e163bff99789e649594017faef
Opcode Fuzzy Hash: 8fe15fa72f18a215b65bf28b6c109182350715e5726ef3b8fbbb6f853e002c72
Instruction Fuzzy Hash: 87113772910118EFDB51DFB4DC80A9E7BF8FB89300F1081ABE545D3250EE349E948B94

Function 0046F2B7 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0046F2C3

Part of subcall function 0046D2AD: __getptd_noexit.LIBCMT ref: 0046D2B0
Part of subcall function 0046D2AD: __amsg_exit.LIBCMT ref: 0046D2BD

__amsg_exit.LIBCMT ref: 0046F2E3
__lock.LIBCMT ref: 0046F2F3
InterlockedDecrement.KERNEL32(?), ref: 0046F310
InterlockedIncrement.KERNEL32(023E2CF0), ref: 0046F33B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 55bb82a4657c5e6778f24b2bf0982653f69f7270799cdfcd4e2b88c13933ea98
Instruction ID: e9087e8add79e138bf4552a35dd68b3a7a6a02ec1d05bc3d1dcf2b18b39f797e
Opcode Fuzzy Hash: 55bb82a4657c5e6778f24b2bf0982653f69f7270799cdfcd4e2b88c13933ea98
Instruction Fuzzy Hash: D201A1359026119BD711ABA9A85574E7760AB00718F15406BE840A7380E73CA985DFDF

Function 00459851 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00459858
GetLastError.KERNEL32(0000000C), ref: 0045985F
SetLastError.KERNEL32(?), ref: 004598B7
SetLastError.KERNEL32(?), ref: 004598C1
SetLastError.KERNEL32(?), ref: 004598D1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorLast$H_prolog3
String ID:
API String ID: 3502553090-0
Opcode ID: c9d0aeb7509ba0d583ca85c7bf870b0c14c29c7d76c6165dfbd4a11d8e95ad6d
Instruction ID: 45492d2c7dd13fe44a607d8ae01a4ca4b56d6e7ddf07ae9072be28e9d3b6ddee
Opcode Fuzzy Hash: c9d0aeb7509ba0d583ca85c7bf870b0c14c29c7d76c6165dfbd4a11d8e95ad6d
Instruction Fuzzy Hash: 25012934904606DFDF11AFA4C8859AE7BB1BB4A302F24447AF916D73A2DB389D048B59

Function 00432B9C Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00432BA4
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00432BB1
MulDiv.KERNEL32(?,00000000), ref: 00432BBB
ReleaseDC.USER32(?,00000000), ref: 00432BC9
CreateFontW.GDI32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,00000000,00000000,00000000,?), ref: 00432BE7

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CapsCreateDeviceFontRelease
String ID:
API String ID: 2367478762-0
Opcode ID: c42abbafe626f79bffdec87b9a36b35a06c54ffe4d0f202df53c8de64caa81bf
Instruction ID: 1d2282aed156dcd4f4b497358f09f038e344bce43223763a22509a525f6caeab
Opcode Fuzzy Hash: c42abbafe626f79bffdec87b9a36b35a06c54ffe4d0f202df53c8de64caa81bf
Instruction Fuzzy Hash: 22F074B2104119BFEB521FA1EC48DBF3F6DEB4A761B018024FE05C5060C7368D21ABB9

Function 0041CBC3 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 192COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041CBE5
__wcstoi64.LIBCMT ref: 0041CE03

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0041CC6B
UninstallString, xrefs: 0041CC58

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3__wcstoi64
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$UninstallString
API String ID: 1089274265-2644134543
Opcode ID: 25dbabbe5ae545c6e32c84dd24048ff7775e518d83d4c14ba3a1cff9a2a5160b
Instruction ID: b77ecb079b97e7df4c6003e7888fc7ac60604c3e6400ab34b92aae13a84c3e8e
Opcode Fuzzy Hash: 25dbabbe5ae545c6e32c84dd24048ff7775e518d83d4c14ba3a1cff9a2a5160b
Instruction Fuzzy Hash: 4D71C471D01248EFDB15EBA9CC45BDE7BB8AF11304F4444AEF406A7192EB785B08C7A6

Function 00452115 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045211F
SysAllocString.OLEAUT32(?), ref: 00452142
SysFreeString.OLEAUT32(?), ref: 004522D1

Strings

, xrefs: 004521C5

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: String$AllocFreeH_prolog3
String ID:
API String ID: 2967515224-410699589
Opcode ID: e20722dfb5614d864bb50b1e2f52648ddcff0141e0f2f4d098dc2721e1434b43
Instruction ID: dab902f2a1fb1b20ea871aad706b8980bb1a7c2764326df23ffa32c7faf60494
Opcode Fuzzy Hash: e20722dfb5614d864bb50b1e2f52648ddcff0141e0f2f4d098dc2721e1434b43
Instruction Fuzzy Hash: 0F51B4349002159BDF24DF95C5417AEB7B1AF46305F00809FF85577292CBBC5E4ACBA9

Function 0041166E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 153stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00411687

Part of subcall function 00410006: __EH_prolog3.LIBCMT ref: 0041000D

lstrcpyW.KERNEL32(00000000,-00000004,004AD218,004AD218,?,?,?,?,00000000,MsiVersion,0000004C), ref: 00411750
lstrcpyW.KERNEL32(?,-00000020), ref: 0041177D

Strings

MsiVersion, xrefs: 00411695

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3lstrcpy
String ID: MsiVersion
API String ID: 135781820-1669961159
Opcode ID: 3b1b26248a3d477d0fa72a2bc5c0a52c558af7299fd98c5b2100dcf6f7e2fbcb
Instruction ID: f4fe0e95da6400bc6f139440c717180db424939e5cc2226e51691dcb835f3760
Opcode Fuzzy Hash: 3b1b26248a3d477d0fa72a2bc5c0a52c558af7299fd98c5b2100dcf6f7e2fbcb
Instruction Fuzzy Hash: 0351627250014D9BDF04EFA5D981EEE77B8AF04304F10412BFA15A72D1EB39EA49CB59

Function 0045379C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004537A6
_vswprintf_s.LIBCMT ref: 00453845

Part of subcall function 00415B3A: _wcslen.LIBCMT ref: 00415B41

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0045298B: __EH_prolog3_catch_GS.LIBCMT ref: 00452995
Part of subcall function 0045298B: EnterCriticalSection.KERNEL32(00000098,00453811,?,00000001), ref: 004529A5
Part of subcall function 0045298B: _strncpy.LIBCMT ref: 004529CF
Part of subcall function 0045298B: lstrlenA.KERNEL32(00000000), ref: 004529D8
Part of subcall function 0045298B: LeaveCriticalSection.KERNEL32(004DB884,00000001,00000000,00000000,00000021), ref: 00452A7C

Strings

%ls|%ls|, xrefs: 004537EC
PHK, xrefs: 00453899

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CriticalH_prolog3_catch_Section$EnterH_prolog3Leave_strncpy_vswprintf_s_wcslenlstrlen
String ID: %ls|%ls|$PHK
API String ID: 3587775356-2083918828
Opcode ID: af768dbe1bc03d926f3443c6f38a0af44ff4ee5dcde46bb4a79bfc9c72ebf947
Instruction ID: 6fdc3b0cd7b11a9b96be51f504e8602095ec3831471fa78c948d09555a4224fc
Opcode Fuzzy Hash: af768dbe1bc03d926f3443c6f38a0af44ff4ee5dcde46bb4a79bfc9c72ebf947
Instruction Fuzzy Hash: E2517FB1800148ABDB05EBA1CD92FDD777CAF15304F4440AEF606B3192EB786B49CB69

Function 0043A0E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043A0FF
_memset.LIBCMT ref: 0043A152

Strings

Setup.bmp, xrefs: 0043A197, 0043A1F8
C:\Users\user\Desktop, xrefs: 0043A1FD

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_memset
String ID: C:\Users\user\Desktop$Setup.bmp
API String ID: 2828583354-820595544
Opcode ID: 63235e68d16c07e1125747e9e51b61aa2a5adc587a8289b8943947b6675b3c58
Instruction ID: 3b15bdadca4b9175c3ec3fe4f6783945729f9d1ab385b9b777b11be48630bd0d
Opcode Fuzzy Hash: 63235e68d16c07e1125747e9e51b61aa2a5adc587a8289b8943947b6675b3c58
Instruction Fuzzy Hash: 0F41E770A402086BDF10EFA589527FF77A8AF09304F04412FA955972D1EB789E15C796

Function 00430E0C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00430E25

Part of subcall function 004229A9: __EH_prolog3.LIBCMT ref: 004229B0

Part of subcall function 00410C1B: __EH_prolog3.LIBCMT ref: 00410C22

Part of subcall function 00423B22: __EH_prolog3.LIBCMT ref: 00423B29

Strings

MSINEWINSTANCE=1, xrefs: 00430E70
:InstanceId%d.mst, xrefs: 00430EB7
/n %s, xrefs: 00430F29

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: /n %s$:InstanceId%d.mst$MSINEWINSTANCE=1
API String ID: 431132790-3737453586
Opcode ID: 762426a09e78689a9cf8faf9271356e0a642ac25940afcc902ffc16f80801de0
Instruction ID: 3f99174eeaf73d20935ef19ddf22c298ce52bfd9780ec6fff2517756a71d8de2
Opcode Fuzzy Hash: 762426a09e78689a9cf8faf9271356e0a642ac25940afcc902ffc16f80801de0
Instruction Fuzzy Hash: D3419F71900148EFCB15EFA1D992EEE77B8AF14304F50416FF90697192EB78AB08CB59

Function 004249D2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004249EB

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 00423082: __EH_prolog3.LIBCMT ref: 00423089

Part of subcall function 0040B2F1: __EH_prolog3.LIBCMT ref: 0040B2F8

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000000,00000400,?,?,00000000,00000000,ISSetup.dll,?,00000001,00000068), ref: 00424A74

Part of subcall function 0040B14B: __EH_prolog3.LIBCMT ref: 0040B152
Part of subcall function 0040B14B: GetLastError.KERNEL32(00000038,0040C732), ref: 0040B159
Part of subcall function 0040B14B: SetLastError.KERNEL32(00000000), ref: 0040B1A3

Part of subcall function 0040A7C0: __EH_prolog3.LIBCMT ref: 0040A7D9

Part of subcall function 0040AE09: __EH_prolog3.LIBCMT ref: 0040AE10
Part of subcall function 0040AE09: SetLastError.KERNEL32(?,?,00000000,00000004,0040B187,?,?,00000001), ref: 0040AE74

Part of subcall function 00415EC8: __EH_prolog3_GS.LIBCMT ref: 00415ECF

Strings

ISSetup.dll, xrefs: 00424AB2
ISSetup.dll, xrefs: 004249FD

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ErrorLast$String$AllocFileH_prolog3_ModuleName
String ID: ISSetup.dll$ISSetup.dll
API String ID: 209049337-1816852773
Opcode ID: 43e22d4836dadc71f5b65aa4dd0383166a2a53e4c6cf8bb1408aedbc2e62a03a
Instruction ID: 8cee35fbbe4e7c1c47375a366374028d2770fe52e445aee45f11b7ff2c615c43
Opcode Fuzzy Hash: 43e22d4836dadc71f5b65aa4dd0383166a2a53e4c6cf8bb1408aedbc2e62a03a
Instruction Fuzzy Hash: 5D419071900248EBDB01EFA5CC56ADE7BB8EF15344F04416EF802A71D2DB785B09CB99

Function 0044E83D Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044E84B

Strings

CLSID\{, xrefs: 0044E8D5
InprocServer32, xrefs: 0044E876, 0044E888
LocalServer32, xrefs: 0044E87D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: CLSID\{$InprocServer32$LocalServer32
API String ID: 431132790-2428679467
Opcode ID: 7ebcf9b6f3c4b66a1034f7c4f293a8711bffad31be8d75f7b2c804e327d027c4
Instruction ID: b38b6553f43c3bb62b217e2fa9a11c86093ad95fd7df252100713f116b9ba740
Opcode Fuzzy Hash: 7ebcf9b6f3c4b66a1034f7c4f293a8711bffad31be8d75f7b2c804e327d027c4
Instruction Fuzzy Hash: 0131C971910248AFDB04EFA5CC42BDD77A8AF15344F44406FF905A31C2EBB99B08CB6A

Function 00422737 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00422756

Strings

C:\Users\user\Desktop, xrefs: 004227EF
dotnetredist.exe, xrefs: 00422774

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: C:\Users\user\Desktop$dotnetredist.exe
API String ID: 431132790-607027747
Opcode ID: ff26e5a0bf0ea49cc064436faa7b8d5cd1056657476915292851ac47684a7aa8
Instruction ID: 94a6f84164e54739f8bfe7180d5db891950388c478f0de9a2aa0ad65b9ce1f3f
Opcode Fuzzy Hash: ff26e5a0bf0ea49cc064436faa7b8d5cd1056657476915292851ac47684a7aa8
Instruction Fuzzy Hash: C4319471A01158ABDF20EFA5D946BED77A8EF14304F50402BF905A7181EB789B09CB59

Function 00438679 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004386C9

Part of subcall function 0040F5AC: __EH_prolog3.LIBCMT ref: 0040F5B3

wsprintfW.USER32 ref: 00438749

Strings

%s/%s, xrefs: 00438743
Location, xrefs: 00438704

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_memsetwsprintf
String ID: %s/%s$Location
API String ID: 3789294381-42320356
Opcode ID: 987d5d409b794d1a3af2f1c7f6454fd670b8ddfdb5b539522ce1ad2095f3a203
Instruction ID: 5b33697772bba50757abeec7019ebe713a723d344552e02fb4e9f4678f4ff9cd
Opcode Fuzzy Hash: 987d5d409b794d1a3af2f1c7f6454fd670b8ddfdb5b539522ce1ad2095f3a203
Instruction Fuzzy Hash: AC214472900118ABD714DB55CC41FEAB3BCFB48714F1446ABB516E2191DB78AA448F98

Function 0041CECE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041CEED

Part of subcall function 0040DB19: __EH_prolog3.LIBCMT ref: 0040DB20

Part of subcall function 00413011: __EH_prolog3.LIBCMT ref: 00413033

lstrcpyW.KERNEL32(00000000,00000000,00000452,?,0000000C), ref: 0041CF43

Strings

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI, xrefs: 0041CF61
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 0041CF30

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$lstrcpy
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI
API String ID: 3886590098-1156657366
Opcode ID: bab74a3351a0e5e8281d4187a52863e152883269c7e1c782269344f8401205c4
Instruction ID: 35c6189975533b4b35679ce2bd2f255230671e12285fe8b2a37433cff69c8fea
Opcode Fuzzy Hash: bab74a3351a0e5e8281d4187a52863e152883269c7e1c782269344f8401205c4
Instruction Fuzzy Hash: C521F031A402089BDB14EBA5DC46AEE77B6AB44304F00012FE516D72C1DF7CAE46C78D

Function 004377B6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004377C0
lstrcpyW.KERNEL32(?,?,?,00000240,0043822A,00000000,?,00000000,00000001,004130AD,00000000,00000001,0000044F,00000000,000000B4), ref: 004377E6
lstrcpyW.KERNEL32(?,?,?,00000240,0043822A,00000000,?,00000000,00000001,004130AD,00000000,00000001,0000044F,00000000,000000B4), ref: 00437843

Strings

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI, xrefs: 00437865

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: lstrcpy$H_prolog3_
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI
API String ID: 3091677954-3978022597
Opcode ID: aaeefdaec7bd1e9c7ff2c70d0079e35dae5ff348abb11b3a31141293870da612
Instruction ID: db5383d3501441d0d0115b77943e5b12787534e58808b53175830ecb3a2bf31a
Opcode Fuzzy Hash: aaeefdaec7bd1e9c7ff2c70d0079e35dae5ff348abb11b3a31141293870da612
Instruction Fuzzy Hash: 7E11B6B1804200EBD724E7A5CC88FEB7779AB89305F10445FF046E2151CB38A946CB6D

Function 0043A26E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043A275

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\session.cpp, xrefs: 0043A294
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 0043A300
Extracting setup.ini..., xrefs: 0043A2AA

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\session.cpp$Extracting setup.ini...
API String ID: 431132790-1959723956
Opcode ID: 680e42395988722506865053fa67809a47c6959c919a9638e5ac4eb52d74d8a8
Instruction ID: 9e169826426121cab3dfe45699dc9e74d80b66bc0255f4c63da94e1bc1014236
Opcode Fuzzy Hash: 680e42395988722506865053fa67809a47c6959c919a9638e5ac4eb52d74d8a8
Instruction Fuzzy Hash: 291182709442486AEF10FBA08D92FEF77698B05744F50016FB141A72E2EAAD5F44C769

Function 0041579F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004157A6

Part of subcall function 0041569C: __EH_prolog3.LIBCMT ref: 004156A3
Part of subcall function 0041569C: SysStringLen.OLEAUT32(?), ref: 004156D9

SysStringLen.OLEAUT32(?), ref: 004157C9

Part of subcall function 004143F9: __EH_prolog3.LIBCMT ref: 00414400

Part of subcall function 00414905: SysStringLen.OLEAUT32(?), ref: 00414914

SysStringLen.OLEAUT32(00000000), ref: 00415812

Strings

., xrefs: 004157E3

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: String$H_prolog3
String ID: .
API String ID: 49034381-248832578
Opcode ID: 50305e6bc173b9256d179bb1272c95914afc10af99b44180476404779519afb6
Instruction ID: 5b74ce2900ba9c429adff12e5a69ac7e3d2d7be247ac8e30df05ec2106764fbb
Opcode Fuzzy Hash: 50305e6bc173b9256d179bb1272c95914afc10af99b44180476404779519afb6
Instruction Fuzzy Hash: CA115170404118EBDF00EFA5CC45BEE7BA8AF85324F10421AB425A21D1CB784A44CBA5

Function 0043884F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043887B

Part of subcall function 00409EC2: __EH_prolog3_GS.LIBCMT ref: 00409EC9

lstrlenW.KERNEL32(?,Startup,ClickOncePackage,004BDF40,?,00000400), ref: 004388AD

Strings

ClickOncePackage, xrefs: 00438894
Startup, xrefs: 00438899

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3__memsetlstrlen
String ID: ClickOncePackage$Startup
API String ID: 1437836783-2858441910
Opcode ID: cffeb6c76ad905816673a976e3c7dae17812d5210d389612ede15db2aea53ce2
Instruction ID: 035616e2f58cb1d6c030c2b0f6f83c3fc700598a5cee0a52936b8ed18869d1bd
Opcode Fuzzy Hash: cffeb6c76ad905816673a976e3c7dae17812d5210d389612ede15db2aea53ce2
Instruction Fuzzy Hash: 9201FE61A402086AC750E775DC42BE6B3F8AF08704F4054FBB646E2181EE78DD4D8B98

Function 00442DE8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00442DF2

Part of subcall function 00416366: __EH_prolog3.LIBCMT ref: 00416388

wsprintfW.USER32 ref: 00442E35
wvsprintfW.USER32(?,?,?), ref: 00442E50

Strings

%d: %s, xrefs: 00442E2F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_wsprintfwvsprintf
String ID: %d: %s
API String ID: 2943008357-204819183
Opcode ID: 64bc086292f025c2efbc8e93d119697233d2926f17b56102430cdcb4b4ac2a6f
Instruction ID: 3bd6ddbad95679c73c4bf73732ee6be8f6015787e7e121dd41633645ddf5e89e
Opcode Fuzzy Hash: 64bc086292f025c2efbc8e93d119697233d2926f17b56102430cdcb4b4ac2a6f
Instruction Fuzzy Hash: 71014CB190011DEBDF64DBA0CD85EED777CAB05318F4041AAF609A7091DB389B858F6D

Function 00474F11 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00466C8E), ref: 00474F16
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00474F26

Strings

IsProcessorFeaturePresent, xrefs: 00474F20
KERNEL32, xrefs: 00474F11

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 9d9556ca5b9d29b6aa4b7e53347206d4bd33ce6e13780df553ff32d56d8749a1
Instruction ID: 202a812aec2a2d8ed5026019c1aa376bce34032a061f3fa62530c59e95ac3078
Opcode Fuzzy Hash: 9d9556ca5b9d29b6aa4b7e53347206d4bd33ce6e13780df553ff32d56d8749a1
Instruction Fuzzy Hash: E7F03030A10A0AD2EB401FB5AD4E7BFBF79BBC1745F924591D195B0094DF3480B1865A

Function 00444EA6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.lib,IsTextUnicode), ref: 00444EB9
GetProcAddress.KERNEL32(00000000), ref: 00444EC0

Strings

Advapi32.lib, xrefs: 00444EB4
IsTextUnicode, xrefs: 00444EAF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.lib$IsTextUnicode
API String ID: 1646373207-3723215607
Opcode ID: 76eb9e0c93847cf39c4b1fcee542433b51b77176ae87fdd30515ca2bdecda49b
Instruction ID: 65f4baee6d2185ee2ca588f06b9a453e4d1d3fbfbe16eb5eacfefee86a44d8b2
Opcode Fuzzy Hash: 76eb9e0c93847cf39c4b1fcee542433b51b77176ae87fdd30515ca2bdecda49b
Instruction Fuzzy Hash: A9E06D712043626BBA609F65AC05A9BA794BB86701B38882BB05092150CB39C9959BA9

Function 00444B33 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,GetDiskFreeSpaceExW), ref: 00444B3D
GetProcAddress.KERNEL32(00000000), ref: 00444B44

Strings

Kernel32, xrefs: 00444B38
GetDiskFreeSpaceExW, xrefs: 00444B33

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$Kernel32
API String ID: 1646373207-300760764
Opcode ID: fe0316ecade9b38c4a5609631c781ea0de6c56e3fa8d369071870f377e04c283
Instruction ID: d71bd8c409afcbffbf6c3215513627a3452755c57b41770e47823f00caf48f8c
Opcode Fuzzy Hash: fe0316ecade9b38c4a5609631c781ea0de6c56e3fa8d369071870f377e04c283
Instruction Fuzzy Hash: CFD09EB1655342ABDF419FB09C49E1A7AA5FBC5742F084C2DB16080061CB69C414AF1A

Function 00444CCD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetProcessId,00450DD7,?), ref: 00444CD7
GetProcAddress.KERNEL32(00000000), ref: 00444CDE

Strings

kernel32.dll, xrefs: 00444CD2
GetProcessId, xrefs: 00444CCD

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetProcessId$kernel32.dll
API String ID: 1646373207-399901964
Opcode ID: 83d49360107ebb6a972f716aeeee4e334af5482661dddd28571c82c87db6c09a
Instruction ID: 5fa26ac7840e5713ed8018deef6bdcc116ad9a1f9ca3e5a189a6092e253ee584
Opcode Fuzzy Hash: 83d49360107ebb6a972f716aeeee4e334af5482661dddd28571c82c87db6c09a
Instruction Fuzzy Hash: 11C040F0341600B7EA401F75DD99A467A945AC5743B1584657015D0455DF7DD500BE29

Function 00444CF2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetProcessId), ref: 00444CFC
GetProcAddress.KERNEL32(00000000), ref: 00444D03

Strings

kernel32.dll, xrefs: 00444CF7
GetProcessId, xrefs: 00444CF2

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetProcessId$kernel32.dll
API String ID: 1646373207-399901964
Opcode ID: a3baa0c9aaba26d38b934e55206cddea1ea5e51f995c999b71ee74ec05b41e33
Instruction ID: 1f2e7bc7ce47b1c4a3da30cb2936b50f69b6723e7fd7e9d75f74aa5e18b31726
Opcode Fuzzy Hash: a3baa0c9aaba26d38b934e55206cddea1ea5e51f995c999b71ee74ec05b41e33
Instruction Fuzzy Hash: EEB092F03D1216A69A401FB5DCAED947AA4964BB0372186A27002C14D2DE6851045E28

Function 00420CA7 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00420CE4
char_traits.LIBCPMTD ref: 00420D50
char_traits.LIBCPMTD ref: 00420D8F
char_traits.LIBCPMTD ref: 00420DBF

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: char_traits$String_base::_Xlenstd::_
String ID:
API String ID: 1810552321-0
Opcode ID: 8cd605e2aa360fb64d55814a73adfd4076ae572ce8410b1f97177eb5f3c4bd08
Instruction ID: b0723ee1d008018a5123ecd37dc2ec27bdadffa1e019edcde7830e335d572ceb
Opcode Fuzzy Hash: 8cd605e2aa360fb64d55814a73adfd4076ae572ce8410b1f97177eb5f3c4bd08
Instruction Fuzzy Hash: 6A417931211119AFCB18CF98EAC0AAE77F6EF81304B50455AF8019B252DB38FD51CBA9

Function 0044AD8E Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

FindResourceExW.KERNEL32(?,00000006,?,?,?,?,?,?,?,0041657A,?,?,?,?,?,00000001), ref: 0044ADB2
FindResourceExW.KERNEL32(?,00000006,?,?,00000001,?,?,?,?,0041657A,?,?,?,?,?,00000001), ref: 0044ADED
FindResourceExW.KERNEL32(?,00000006,?,00000400,?,?,?,?,0041657A,?,?,?,?,?,00000001), ref: 0044AE14
FindResourceExW.KERNEL32(?,00000006,?,00000000,?,?,?,?,0041657A,?,?,?,?,?,00000001), ref: 0044AE3C

Part of subcall function 00449BF0: __EH_prolog3.LIBCMT ref: 00449BF7
Part of subcall function 00449BF0: LoadResource.KERNEL32(?,?,00000034,0044AE55,?,00000001,?,?,?,?,?,?,0041657A,?,?,?), ref: 00449C0A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Resource$Find$H_prolog3Load
String ID:
API String ID: 1139805790-0
Opcode ID: 8cc83fea293158254f1bf90a927b03e586b4b8646a7cf16547043d6a8474c108
Instruction ID: c2d7d5165d3d03bae8efeab3d691ff8b53d5cf78db98652bcad8dba3bf12598b
Opcode Fuzzy Hash: 8cc83fea293158254f1bf90a927b03e586b4b8646a7cf16547043d6a8474c108
Instruction Fuzzy Hash: F221CC7184020EBAFF119F95DC40EEF3BBDEF45348F104056FA10A2211E636DE22AB65

Function 004608E6 Relevance: 6.1, APIs: 4, Instructions: 81fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00460903
GetFileSize.KERNEL32(00000000,00000000), ref: 0046091B
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 0046093A
CloseHandle.KERNEL32(?), ref: 00460948

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: bdc5749dab860124b2c3d43bf4dbf351e398c5269c048df979c58c61a5dcff41
Instruction ID: 252a7f472d5ba454f67ff15e5da49dd78468c662fbe259f503787c021471c057
Opcode Fuzzy Hash: bdc5749dab860124b2c3d43bf4dbf351e398c5269c048df979c58c61a5dcff41
Instruction Fuzzy Hash: EF219671200204BEEB146772DC4AF6F3A6EEB81754F10452FFD42D6183EE789A0586AE

Function 00414637 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 004142A0: GetVersionExW.KERNEL32(?), ref: 004142CD

CompareStringW.KERNEL32(00000400,00000000,?,?,?,?), ref: 00414664
__alloca_probe_16.LIBCMT ref: 0041467C
__alloca_probe_16.LIBCMT ref: 0041469D
CompareStringA.KERNEL32(00000400,00000001,00000000,?,00000000,?), ref: 004146BA

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CompareString__alloca_probe_16$Version
String ID:
API String ID: 947746289-0
Opcode ID: e960ccd012d461353088ad6fce823e054a9f10a5809fd9ccbc25fb123a2bbacf
Instruction ID: 42a6b1c2f83d2e4292e36c6be5e1813ec4d83413da874f3bc6195b8dc9e29d6e
Opcode Fuzzy Hash: e960ccd012d461353088ad6fce823e054a9f10a5809fd9ccbc25fb123a2bbacf
Instruction Fuzzy Hash: EA117371600208FBCF10AFA69C49DEF3F69EF86358F40441AFA0996141D679D990DBA9

Function 0041C806 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041C80D
SetLastError.KERNEL32(?,?,00000004,0041C95D,?,00000000,?,00000001,?,?,?,?,?,?,004ACBC0,?), ref: 0041C85E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,?,004ACBC0,?,00000000), ref: 0041C87E
SetLastError.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,004ACBC0,?,00000000), ref: 0041C8B9

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorLast$ByteCharH_prolog3MultiWide
String ID:
API String ID: 783719552-0
Opcode ID: 0b295b04b7a1d1d107ddc6d5f2d8d1b4142d29f897c82d4e94a77ebf687b843d
Instruction ID: 5e9e4ae79cc576441eb3718ce82232d83f933131422285e2108f5474e48d91ef
Opcode Fuzzy Hash: 0b295b04b7a1d1d107ddc6d5f2d8d1b4142d29f897c82d4e94a77ebf687b843d
Instruction Fuzzy Hash: CD217F70900208EFCF11EF19CC8999ABFF0FF86704B10855EF4465B261D7759A50DB99

Function 0041C8CD Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041C8D4
SetLastError.KERNEL32(?,?,00000004,0043A62C,no_engine,?,00000001,?,?,00000001,?,?,00000000,0000000A), ref: 0041C929
_strlen.LIBCMT ref: 0041C942
SetLastError.KERNEL32(?,?,?,?,?,?,?,004ACBC0,?,00000000), ref: 0041C96A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ErrorLast$H_prolog3_strlen
String ID:
API String ID: 2695463197-0
Opcode ID: daf579aa74c5d19273169e28c69f27431d246849dcfb0eb71cd8cced5e4d5fa4
Instruction ID: 16b2f532305c2017c9fbb566a97b74f45ca7564d32334522de6231f262642300
Opcode Fuzzy Hash: daf579aa74c5d19273169e28c69f27431d246849dcfb0eb71cd8cced5e4d5fa4
Instruction Fuzzy Hash: AD21AF70900244EFCB11EF29CD81A9EBFE0FF55704F10815EF4959B261D7B99A40DB89

Function 00474DDC Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00474E02

Part of subcall function 00474BEA: __fltout2.LIBCMT ref: 00474C16

__cftog_l.LIBCMT ref: 00474E28
__cftoe_l.LIBCMT ref: 00474E5A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: afc8384d7de5dc81d749eb2ef2e502e72940c946d5071aaa17129bf9d5fb4602
Instruction ID: e3aabb194c4ac344b18b11b946baef2fa4d2b3a0789dcb8e7629d22c8f4952e5
Opcode Fuzzy Hash: afc8384d7de5dc81d749eb2ef2e502e72940c946d5071aaa17129bf9d5fb4602
Instruction Fuzzy Hash: 8511923600014EBBCF166E84DC45CEE3F67BB89364F198516FA2C59131C33AC9B1AB85

Function 00432625 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00432641
GetDlgItem.USER32(00000000), ref: 00432654

Part of subcall function 0043251C: SendMessageW.USER32(?,0000101E,00000000,000000FE), ref: 004325E3
Part of subcall function 0043251C: SendMessageW.USER32(?,00001036,00000000,00000020), ref: 004325FA
Part of subcall function 0043251C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00432606

EnableWindow.USER32(00000000,00000000), ref: 0043266E
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 0043268F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: MessageSend$Item$EnableWindow
String ID:
API String ID: 1570322866-0
Opcode ID: f63b18c5fefe8d24a4b0e3ba4500f96d3bdaa15dfecc659699188b88b3e35109
Instruction ID: d84f69b795613c2151ceff4e9fe06741827e98de09ebbd9c231d0afcf43f4823
Opcode Fuzzy Hash: f63b18c5fefe8d24a4b0e3ba4500f96d3bdaa15dfecc659699188b88b3e35109
Instruction Fuzzy Hash: AE018F71500249FFEF118F60DC59BAF3FA9EB49324F044427F80196261CBB99E50DBA8

Function 004321A7 Relevance: 6.0, APIs: 4, Instructions: 44windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000000), ref: 004321C7
SendMessageW.USER32(00000000,0000100C,000000FF,00000002), ref: 004321DF
_memset.LIBCMT ref: 004321F0
SendMessageW.USER32(00000000,0000104B,00000000,?), ref: 0043220E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: MessageSend$Item_memset
String ID:
API String ID: 105786929-0
Opcode ID: 8b323fc2295d49bf99ea07c3b154b0e5b38f445a121ded485d2cdb7cfdc4c7ed
Instruction ID: a6b92658d169c82fa02c75acca41253f985e209fa5cad1cea78567ccceed4c49
Opcode Fuzzy Hash: 8b323fc2295d49bf99ea07c3b154b0e5b38f445a121ded485d2cdb7cfdc4c7ed
Instruction Fuzzy Hash: C7016775940208BBD7109F99EC85FDE7FB8A70C720F104123F614A71D1D6B498448FA8

Function 004596D9 Relevance: 6.0, APIs: 4, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00459716
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,?,000004FF), ref: 0045972B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: MessageMultipleObjectsPeekWait
String ID:
API String ID: 3986374578-0
Opcode ID: cf9202b1986114ebf292d62f81756fe8b1c212a181514a0b8a502c670f6add00
Instruction ID: afef5a3a98f58999221a7ba8402c03282a37788fc93e00c132cbf2217a32659d
Opcode Fuzzy Hash: cf9202b1986114ebf292d62f81756fe8b1c212a181514a0b8a502c670f6add00
Instruction Fuzzy Hash: 60F0EC7290010ABFDB409FD8DCC4DAB7BACEB49759F008036FA15D7151D674DD098BA8

Function 004417C4 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,00000000,00441BF9,?,00441D4A,?,?,?,?,00441DA7,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}), ref: 004417D7
CharNextW.USER32(?,?,00000000,00441BF9,?,00441D4A,?,?,?,?,00441DA7,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}), ref: 00441800
CharNextW.USER32(00000000,?,?,?,00441DA7,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 00441809
CharNextW.USER32(00000000,?,?,?,00441DA7,?,?,0040C9D9,?,C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E},_ISMSIDEL.INI,?,?,?), ref: 0044180E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: a5ff57b0e8948730ac9806ce2039053dfdc162de59f2a4698f5e029d3d8cc03a
Instruction ID: e22a8596c07b20efd7c89ee4224fe54893a22345d509e93d4b80a9426af1b36c
Opcode Fuzzy Hash: a5ff57b0e8948730ac9806ce2039053dfdc162de59f2a4698f5e029d3d8cc03a
Instruction Fuzzy Hash: 0FF0822AD1011298BB2237648C804BBABF9EBAA721B55C437D44083274E7BC4CC383BD

Function 00417802 Relevance: 6.0, APIs: 4, Instructions: 38windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00417809
CreateCompatibleDC.GDI32(?), ref: 0041781B
SelectObject.GDI32(00000000), ref: 0041782F
BitBlt.GDI32(?,?,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00417862

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CompatibleCreateH_prolog3ObjectSelect
String ID:
API String ID: 419599525-0
Opcode ID: 9a7021490a85b427ef1a5df8ae48897c1dcdfbb5654c689e34b95af17399a469
Instruction ID: 3ea0ecc3aa191496ae1469ec6367b82925c4cd53ac6291482b287e80747ded89
Opcode Fuzzy Hash: 9a7021490a85b427ef1a5df8ae48897c1dcdfbb5654c689e34b95af17399a469
Instruction Fuzzy Hash: 3C011631900109EBDF10EFA0DC46BEE7BB2FF15325F104619F622661E0CB759990DB58

Function 004381DA Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,?,00000000,00000001,004130AD,00000000,00000001,0000044F,00000000,000000B4), ref: 004381E4
lstrcpyW.KERNEL32(00000000,00000000,?,00000000,00000001,004130AD,00000000,00000001,0000044F,00000000,000000B4), ref: 0043820F
lstrcpyW.KERNEL32(C:\Users\user\Desktop,00000000,?,00000000,00000001,004130AD,00000000,00000001,0000044F,00000000,000000B4), ref: 00438217

Part of subcall function 004377B6: __EH_prolog3_GS.LIBCMT ref: 004377C0
Part of subcall function 004377B6: lstrcpyW.KERNEL32(?,?,?,00000240,0043822A,00000000,?,00000000,00000001,004130AD,00000000,00000001,0000044F,00000000,000000B4), ref: 004377E6

Strings

C:\Users\user\Desktop, xrefs: 00438212

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: lstrcpy$H_prolog3_lstrlen
String ID: C:\Users\user\Desktop
API String ID: 1319355046-224404859
Opcode ID: cf4b69ab99c099951626fb5915624ba486f08075261242df60d60a591c8c8a5c
Instruction ID: 41658410cb97767675ec6b0761c8d718495b28051751ff276f7cc05e6f552091
Opcode Fuzzy Hash: cf4b69ab99c099951626fb5915624ba486f08075261242df60d60a591c8c8a5c
Instruction Fuzzy Hash: 11F065F36012047EE664A7B5AC8AF6BAA9CEBC9364F11446FF146C2191DF7858414638

Function 004767D8 Relevance: 6.0, APIs: 4, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?), ref: 00476806
HeapFree.KERNEL32(00000000,?), ref: 00476816
HeapFree.KERNEL32(00000000), ref: 00476833
HeapDestroy.KERNEL32 ref: 0047683D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: FreeHeap$DestroyVirtual
String ID:
API String ID: 765507482-0
Opcode ID: 340736a48f8b069b8080dcb5070d6a37068bca2f99bc57ed85f84e527e4bcb18
Instruction ID: ba88d4d37a148394ee44605363603367d9c4d138119f3ab37576bba2fad17c53
Opcode Fuzzy Hash: 340736a48f8b069b8080dcb5070d6a37068bca2f99bc57ed85f84e527e4bcb18
Instruction Fuzzy Hash: 36F0673A982210AFEB516FD4FDC5B853BA1EB84765F2280B7EA00660B1D2722851CF5C

Function 0041E8F6 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00436014), ref: 0041E8FC
GetDlgItem.USER32(0000012D,75C0BF70), ref: 0041E919
SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 0041E931
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 0041E949

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: MessageSend$ItemWindow
String ID:
API String ID: 591194657-0
Opcode ID: cf8a6d5b7b191159e1feea064343201491fe9307a8bd621fa05969bb16522bc5
Instruction ID: 700829dd75d742c0b3ecd9f6347ed1f4f1ccb61bd95b5f8eedc56a5726f24149
Opcode Fuzzy Hash: cf8a6d5b7b191159e1feea064343201491fe9307a8bd621fa05969bb16522bc5
Instruction Fuzzy Hash: D0E0E5F52001247FE6401B22EDC5DBB2F5CEB86BA5B04003AFA01E61A0CA645C41D67C

Function 0046B1CD Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0046B1D9

Part of subcall function 0046D2AD: __getptd_noexit.LIBCMT ref: 0046D2B0
Part of subcall function 0046D2AD: __amsg_exit.LIBCMT ref: 0046D2BD

__getptd.LIBCMT ref: 0046B1F0
__amsg_exit.LIBCMT ref: 0046B1FE
__lock.LIBCMT ref: 0046B20E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 55c461e43faaee163950f15bbd54108cf43441a799a5e65bb4d450776027e6df
Instruction ID: 058a32980b00d74001c4d7d2652ce5e0b848db9ecf7bea5a0f3786f6db0f0ceb
Opcode Fuzzy Hash: 55c461e43faaee163950f15bbd54108cf43441a799a5e65bb4d450776027e6df
Instruction Fuzzy Hash: 91F06271D017009BD710BBA68416B8D33E0EB01B28F14419FE461D7291EB3C99418B9B

Function 00450935 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00450957

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0044CEF2: __EH_prolog3_GS.LIBCMT ref: 0044CEFC

Strings

*.*, xrefs: 00450C34

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID: *.*
API String ID: 4240126716-438819550
Opcode ID: 62afe0c1f8023252c41ff4b7e7fc247afa5340d4b148d007e2f4ba03a0488f49
Instruction ID: 263114ca5a2493b19456fe4d634b156a700260bf6a41ebce5aafbd847229a217
Opcode Fuzzy Hash: 62afe0c1f8023252c41ff4b7e7fc247afa5340d4b148d007e2f4ba03a0488f49
Instruction Fuzzy Hash: 05C1707140024CEBDF15EFA5CD92AED3B78AF15318F54002FFC066A192EB399A49CB55

Function 0044C0FC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044C103

Part of subcall function 00408C7C: __EH_prolog3.LIBCMT ref: 00408C83

__CxxThrowException@8.LIBCMT ref: 0044C141

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

invalid map/set<T> iterator, xrefs: 0044C114

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: 576e35a583d546c75457558709b4edd9887baa97c3454a020cdfc3d5f73d459a
Instruction ID: e951911a7bbff78a2ea461e35d1914cc9d439a682ee666208f582deb41bd2ea6
Opcode Fuzzy Hash: 576e35a583d546c75457558709b4edd9887baa97c3454a020cdfc3d5f73d459a
Instruction Fuzzy Hash: EBA19F709052809FEB65DF58C4C4B66BBA2BF15308F28808ED5454F363D7BAEC85CB59

Function 0044A3B1 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044A3B8

Part of subcall function 00408C7C: __EH_prolog3.LIBCMT ref: 00408C83

__CxxThrowException@8.LIBCMT ref: 0044A3F6

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

invalid map/set<T> iterator, xrefs: 0044A3C9

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: 5a9ff3eba934ef54666e635cdb7bcf024fd93a89e3f71f175d3dc17bfe78e1b9
Instruction ID: 1a616fc9b85a3bb112223f7fe7f9658881061d812a2a1180e4706eeac2baf36c
Opcode Fuzzy Hash: 5a9ff3eba934ef54666e635cdb7bcf024fd93a89e3f71f175d3dc17bfe78e1b9
Instruction Fuzzy Hash: 74A1A3705442809FEB21DF14C188B6ABFE1AF55308F18848ED1894F393D7BAEC96CB56

Function 00410299 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004102A0

Part of subcall function 00408D26: __EH_prolog3.LIBCMT ref: 00408D2D

__CxxThrowException@8.LIBCMT ref: 004102D7

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

invalid map/set<T> iterator, xrefs: 004102B1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: 900e81a8f7a2a4b38bc7bb9bedf42890c2a053f4f70552935bbacd5a82791b4a
Instruction ID: 1838696f968eea3267071048323732a692a847b6b5c029f88874d5377a531503
Opcode Fuzzy Hash: 900e81a8f7a2a4b38bc7bb9bedf42890c2a053f4f70552935bbacd5a82791b4a
Instruction Fuzzy Hash: C7A19D70504284DFDB25CF54C184BAABBE1AF15308F28849ED5594F392D7BAECC6CB54

Function 00431066 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043106D

Part of subcall function 00408D26: __EH_prolog3.LIBCMT ref: 00408D2D

__CxxThrowException@8.LIBCMT ref: 004310A4

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

invalid map/set<T> iterator, xrefs: 0043107E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: ed8104e717d84cdec8fa6f5fe532328f4069d5345ea840cec6c6189666d5f214
Instruction ID: 9683f333a8e14d62540df0e9ab5e7d538321fcb7e8b5b53620e3f0f3a8d91dac
Opcode Fuzzy Hash: ed8104e717d84cdec8fa6f5fe532328f4069d5345ea840cec6c6189666d5f214
Instruction Fuzzy Hash: 48A19270604284DFDB15DF64C484BA6BBA2BF59308F2491DED0854F3A2C779EC86CB55

Function 0041B0B3 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041B0BA

Part of subcall function 00408D26: __EH_prolog3.LIBCMT ref: 00408D2D

__CxxThrowException@8.LIBCMT ref: 0041B0F1

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

invalid map/set<T> iterator, xrefs: 0041B0CB

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: 017083ba8ea258ff9433ba5a85fccc0b7058a5835d9df4c7ead8a9be9a854fd9
Instruction ID: 742d078744a99a56ced71e369a19bc91acd4f0d44138151f9fa286e2478d25a0
Opcode Fuzzy Hash: 017083ba8ea258ff9433ba5a85fccc0b7058a5835d9df4c7ead8a9be9a854fd9
Instruction Fuzzy Hash: E5A19F70A04280AFD725DF18C494BEABBA2EF15348F25848ED5454F3A2D77AECC5CB94

Function 004233C0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004233C7

Part of subcall function 00408D26: __EH_prolog3.LIBCMT ref: 00408D2D

__CxxThrowException@8.LIBCMT ref: 004233FE

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

invalid map/set<T> iterator, xrefs: 004233D8

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: a80137766af007c0267ed6b1e5c03f2b343862141ea78b57a719cb293523d925
Instruction ID: b74c025b018219b8595eca592311353f57f3280eb4ee215b6009ba06f7627fc6
Opcode Fuzzy Hash: a80137766af007c0267ed6b1e5c03f2b343862141ea78b57a719cb293523d925
Instruction Fuzzy Hash: 0AA17D706042A09FD722DF18D084B65BBB2AF55309FA484CED1494B3A2D77EEDC6CB58

Function 0040B6A9 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040B6B0

Part of subcall function 00408D26: __EH_prolog3.LIBCMT ref: 00408D2D

__CxxThrowException@8.LIBCMT ref: 0040B6E7

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

invalid map/set<T> iterator, xrefs: 0040B6C1

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: ace2c344d78c18f597d1d93ab910d27558df391451b8e077b75eac3f2d410a3e
Instruction ID: a96cfd8b563fe69badc873900c9a3ad73f087614b11db4257057143c98b35eea
Opcode Fuzzy Hash: ace2c344d78c18f597d1d93ab910d27558df391451b8e077b75eac3f2d410a3e
Instruction Fuzzy Hash: DAA1A471904280DFD725DF28C084B65BBA1EF95308F2580AED5456F3E2D77AEC81CB98

Function 00448473 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044847A

Part of subcall function 00408C7C: __EH_prolog3.LIBCMT ref: 00408C83

__CxxThrowException@8.LIBCMT ref: 004484B8

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

invalid map/set<T> iterator, xrefs: 0044848B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: ecb32ef1fb7dbae0cce3e3ccb5dd60e9a8bfbde01d0fd709606bcd36d345a4ab
Instruction ID: 25a359fbc9bd2b35df714a17901da718df3683bf70eb3847cac4f0d27f162a81
Opcode Fuzzy Hash: ecb32ef1fb7dbae0cce3e3ccb5dd60e9a8bfbde01d0fd709606bcd36d345a4ab
Instruction Fuzzy Hash: 7CA17E70504281DFEB15CF24C084B6ABBE1BF55308F29858ED4554F392CBB9ED86CB95

Function 0043CDEE Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 221COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043CDF5

Part of subcall function 00408D26: __EH_prolog3.LIBCMT ref: 00408D2D

__CxxThrowException@8.LIBCMT ref: 0043CE2C

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

invalid map/set<T> iterator, xrefs: 0043CE06

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: 6068b68a32408ee7e79b3ac50395e5ff3964f89155cb0d8eff926077ccfb3866
Instruction ID: e098eb1b0d2aa4a00257c0c80e34a7d760a9881c7088af03df97d92bcb0fbbb2
Opcode Fuzzy Hash: 6068b68a32408ee7e79b3ac50395e5ff3964f89155cb0d8eff926077ccfb3866
Instruction Fuzzy Hash: 1AA15B70904280DFD715DF24C084B66BBE2AF59308F28D49ED059AF392C779EC86CB99

Function 0042F0CE Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 221COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042F0D5

Part of subcall function 00408D26: __EH_prolog3.LIBCMT ref: 00408D2D

__CxxThrowException@8.LIBCMT ref: 0042F10C

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

invalid map/set<T> iterator, xrefs: 0042F0E6

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: b35cafa44fe3efb0d4acdcf5e8cad72b03e29c3b1d5cea25b0b667cb0162d9b1
Instruction ID: 0d2af778bb7cd04d54ceee56a78322d8103b28f8dac4d2d6b77164c1e65e5555
Opcode Fuzzy Hash: b35cafa44fe3efb0d4acdcf5e8cad72b03e29c3b1d5cea25b0b667cb0162d9b1
Instruction Fuzzy Hash: 4FA1BE70A04260DFDB15CF54E584B66BBB1AF15308FE880AED4454B392C779EC8ACBA5

Function 0044C967 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044C971

Part of subcall function 00407126: _wcslen.LIBCMT ref: 0040712D

Strings

*.*, xrefs: 0044C98B
dJ, xrefs: 0044C9B4

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3_wcslen
String ID: *.*$dJ
API String ID: 3746244732-18091184
Opcode ID: 5518938d7b8e2c558aaf9594aa70e3b974f3ad4cb27daa5e1c527d99392e54ec
Instruction ID: 7d1547d3e33050df3f3b92347906db659550d5c42c05215257bff2c505b5fb86
Opcode Fuzzy Hash: 5518938d7b8e2c558aaf9594aa70e3b974f3ad4cb27daa5e1c527d99392e54ec
Instruction Fuzzy Hash: C671E271C01118ABDF14EFA5D8C2AEDB7B8AF15314F18415BE411772C2DB38AE45CB99

Function 004501A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004501AF

Strings

PSTORES.EXE, xrefs: 00450301

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: PSTORES.EXE
API String ID: 431132790-1209905799
Opcode ID: 5fa8530cbc850ff9ae22e6f3a501eb78444ff76a855c2e2f39336531f37703c9
Instruction ID: f6d308928901910c1651744730b498b1b4a16f7580c72b57cc122f38a740cb5e
Opcode Fuzzy Hash: 5fa8530cbc850ff9ae22e6f3a501eb78444ff76a855c2e2f39336531f37703c9
Instruction Fuzzy Hash: DB514D7680014C9BDF15EFA0CC81AEE37A8AF14355F54016BFD05A7192EB38EA4DCB99

Function 0043D3AE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043D3B5

Part of subcall function 0043CC15: __EH_prolog3.LIBCMT ref: 0043CC1C

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Strings

file://, xrefs: 0043D3E0, 0043D3E8, 0043D40F
%20, xrefs: 0043D4EA

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: %20$file://
API String ID: 431132790-2765206336
Opcode ID: 70cbcb213ac6d4248281b2070267f43cb5a8f10ea330ff9d30ab603b1bf6c4ca
Instruction ID: e8802b8e7489f5c1fbdb663f1b51d7d2a1068f69c26718e6868b4585a88c4e2b
Opcode Fuzzy Hash: 70cbcb213ac6d4248281b2070267f43cb5a8f10ea330ff9d30ab603b1bf6c4ca
Instruction Fuzzy Hash: 60517371904108AADB01EFA5C891AEE77BCAF55308F50846FF005A7182DB786F49CB69

Function 00422EAA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00422EC6

Part of subcall function 00439BC1: __EH_prolog3_GS.LIBCMT ref: 00439BCB

Part of subcall function 004214FB: _wcslen.LIBCMT ref: 00421502

Strings

J, xrefs: 00422F79
Startup, xrefs: 00422F00

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3__wcslen
String ID: Startup$J
API String ID: 1523997010-45827669
Opcode ID: 3fe6de11922791ad7e233c032def5760bf28c776b8b7dbfdc321138744494b00
Instruction ID: 28a4a726078a6bebcf478cafaa553f4fbf7327641db8d8d1d69da2750d840f43
Opcode Fuzzy Hash: 3fe6de11922791ad7e233c032def5760bf28c776b8b7dbfdc321138744494b00
Instruction Fuzzy Hash: 20518A71900248EADB14EFA5CD81BEE77B8AF15308F14416EF501A72D2DB78AF08CB65

Function 00424B4E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00424B6A

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 0040AE09: __EH_prolog3.LIBCMT ref: 0040AE10
Part of subcall function 0040AE09: SetLastError.KERNEL32(?,?,00000000,00000004,0040B187,?,?,00000001), ref: 0040AE74

Strings

Extracting resource: %s, xrefs: 00424CA2
E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 00424CA8

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ErrorLast
String ID: E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp$Extracting resource: %s
API String ID: 1123136255-2144736814
Opcode ID: 5829ef3a73301beb56109312f90e436437daf5e214106b052f4ccee41440c148
Instruction ID: 6e6909b3a879288b3012ff097aade475c36bde687e3891f0685fa7b72c558fec
Opcode Fuzzy Hash: 5829ef3a73301beb56109312f90e436437daf5e214106b052f4ccee41440c148
Instruction Fuzzy Hash: ED517C71900248EFDB05DF65DD46BED77B4EF61308F54406EF802A7192EB78AA08CB69

Function 00424173 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00424195

Part of subcall function 00423F72: __EH_prolog3.LIBCMT ref: 00423F8E
Part of subcall function 00423F72: VariantChangeType.OLEAUT32(?,?,00000000,00000002), ref: 00423FC9
Part of subcall function 00423F72: VariantClear.OLEAUT32(?), ref: 0042414E

_memset.LIBCMT ref: 00424229

Strings

Version, xrefs: 00424239

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3Variant$ChangeClearType_memset
String ID: Version
API String ID: 1256816754-1889659487
Opcode ID: 700ac184071014c60cf42a2f71ddca2218b9bbe30192d112a3db28cfc1d012d8
Instruction ID: f92c35c4ab6475ebb85d68d4c115380af49aeb89ea7451607aa30386976da890
Opcode Fuzzy Hash: 700ac184071014c60cf42a2f71ddca2218b9bbe30192d112a3db28cfc1d012d8
Instruction Fuzzy Hash: B6419E71900148EBDB10EFA5DC45FEEB7B8AF55304F50406AB505F7191EB785B08CB65

Function 0044825B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00448262

Part of subcall function 00408C7C: __EH_prolog3.LIBCMT ref: 00408C83

__CxxThrowException@8.LIBCMT ref: 0044829F

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

map/set<T> too long, xrefs: 00448272

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 1412866469-1285458680
Opcode ID: 175d273884476e93ae7dde8a40f0079a8d855ca0c51425fdde3851841a1f7566
Instruction ID: 73bae4fe5714b7343171d56ffa4f0fa07e4e03b9c3eb1f0b854c3d0d17a2eceb
Opcode Fuzzy Hash: 175d273884476e93ae7dde8a40f0079a8d855ca0c51425fdde3851841a1f7566
Instruction Fuzzy Hash: 70517F306006409FEB15DF59C084B9ABBF1BF15708F19818EE8555F792CBB9EC81CB99

Function 0044B07E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044B085

Part of subcall function 00408C7C: __EH_prolog3.LIBCMT ref: 00408C83

__CxxThrowException@8.LIBCMT ref: 0044B0C2

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

map/set<T> too long, xrefs: 0044B095

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 1412866469-1285458680
Opcode ID: 65db4309a57584bb37025dd0271a1adc0765805e0698968b43a0c790b7eb00ac
Instruction ID: fabfa929093d81cf95a94a550eb3b61a29dd5ce0aca2921f1f1da14ad23e2eb2
Opcode Fuzzy Hash: 65db4309a57584bb37025dd0271a1adc0765805e0698968b43a0c790b7eb00ac
Instruction Fuzzy Hash: 41514A356006409FEB11DF19C594AAABBF1FF1A304F09808EE5495B392D779FC81CB95

Function 0041A288 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041A28F

Part of subcall function 00408CB5: __EH_prolog3.LIBCMT ref: 00408CBC

__CxxThrowException@8.LIBCMT ref: 0041A2C5

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

map/set<T> too long, xrefs: 0041A29F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 1412866469-1285458680
Opcode ID: 87d0de7fa3b10f67cbf3a894cde1b38ca385614f08e1312cebdbe1a314b0d8c4
Instruction ID: b9a4b512db7f9fcf7e4bda275ace8cebd3f53c1e168f0b18b3b3ae7589543f90
Opcode Fuzzy Hash: 87d0de7fa3b10f67cbf3a894cde1b38ca385614f08e1312cebdbe1a314b0d8c4
Instruction Fuzzy Hash: 4B415A346012449FC711DF59C184BAABBE1BF15304F09808EE8599B792D779FCD1CB96

Function 0041051E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00410525

Part of subcall function 00408CB5: __EH_prolog3.LIBCMT ref: 00408CBC

__CxxThrowException@8.LIBCMT ref: 0041055B

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

map/set<T> too long, xrefs: 00410535

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 1412866469-1285458680
Opcode ID: 2054e9dd3c341d4c6eb7c29dd0e81c1d33fe299f4ce75baf100d9f58ef85da2d
Instruction ID: 689d73ca07c0dc6d09da4ba37da7c2e9509f9c0935d1479beedfbec673717ed4
Opcode Fuzzy Hash: 2054e9dd3c341d4c6eb7c29dd0e81c1d33fe299f4ce75baf100d9f58ef85da2d
Instruction Fuzzy Hash: FF411634600240AFDB21DF19C584AAABBF2BF59304F09809AE5495B392D7B9FCC1CB95

Function 0040A626 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040A62D

Part of subcall function 00408CB5: __EH_prolog3.LIBCMT ref: 00408CBC

__CxxThrowException@8.LIBCMT ref: 0040A663

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

map/set<T> too long, xrefs: 0040A63D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 1412866469-1285458680
Opcode ID: 7f881099110c0aa9d766b18a1c68a77eb8432d6bcd22ac3c3a0970938e9954c3
Instruction ID: bf5337a929deea8892bb413adf8ec186829899aa259788f55b3b9357a2315698
Opcode Fuzzy Hash: 7f881099110c0aa9d766b18a1c68a77eb8432d6bcd22ac3c3a0970938e9954c3
Instruction Fuzzy Hash: 2E4160346002419FC711DF19C184AA6BBF1BF55308F0984AEE54A6F392D77AFC91CB96

Function 004309EA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004309F1

Part of subcall function 00408CB5: __EH_prolog3.LIBCMT ref: 00408CBC

__CxxThrowException@8.LIBCMT ref: 00430A27

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

map/set<T> too long, xrefs: 00430A01

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 1412866469-1285458680
Opcode ID: ab4c53a69e97c776275e0306d869f3dbae9a4ad959ee97adfdaf4b7bc409d6b7
Instruction ID: 7b211bfe4749740e8532e1da75d1b98a63391cda23212986c2c1968f5e1cb0df
Opcode Fuzzy Hash: ab4c53a69e97c776275e0306d869f3dbae9a4ad959ee97adfdaf4b7bc409d6b7
Instruction Fuzzy Hash: E5416A30600244DFCB15EF59C094A6ABBF1BF69308F09828EE4459B792C779FC81CB95

Function 0042EF7A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042EF81

Part of subcall function 00408CB5: __EH_prolog3.LIBCMT ref: 00408CBC

__CxxThrowException@8.LIBCMT ref: 0042EFB7

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

map/set<T> too long, xrefs: 0042EF91

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 1412866469-1285458680
Opcode ID: bf556ac234180a8071c8ccccf3ee0f24027b0916c47b5b08da34902dc099ee7f
Instruction ID: b658650cf9ad610831ae42355a2239982be25b92a24dc2dec392fea9ada6278f
Opcode Fuzzy Hash: bf556ac234180a8071c8ccccf3ee0f24027b0916c47b5b08da34902dc099ee7f
Instruction Fuzzy Hash: 5A415830600160DFCB15DF19D184B6ABBF1AF19308F9980AEE8455B392C7B9FD85CBA5

Function 0040F0C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040F0C7

Part of subcall function 00408CB5: __EH_prolog3.LIBCMT ref: 00408CBC

__CxxThrowException@8.LIBCMT ref: 0040F0FD

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

map/set<T> too long, xrefs: 0040F0D7

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 1412866469-1285458680
Opcode ID: 6a1756a35d4999d9b10b6115e446306d25acfd39b427ae0b3304806cf599983e
Instruction ID: a5be481692a3b4d98bd59f6066a1dd6706ae9092a7d075688b3309f65d287f79
Opcode Fuzzy Hash: 6a1756a35d4999d9b10b6115e446306d25acfd39b427ae0b3304806cf599983e
Instruction Fuzzy Hash: EF415634600200DFCB21DF19C484A6ABBF1AF55304F1981BAE849AF792CB79FD85CB95

Function 0042326C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00423273

Part of subcall function 00408CB5: __EH_prolog3.LIBCMT ref: 00408CBC

__CxxThrowException@8.LIBCMT ref: 004232A9

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

map/set<T> too long, xrefs: 00423283

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 1412866469-1285458680
Opcode ID: 4ac679cca63318cd655b3cbd1c5c81a4e73d69e85d92f93759831bfe1b1d31d4
Instruction ID: 798d300d1012c7bbb248e0c7561fa86347fb3336dfedb993e76a7de94da7eae0
Opcode Fuzzy Hash: 4ac679cca63318cd655b3cbd1c5c81a4e73d69e85d92f93759831bfe1b1d31d4
Instruction Fuzzy Hash: 22417A35600250DFCB11DF19C184A9ABBF1BF15308F59808AE9459B3A2DB79FE82CB95

Function 0041B338 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041B33F

Part of subcall function 00408CB5: __EH_prolog3.LIBCMT ref: 00408CBC

__CxxThrowException@8.LIBCMT ref: 0041B375

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

map/set<T> too long, xrefs: 0041B34F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 1412866469-1285458680
Opcode ID: b6aa0ad69439ec3438eea0f0df40cc45a7464de002f46c9c0c3de43509099855
Instruction ID: cc5df4e183325d8a36baf5f5fb9e16c09dc95a73e1138c44d2fbff0b61a3e43c
Opcode Fuzzy Hash: b6aa0ad69439ec3438eea0f0df40cc45a7464de002f46c9c0c3de43509099855
Instruction Fuzzy Hash: 6F4147316006449FCB21DF19C084A9ABBE1FF19308F19808EE9559B7A2D779FCD1CB95

Function 00439139 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00439152

Part of subcall function 0040AE09: __EH_prolog3.LIBCMT ref: 0040AE10
Part of subcall function 0040AE09: SetLastError.KERNEL32(?,?,00000000,00000004,0040B187,?,?,00000001), ref: 0040AE74

Part of subcall function 00416366: __EH_prolog3.LIBCMT ref: 00416388

Strings

%s: %s, xrefs: 004391C3
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 0043921F

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ErrorLast
String ID: %s: %s$C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}
API String ID: 1123136255-4122078509
Opcode ID: d9668d472dec859eed394c3422c57d8acc0c8d73a76c3374ab4788b3f70c41ca
Instruction ID: 6b0a24eb578e0e17489e90e1effeb9dc137f134aac2a36f109b7ddca08a4b0ad
Opcode Fuzzy Hash: d9668d472dec859eed394c3422c57d8acc0c8d73a76c3374ab4788b3f70c41ca
Instruction Fuzzy Hash: FF418D71900248EFDB04EFA5CD85BDE77B4AF14304F14406EF806A7292EB78AE19CB65

Function 004225C9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004225E5

Part of subcall function 00439BC1: __EH_prolog3_GS.LIBCMT ref: 00439BCB

Part of subcall function 004396FA: __EH_prolog3.LIBCMT ref: 00439719

Strings

CertKey, xrefs: 0042261D
C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 004226D9

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}$CertKey
API String ID: 4240126716-2801530750
Opcode ID: ba9475d42a57d7c25ba0a90b4d2d0fb8dcbb23ab7d83d5342fe15919000c6439
Instruction ID: d72a260b324ca2aa2671e61d4efa0f5365468868a9f1ad13a5425d992f522535
Opcode Fuzzy Hash: ba9475d42a57d7c25ba0a90b4d2d0fb8dcbb23ab7d83d5342fe15919000c6439
Instruction Fuzzy Hash: EC316D71900148EBDB00EFA5CD85EDE77B8AF55304F10416BF906A7291EB749F08CB69

Function 0041ABB9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041ABD5

Part of subcall function 0040B2F1: __EH_prolog3.LIBCMT ref: 0040B2F8

Part of subcall function 00407803: SysStringLen.OLEAUT32(?), ref: 00407810
Part of subcall function 00407803: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

GetModuleFileNameW.KERNEL32(?,00000400,00000000,00000400,0000009C), ref: 0041AC21

Part of subcall function 0040B14B: __EH_prolog3.LIBCMT ref: 0040B152
Part of subcall function 0040B14B: GetLastError.KERNEL32(00000038,0040C732), ref: 0040B159
Part of subcall function 0040B14B: SetLastError.KERNEL32(00000000), ref: 0040B1A3

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 0040A7C0: __EH_prolog3.LIBCMT ref: 0040A7D9

Part of subcall function 00415EC8: __EH_prolog3_GS.LIBCMT ref: 00415ECF

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Strings

ISSetup.dll, xrefs: 0041AC37

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ErrorLastString$AllocFileH_prolog3_ModuleName
String ID: ISSetup.dll
API String ID: 2599676116-2131771917
Opcode ID: 50d5d6c2b9823be35fdafa42cb90c18e553eafedd85353b5947cb3b4a9a3f28b
Instruction ID: 4395abeaaf2b5c995749776b8fe7a0d8aafc0fd14bd60cc7e58d6e00adc81410
Opcode Fuzzy Hash: 50d5d6c2b9823be35fdafa42cb90c18e553eafedd85353b5947cb3b4a9a3f28b
Instruction Fuzzy Hash: 95318171904248EFDB05EFA5CC55BDE7BA8AF25344F04406EF501AB191DB78AB08CB95

Function 0044C57E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044C58C

Part of subcall function 00444A08: _memset.LIBCMT ref: 00444A31

Part of subcall function 0040AE09: __EH_prolog3.LIBCMT ref: 0040AE10
Part of subcall function 0040AE09: SetLastError.KERNEL32(?,?,00000000,00000004,0040B187,?,?,00000001), ref: 0040AE74

Part of subcall function 004488C4: __EH_prolog3.LIBCMT ref: 004488E3
Part of subcall function 004488C4: GetModuleHandleW.KERNEL32(KERNEL32.DLL,00000070), ref: 00448902
Part of subcall function 004488C4: GetProcAddress.KERNEL32(00000000,GetSystemWindowsDirectoryW), ref: 00448912

Part of subcall function 00415C78: __EH_prolog3.LIBCMT ref: 00415C7F

Part of subcall function 00415EC8: __EH_prolog3_GS.LIBCMT ref: 00415ECF

Strings

Z, xrefs: 0044C668
Kernel32.dll, xrefs: 0044C5A3

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$AddressErrorH_prolog3_HandleLastModuleProc_memset
String ID: Kernel32.dll$Z
API String ID: 1035139985-2758653402
Opcode ID: d67d3dbeb910b3508a7366bceadabcfb374c7a808c152a09309d1a081ce9b447
Instruction ID: a691cf862d7af8248e0be6045756e58423398a8074c21ce49ab9d73dfaa7a508
Opcode Fuzzy Hash: d67d3dbeb910b3508a7366bceadabcfb374c7a808c152a09309d1a081ce9b447
Instruction Fuzzy Hash: DE21E131945248EEEB04EF65CC91BDD73B4AB22304F18806FE405672C2EF796B49CB69

Function 0044EE7F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044EE89

Part of subcall function 00444A08: _memset.LIBCMT ref: 00444A31

Strings

h7K, xrefs: 0044EF59
%d%s%d%s%d%s%d, xrefs: 0044EF31

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3__memset
String ID: %d%s%d%s%d%s%d$h7K
API String ID: 3055368530-594620399
Opcode ID: 4a21c558b4d6af7ce7ec3f82f53d3c02f5af46cce66f6a6ab629aa3cb9dec232
Instruction ID: 0a1b2bb29a16680c893058d795f1df80ccc593d906000c21837a6d2eac909d04
Opcode Fuzzy Hash: 4a21c558b4d6af7ce7ec3f82f53d3c02f5af46cce66f6a6ab629aa3cb9dec232
Instruction Fuzzy Hash: 39316F719001189BDF14EF96C941AED77B8AF84305F50806FF905A7282EB38AE46DF59

Function 0045161D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00451624

Part of subcall function 0040A976: __EH_prolog3.LIBCMT ref: 0040A98F

Part of subcall function 0043860C: __EH_prolog3.LIBCMT ref: 00438613

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 004514ED: __EH_prolog3_GS.LIBCMT ref: 004514F4

Strings

.EXE, xrefs: 0045163E
SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00451690

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID: .EXE$SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 4240126716-4260402741
Opcode ID: d310346096b2cd28fe5fb78e3cb591e0389c8e84e837a96a50a27fed8a840c1b
Instruction ID: 072921a28a712296f171f4f180f7a3b0ee65cce0e16bc37d9f9b193a7cdec106
Opcode Fuzzy Hash: d310346096b2cd28fe5fb78e3cb591e0389c8e84e837a96a50a27fed8a840c1b
Instruction Fuzzy Hash: A71163F1900248BBDF00FAE5C847BDE7BA89B15344F10401FB9116B193EA795B1987AA

Function 0045B558 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045B576
_memset.LIBCMT ref: 0045B5CC

Part of subcall function 0045B3C6: SetLastError.KERNEL32(0000007F,0045B60E,00000000,00AAC56B,?,?,00000000,00000030,?,00000000,00000010), ref: 0045B3D1

Strings

O, xrefs: 0045B5BC

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: _memset$ErrorLast
String ID: O
API String ID: 821541545-878818188
Opcode ID: dae4a5bfb17f00b337e84be1631ca1b331726c69080809b85811e1b52738c749
Instruction ID: 37626a324314f591ded1185c9fd8a33cb147674385abc358b122c6a324f01842
Opcode Fuzzy Hash: dae4a5bfb17f00b337e84be1631ca1b331726c69080809b85811e1b52738c749
Instruction Fuzzy Hash: 0A2126B0D0024CAADB01DFE9C9809DEFBB8BF09314F50426FE455BB281D7B45A45CBA5

Function 00459786 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 00459815
SetEvent.KERNEL32(00000046), ref: 00459824

Strings

d, xrefs: 0045979D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: Event
String ID: d
API String ID: 4201588131-2564639436
Opcode ID: 4d68c76ad35849661b983fc779f6e55ab145eab8eaafe7dcd9eb3df099d8742b
Instruction ID: 2b0bd38072627f5436390b72dbff980ef83002065edb273d50a026bf186498d5
Opcode Fuzzy Hash: 4d68c76ad35849661b983fc779f6e55ab145eab8eaafe7dcd9eb3df099d8742b
Instruction Fuzzy Hash: C2218C71510704DFCB28DF54D884A66B7F5FF06312F14886BE8468B662C334EC59DB55

Function 00448A95 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00448AAE

Part of subcall function 00444A08: _memset.LIBCMT ref: 00444A31

Part of subcall function 0045D2BB: VerQueryValueW.VERSION(?,?,?,?,?,?), ref: 0045D2F4

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Strings

ISInternalVersion, xrefs: 00448AF8
h7K, xrefs: 00448B2A

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$QueryValue_memset
String ID: ISInternalVersion$h7K
API String ID: 670738438-3652093847
Opcode ID: a889e12c4f8278a216f8a1fba7a1c667609ce8435309221030a1cf6f19e864f5
Instruction ID: 85d3a80b3dcef425a62fd1f82b358620824503a07642b620145854ef52360931
Opcode Fuzzy Hash: a889e12c4f8278a216f8a1fba7a1c667609ce8435309221030a1cf6f19e864f5
Instruction Fuzzy Hash: 23119371A002089BDB04EF55C952BEDB3A4EF54309F50802FF906A7281DBB86E08CB59

Function 0040E6CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,00000000,74DEF550,00000000,00000000,?,kernel32.dll,?,0040EA70,?,?,00000003,74DEF550), ref: 0040E703
__swab.LIBCMT ref: 0040E747

Strings

kernel32.dll, xrefs: 0040E6CD

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: ByteCharMultiWide__swab
String ID: kernel32.dll
API String ID: 87884932-1793498882
Opcode ID: 9f27e7a64eb60796793b3d0fca53dee49c9158bc4c8e6ef6843a92cd7eb7b2be
Instruction ID: f2716c26126244434ac4c19bae51f3c1aec650924f76766abee6beb2cdc7b985
Opcode Fuzzy Hash: 9f27e7a64eb60796793b3d0fca53dee49c9158bc4c8e6ef6843a92cd7eb7b2be
Instruction Fuzzy Hash: 7011C271200104ABDF089E06CC84C7A3729EB90714B24883EF9095B252D63AED62DBA9

Function 00451284 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045128B

Part of subcall function 004091CA: __EH_prolog3.LIBCMT ref: 004091D1

Part of subcall function 0044886C: __EH_prolog3.LIBCMT ref: 00448873

Strings

/REGSERVER, xrefs: 004512BC, 004512F5
/UNREGSERVER, xrefs: 004512C3

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: /REGSERVER$ /UNREGSERVER
API String ID: 431132790-2509393938
Opcode ID: 163a942b3e398dcf4c9538cec79d0170c5bd537b79f0a3ea147c1c765e5b0373
Instruction ID: 72a58f1f5876e019f0aaa955fdab3a62baf64f51b726882b916e81518949b73f
Opcode Fuzzy Hash: 163a942b3e398dcf4c9538cec79d0170c5bd537b79f0a3ea147c1c765e5b0373
Instruction Fuzzy Hash: 6111B6B2D01308BBDF00FAA5C846BAE3BAC9B11354F40446EFC0167182E6788A0887E7

Function 00423170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00423177

Part of subcall function 00439D2C: __EH_prolog3_GS.LIBCMT ref: 00439D33

Part of subcall function 00422737: __EH_prolog3.LIBCMT ref: 00422756

Strings

Type, xrefs: 0042318B
dotnetfx.exe, xrefs: 004231A3

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID: Type$dotnetfx.exe
API String ID: 4240126716-1335848363
Opcode ID: cea843d43593ab380421acde03a773c3e2caabe2094821bf49be8ca6021ec4c0
Instruction ID: a399e91967ef9692d626e97605809b5aa78b4bcbb73aa40b6f428465c837ef1d
Opcode Fuzzy Hash: cea843d43593ab380421acde03a773c3e2caabe2094821bf49be8ca6021ec4c0
Instruction Fuzzy Hash: 6A01A531600208AADB10EA65CC82EEE7378AF55350F50413FF501A71D1DA788F05C758

Function 0043AA33 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043AA3A

Strings

This setup was created with a BETA VERSION of %s, xrefs: 0043AA55
This setup was created with a EVALUATION VERSION of %s, xrefs: 0043AA91

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: This setup was created with a BETA VERSION of %s$ This setup was created with a EVALUATION VERSION of %s
API String ID: 431132790-3771001655
Opcode ID: 59e5e42388b10303a74bc9a4362c071fed9f3970979e1d45f6050ee259e96b10
Instruction ID: a5b17d25539895775754ae0637d406404ec6712584fc57a34328118dc7a9484f
Opcode Fuzzy Hash: 59e5e42388b10303a74bc9a4362c071fed9f3970979e1d45f6050ee259e96b10
Instruction Fuzzy Hash: 8201A570940248AFEB14FFA1C8A2DAD7664AB11744F50802EF491AB1D2EB794F45C799

Function 0041571A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00415721

Part of subcall function 0041569C: __EH_prolog3.LIBCMT ref: 004156A3
Part of subcall function 0041569C: SysStringLen.OLEAUT32(?), ref: 004156D9

SysStringLen.OLEAUT32(?), ref: 0041573E

Part of subcall function 004143F9: __EH_prolog3.LIBCMT ref: 00414400

Part of subcall function 00414905: SysStringLen.OLEAUT32(?), ref: 00414914

Part of subcall function 00414765: __EH_prolog3.LIBCMT ref: 0041476C

Strings

., xrefs: 0041575B

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$String
String ID: .
API String ID: 1535534334-248832578
Opcode ID: b147e14e8039aaa5b9ef7be02832fe25ee266d99e75d8d83e6bf0e50c1f176f3
Instruction ID: 9962509192981b593eb2d84b032384fbd22674b4b56eee9949750176562b6752
Opcode Fuzzy Hash: b147e14e8039aaa5b9ef7be02832fe25ee266d99e75d8d83e6bf0e50c1f176f3
Instruction Fuzzy Hash: 17018070900118ABDB04EFA4CC85AEE7ABCAF86324F10422BB020961D1CB784A44C7A5

Function 00407803 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 00407810
SysReAllocStringLen.OLEAUT32(?,?,?), ref: 0040782E

Strings

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}, xrefs: 00407804

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: String$Alloc
String ID: C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}
API String ID: 143312630-3554130927
Opcode ID: 9856b5f7cf53dfcf28fdd67b137d6e09f5431af0e407b59de77edf3fec9dd408
Instruction ID: 301d1c63be67390855e41ca8d8c78202c07eea175fcb49f9e9e4e4fcb6255f8b
Opcode Fuzzy Hash: 9856b5f7cf53dfcf28fdd67b137d6e09f5431af0e407b59de77edf3fec9dd408
Instruction Fuzzy Hash: 93014B72604600ABD634EF0AC884DA7B7B9EF58301300853EE542E75A0DB70BC45CB69

Function 00470F40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

Strings

"`K, xrefs: 00470F64

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID:
String ID: "`K
API String ID: 0-1081849891
Opcode ID: f40b19c182b639bdd7b6ab91a2ed871c6d3ac5aadadd2b91e6b5c5377eb1b182
Instruction ID: dc73f2e284efcba4132bfb3107064da40c82d1c6dc154ced4078082bf4d9dce8
Opcode Fuzzy Hash: f40b19c182b639bdd7b6ab91a2ed871c6d3ac5aadadd2b91e6b5c5377eb1b182
Instruction Fuzzy Hash: 6CF08172502108FADF20AF54DC12BBA37A4DB40748F10C027F909991D0E3BADA94D399

Function 004522FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00452305

Strings

(DK, xrefs: 0045233B, 00452360, 0045233E
(DK, xrefs: 0045231C

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3
String ID: (DK$(DK
API String ID: 431132790-3066147983
Opcode ID: 60bf1d974e6cf48e365754137e61a9ff9e746e18f12d14aa5d622e8e11f425a9
Instruction ID: 050e5d224476ba9294d5aade40b7667d437f69567ebdd9b84856761345241ad3
Opcode Fuzzy Hash: 60bf1d974e6cf48e365754137e61a9ff9e746e18f12d14aa5d622e8e11f425a9
Instruction Fuzzy Hash: 8E0121B1904204ABCB11DF65D941ACFB7F8BF85704F50861FF455A7681DBB8A904CBA8

Function 0044F38F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044F396

Part of subcall function 004096BA: __EH_prolog3.LIBCMT ref: 004096C1

Part of subcall function 0044DD8B: __EH_prolog3_GS.LIBCMT ref: 0044DD92
Part of subcall function 0044DD8B: RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,00000000,00000444,00000058,0041CCAF,?,-80000001), ref: 0044DDF9

Strings

Software\Microsoft\Internet Explorer, xrefs: 0044F3E6
Version, xrefs: 0044F3CE

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_QueryValue
String ID: Software\Microsoft\Internet Explorer$Version
API String ID: 4174950012-2486530099
Opcode ID: 60fed16115cd27153e379519a9df74ebcd521a49b855a4680316e0d32506b9cf
Instruction ID: c31aee0f5d5b0fc02deb22f3a369d0e1ec030baea1fb3521c60fa4ae422c825d
Opcode Fuzzy Hash: 60fed16115cd27153e379519a9df74ebcd521a49b855a4680316e0d32506b9cf
Instruction Fuzzy Hash: 1101A271E00208BBEF00FB95C807BAD3BB4DB42714F50412AF9206A1C2D7B94B448BD7

Function 004387DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00438806

Part of subcall function 00409EC2: __EH_prolog3_GS.LIBCMT ref: 00409EC9

Strings

PackageName, xrefs: 0043881F
Startup, xrefs: 00438824

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3__memset
String ID: PackageName$Startup
API String ID: 3055368530-2142348390
Opcode ID: e9cbdb988f75241ad1e100dea76226ac235cd53b4b9a5b4685158d658315ac66
Instruction ID: 9d62c41e4b950a3a5eda287130a16db40e822ce6dadd231c1bb57ff62383b36e
Opcode Fuzzy Hash: e9cbdb988f75241ad1e100dea76226ac235cd53b4b9a5b4685158d658315ac66
Instruction Fuzzy Hash: FFF0BBB5A402186BD750EB25DC43FEA73E8AF08704F4050ABE646E71C1ED74AD4C8F98

Function 0044C744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044C74B

Part of subcall function 0040AE09: __EH_prolog3.LIBCMT ref: 0040AE10
Part of subcall function 0040AE09: SetLastError.KERNEL32(?,?,00000000,00000004,0040B187,?,?,00000001), ref: 0040AE74

RegCreateKeyW.ADVAPI32(80000001,-00000008,00000000), ref: 0044C783

Strings

SOFTWARE\InstallShield\Cryptography\Trust, xrefs: 0044C75E

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$CreateErrorLast
String ID: SOFTWARE\InstallShield\Cryptography\Trust
API String ID: 3942452713-595016613
Opcode ID: f815ace20dc1ef2d76103d0c2d43c2e4a2a11d5c960256208b9ec89968a4c0a9
Instruction ID: 0d5e588b24c624e14bf8b283d588e50ceb29338d9510b7a9775079df5b4e4853
Opcode Fuzzy Hash: f815ace20dc1ef2d76103d0c2d43c2e4a2a11d5c960256208b9ec89968a4c0a9
Instruction Fuzzy Hash: CCF0F471850109AFEB04EF91CC96BBD7374EF1230AF54441EF501660A3EBB86A49CFA9

Function 00418D5F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,RunISMSISetup), ref: 00418D73
GetLastError.KERNEL32 ref: 00418D7D

Strings

RunISMSISetup, xrefs: 00418D6D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: RunISMSISetup
API String ID: 199729137-1536503584
Opcode ID: 6b843805a48a9bb664b99f4ffba7078531efe481d5070b02353c4d770c53ef1c
Instruction ID: 966c4a9d2745a01d307b1aa001372da9ca71913ea2f53197270b5380d79d6d9e
Opcode Fuzzy Hash: 6b843805a48a9bb664b99f4ffba7078531efe481d5070b02353c4d770c53ef1c
Instruction Fuzzy Hash: 42E065B1E153109FDBA49B65BD445E327E8DB25705315843FF806D2650EA38D8814A99

Function 0041E833 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041E855
GetTickCount.KERNEL32 ref: 0041E85F

Strings

E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp, xrefs: 0041E84D

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: CountTick
String ID: E:\CodeBases_Majesty_Hotfixes\isdev\src\Runtime\MSI\Shared\Setup\msiaction.cpp
API String ID: 536389180-575188679
Opcode ID: a9e5cff809dbd7e5e9f62aa2cd5b09398b535be24c6b8bdf3f2c159467390af3
Instruction ID: 905f2e7cde9998432f7635d9dd81fff687960a5d19c0ee12c8476ea1c922b477
Opcode Fuzzy Hash: a9e5cff809dbd7e5e9f62aa2cd5b09398b535be24c6b8bdf3f2c159467390af3
Instruction Fuzzy Hash: 0BE06D36508140DEEB11B76BEC49BD6B7E69B91320F0A84A7E814C73A1C778ACC5CB59

Function 004483F5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004483FC

Part of subcall function 00408C7C: __EH_prolog3.LIBCMT ref: 00408C83

__CxxThrowException@8.LIBCMT ref: 0044842E

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

vector<T> too long, xrefs: 00448401

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: vector<T> too long
API String ID: 1412866469-3788999226
Opcode ID: 28e3ce4f3afe6154e2442ac15cc7383e34b18e3f0a3e4b22bf28cd213cb965e8
Instruction ID: 782596ef421c4e7458d989fd169e3d1228e99f8ba67b7857814691385213a389
Opcode Fuzzy Hash: 28e3ce4f3afe6154e2442ac15cc7383e34b18e3f0a3e4b22bf28cd213cb965e8
Instruction Fuzzy Hash: 16E046B18001089ACB40EFD0CC42FDEB7B8AF26305F00012EA200BA081DBBC1609866D

Function 00448434 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044843B

Part of subcall function 00408C7C: __EH_prolog3.LIBCMT ref: 00408C83

__CxxThrowException@8.LIBCMT ref: 0044846D

Part of subcall function 004647EA: RaiseException.KERNEL32(?,?,004659EB,00000000,?,?,?,vg@,004659EB,00000000,004C0CFC,004DB9C0,DD@,00406776,00000000,00000000), ref: 0046482C

Strings

deque<T> too long, xrefs: 00448440

Memory Dump Source

Source File: 00000000.00000002.2103358450.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103333903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103421767.00000000004AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103452950.00000000004D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.00000000004DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103510944.000000000051D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SW-GX-3R(EX)_06293_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: deque<T> too long
API String ID: 1412866469-309773918
Opcode ID: f3255b31fb8645cb28ae1569c818f79a1b666b322e2c14bb3f1d1fae1d80ee9c
Instruction ID: eb205c2e4b7e546f8360453215d926fcfb2174f8ad6aafa258a55e0c67238af7
Opcode Fuzzy Hash: f3255b31fb8645cb28ae1569c818f79a1b666b322e2c14bb3f1d1fae1d80ee9c
Instruction Fuzzy Hash: BEE0B6719501189ACB40EFD1C946FDDB778AF1A305F10412FA241B6081DBBC56088A6D

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SW-GX-3R(EX)_06293_setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\668c33.rbs

C:\Program Files (x86)\GX-3R\FILEMOVE.AVI

C:\Program Files (x86)\GX-3R\GX3R.exe

C:\Program Files (x86)\GX-3R\RKComm.ocx

C:\Program Files (x86)\GX-3R\RkIrDA11.ocx

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GX-3R.lnk

C:\Users\Public\Desktop\GX-3R.lnk

C:\Users\user\AppData\Local\Downloaded Installations\{7DED6250-9973-44A8-BFD0-71491CF41AEA}\GX-3R.msi

C:\Users\user\AppData\Local\Temp\MSI3CCA.tmp

C:\Users\user\AppData\Local\Temp\_is23C4.tmp

C:\Users\user\AppData\Local\Temp\_is23E4.tmp

C:\Users\user\AppData\Local\Temp\_is2444.tmp

C:\Users\user\AppData\Local\Temp\_is2455.tmp

C:\Users\user\AppData\Local\Temp\_is26D7.tmp

C:\Users\user\AppData\Local\Temp\_is3919.tmp

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\0x0409.ini

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\GX-3R.msi

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\Setup.INI

C:\Users\user\AppData\Local\Temp\{29BAAC47-C463-4F5C-90DF-D5756FE7815E}\_ISMSIDEL.INI

C:\Users\user\AppData\Local\Temp\~2443.tmp

C:\Users\user\AppData\Local\Temp\~2454.tmp

C:\Users\user\AppData\Local\Temp\~3918.tmp

C:\Windows\Installer\$PatchCache$\Managed\4BF8EFF1F48E0644780597684F923A24\1.0.56\F1122_Expsrv.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2

Windows Analysis Report
SW-GX-3R(EX)_06293_setup.exe